Privacy Notice
Version: 2026-09-23 / 1.0 Effective date: September 23, 2026 Responsible organization: Divan Privacy contact: info@divan.ac
1. At a glance
We use information to review applications, organize teams and sessions, run mentoring/judging, communicate with you, protect the platform and maintain appropriate event records. Your private application is not a public profile. We do not sell personal information or give sponsors an applicant mailing list.
Approved participants see a limited directory of approved participants in their event. Approved mentors have a public profile; approved investors appear publicly only if selected as judges. Investors see project summaries/demo links only when teams expressly share them. Public profiles may be indexed or copied by others.
We do not record sessions for publication or subscribe you to marketing merely because you apply. Separate notices and permissions apply to optional publicity, recording, investor sharing and marketing. Contact us to ask questions, request access/correction or discuss withdrawing permission.
2. Information we collect and why
| Information | Purpose and source |
|---|---|
| Name, verified email and sign-in identifiers | Account access, identity verification and event communications; supplied by you or your chosen Google sign-in |
| City/country, LinkedIn, organization and professional role | Application context, professional introduction and team/role matching; supplied by you |
| Skills, experience, availability, participant type, interests and application answers | Assess fit, plan support and help form teams; supplied in your application |
| Team membership, project descriptions, uploads and demo links | Team administration, authorized reviews and event delivery; supplied by you/your lead |
| Mentor expertise, bio, photo, availability and booking link | Assess application, publish the authorized profile and provide restricted booking access |
| Investor interests, bio, photo and optional investment range | Review investor application, restrict investor access and prepare a public judge profile only if appointed |
| Age-18+ confirmation and agreement records | Verify participant eligibility and record the notices/terms and choices presented; date of birth is not required |
| Decisions, internal notes, scores, conflicts and feedback | Fair administration, review, accountability, safety and dispute handling; supplied by authorized admins/reviewers |
| Contact form name, email, subject and message | Respond to inquiries and maintain a private support record |
| Limited technical/session and security records | Operate sign-in, detect abuse, diagnose failures and protect accounts; collected through the platform and providers |
Google sign-in is intended to request identity information such as name, email and account identifier, not access to your email messages, contacts or Drive. You may use an email code instead. Codes and credentials must not be placed in ordinary application or analytics logs.
Required fields are labelled on the relevant form; optional fields may be left blank. Do not include government identifiers, medical details, payment credentials or another person's confidential information in free-text answers. "Nothing further" is acceptable for the final required participant question. We do not seek sensitive personal information unrelated to the event.
3. Who can see what
| Audience | Permitted information |
|---|---|
| Applicant | Their own application, submitted answers, status and intended admin messages; not internal review notes |
| Event admins / Super Admin | Information needed for authorized event administration; Super Admin also manages platform-wide support/security |
| Approved participants in the same event | Directory fields: name, skills/type, public-facing bio/photo if supplied, city/country, role, organization and LinkedIn; never email, phone or private application answers |
| Team members | Their team's roster information, submissions and released feedback under team permissions |
| Authorized mentors | Confirmed teams' review materials; their own feedback and authorized mentoring context, not general private applicant records |
| Eligible judges | Non-conflicted teams' final submissions and their own judging records; no other judges' private reviews or mentor feedback through judge access |
| Approved investors | Only the specific final summary/demo version a team chooses to share and event invitation details |
| Public website visitors | Authorized mentor/judge profiles, event content, and admin-approved winners/finalists with authorized project information |
Mentor feedback is hidden from teams until admin release. After results publication, a team can see only its own released judge feedback and scores. A person with multiple roles has separate permissions; investors do not gain participant/judge privileges merely by being approved as investors. Conflicts restrict judge access and scoring.
Recipients must not scrape, resell or reuse directory information for unrelated solicitation. Nevertheless, no technical restriction can guarantee that a person will never take a screenshot or copy a link. Contact us about suspected misuse.
4. Directory, photos, project sharing and recordings
The planned registration flow asks participants to agree to a limited same-event directory because collaborative team formation is a core part of the program. Before submission we identify the visible fields, audience and purpose. If you have a privacy or safety concern, contact info@divan.ac for an alternative assessment rather than supplying false information. This choice does not cover unrelated publicity.
Mentor and investor forms request a photo and separate public-profile permission. Mentor approval automatically publishes the authorized mentor profile. Investor approval alone does not publish a homepage profile; admin judge appointment publishes the agreed Judge profile. Contact us to request correction or removal. Reuse in unrelated advertising is not included.
