Privacy policy

What we collect

ApprenticeHack is the data controller for the information collected through this site. When you create an account and set up your profile, we collect:

• Account data — your email address and password (or Google sign-in credentials if you use that option). Passwords are handled by our authentication provider and are never visible to us.
• Profile data — your name, company or university, apprenticeship type, experience level, the AI tools you tell us you use, how you heard about us, and your chosen avatar.
• Activity data — event registrations and attendance, projects you submit at hackathons, badges you earn, and a log of these activities on your profile.

Some fields are optional — you choose how much to share. You can also set your profile to private at any time.

Why we collect it, and our lawful basis

We use your data to run your account, let you register for events, display your profile and badges, and communicate with you about ApprenticeHack activities. We also use aggregate data (like experience levels and tools used) to plan what to bring to events. We rely on your consent (given by creating an account) as our lawful basis for processing this data. You can withdraw that consent at any time — see "Deleting your account" below.

Where your data is stored

Your account, profile, event, project, and badge data is stored in a PostgreSQL database hosted by Supabase (supabase.com). Some early registration data is also held in a Google Sheet via Google Apps Script, which we used before the current platform was built. We do not sell, rent, or otherwise share your data with anyone outside ApprenticeHack. This site sets no cookies and uses no analytics or advertising trackers.

Third-party services

We use the following services to operate the platform:

• Supabase — database hosting, user authentication, and file storage. Supabase processes your data on our behalf as a data processor. Their privacy policy is at supabase.com/privacy.
• Google — Google Apps Script for legacy registration processing, and Gmail for transactional emails (event confirmations, logistics updates). If you sign in with Google, Google processes your authentication as described in their privacy policy.
• GitHub Pages — hosts the static site files. GitHub does not have access to your account or profile data.

We do not use any advertising, analytics, or tracking services.

Who has access

Only the ApprenticeHack organising team has access to user data, through an admin dashboard secured by role-based access. Access is limited to what's needed to run the community: managing events, awarding badges, reviewing registrations, and communicating with members.

How long we keep it

We keep your data for as long as you have an active account. If you haven't engaged with us (logged in, attended an event, or replied to us) for 24 months, we'll delete your account and data unless you tell us you'd like to stay.

Your rights

Under UK GDPR, you have the right to: access the data we hold on you; have inaccurate data corrected; ask us to delete your data ("the right to be forgotten"); restrict how we process it; receive a copy in a portable format; and object to our processing at any time. We don't use your data for any automated decision-making.

You can exercise many of these rights yourself through your settings page: update your profile, toggle your profile to private, or delete your account entirely.

Deleting your account

You can delete your account from your settings page at any time. This soft-deletes your data — your profile will no longer be visible and your account will be deactivated. If you'd prefer a full erasure, email us and we'll remove all traces of your data from both Supabase and any Google Sheets. Deletion can't be undone — if you want to rejoin afterwards, you'll need to create a new account.

Contact and complaints

You can ask us to access, correct, or delete your data at any time by emailing team@apprenticehack.co.uk, and you can complain to the UK's Information Commissioner's Office at ico.org.uk if you think we've mishandled it.