Investor sharing is a separate choice made by an authorized team lead for a specified summary/demo version; the lead must have team authority and rights to included personal information. Sharing is not inferred from submitting for judging and is not required to be judged. Withdrawal removes future platform access, but cannot recall information already lawfully accessed or public external links outside our control.
We will identify any proposed session recording, intended audience, publication purpose and retention period before recording, and obtain any permission required by law. Applying or attending is not blanket consent to a promotional recording. Other attendees may see your meeting display name and hear/see what you voluntarily share; meeting providers have their own settings and notices.
5. Service providers and international processing
We use providers for hosting, database/storage, authentication, email delivery, online meetings and, where offered, external booking. They may process information in Canada or other countries, where local courts or authorities may lawfully access it. A Canadian database region alone does not mean all information stays in Canada.
We remain responsible for information under our control and use appropriate contractual and organizational safeguards for processing on our behalf. Independent services you choose, such as a public demo host or a mentor's booking service, also handle information under their own policies. Do not put private files into public links unnecessarily. New registration uses Divan's platform; legacy Formaloo records and historical public directories have separate provenance and will not be newly exposed by migration.
6. Matching suggestions and AI
Where enabled, matching tools may compare relevant skills, experience, interests, availability and team needs to suggest matches to admins. Humans decide what introductions to share. AI does not approve/reject applicants, assign teams, select winners or replace judge decisions.
Before using an external AI provider to process personal information for matching, we will disclose the provider, information involved, processing location and retention practices, and obtain any required consent. We do not authorize general-purpose model training on private applications/submissions as part of this notice. Do not provide passwords or sensitive personal information to a matching tool.
7. Messages and cookies
Application receipts, review decisions, sign-in codes, required event notices and answers to inquiries support your relationship with the event. We will not disguise advertising as an operational message. If we send messages that require marketing consent, we will obtain or identify the applicable lawful permission, identify the sender and provide the required unsubscribe mechanism. Optional marketing has a separate unchecked opt-in and is not required to participate. We do not authorize sponsors to market to you from our applicant list.
The platform uses session/security technologies needed for sign-in and essential functionality. Nonessential tracking must not be enabled on the basis of accepting these participation terms alone. Where required, we provide a separate choice before activation. Disabling necessary session storage may prevent sign-in.
8. Retention, archive and deletion requests
We keep personal information only for identified event, account, support, accountability or legal purposes and as long as reasonably needed for those purposes. We distinguish public historical event content from private applications and review records. Preserving the Summer 2025 public record does not mean retaining every private record indefinitely or making it public.
Legal holds or necessary dispute/security records may justify restricted retention beyond routine periods. We do not promise deletion of records a law requires us to keep. Access to retained records is limited. We review deletion requests individually, including any effect on historical records and backups, and explain applicable limitations and the expected handling period. Public material copied by an independent third party may remain outside our control.
9. Security and incidents
We use safeguards appropriate to the information, such as access controls, protected storage, restricted administrative permissions and logging. No service can promise absolute security. Please report suspected compromise to info@divan.ac, without attaching other people's private data unnecessarily. We assess incidents, preserve necessary evidence, and notify affected people and authorities when legally required. We do not use a disclaimer to avoid those duties.
10. Your choices, requests and complaints
Contact info@divan.ac to ask about our practices, request access or correction, challenge accuracy, request deletion, or withdraw a consent. We may reasonably verify identity, avoid exposing others' information and explain a lawful exception if a request cannot be fulfilled. We respond within applicable legal time limits. Some jurisdictions may provide additional rights, such as objection, restriction or portability, depending on the law and processing involved.
Withdrawal may affect a feature that genuinely needs the information, but will not automatically cancel unrelated roles or justify new disclosures. We will explain the effect and consider alternatives. You may raise a concern with the appropriate privacy regulator, including Canada's Office of the Privacy Commissioner where applicable; you do not have to give up that right or complete an internal appeal first.
Participants under 18 are not eligible for the 2026 competition. If you believe we have collected an ineligible child's information, notify us for prompt assessment and appropriate handling.
11. Changes
We will publish a dated version and notify you of material changes where appropriate. If a new purpose needs consent, we will request it before that use. Updating this notice does not retroactively authorize undisclosed sharing, model training or publicity. Questions may be sent to the privacy contact above.