Data Use Policy
Last updated: 5 September 2026
This policy supplements the Privacy Policy with a concrete breakdown of every data point the ARKFEST 26 portal collects, why it is needed, and when it is deleted. If the two documents conflict, this one governs on matters of data processing; the Privacy Policy governs on rights and contact.
Account Data
| Field | Purpose | Retention |
|---|---|---|
| Name | Display in dashboard, QR ticket, certificates, team rosters | 12 months post-event |
| OTP login, registration confirmation, payment receipts | 12 months post-event | |
| Phone | Emergency contact during on-campus events | 12 months post-event |
| College | Eligibility verification, inter-college statistics | 12 months post-event |
| Password hash | Authentication (bcrypt, never stored in plaintext) | Deleted with account |
Registration Data
| Field | Purpose | Retention |
|---|---|---|
| Event selection | Seat allocation, check-in matching | 12 months post-event |
| Team name & members | Team events: roster display, QR per team, judging | 12 months post-event |
| QR ticket ID | Unique scan-once token for venue entry | 12 months post-event |
| Check-in timestamp | Verify attendance for certificates & seat tracking | 12 months post-event |
Payment Data
Card numbers, UPI PINs, and bank credentials are never transmitted to or stored on our servers. Razorpay handles all sensitive payment information under PCI-DSS compliance.
| Field | Purpose | Retention |
|---|---|---|
| Razorpay order ID | Link registration to payment, reconciliation | 12 months post-event |
| Razorpay payment ID | Payment verification, dispute reference | 12 months post-event |
| Amount & status | Confirm correct charge, financial audit | 12 months post-event |
Technical Data
| Field | Purpose | Retention |
|---|---|---|
| IP address | OTP brute-force rate limiting, abuse detection | 30 days (server logs) |
| User-agent | Debugging rendering issues, browser compatibility | 30 days (server logs) |
Third-Party Data Sharing
We share data only with the services required to run the event:
- Razorpay — receives the minimum data needed to create a payment order (user email, amount, order ID). Razorpay processes this under its own terms.
- Resend — receives email addresses and names to deliver OTP codes and registration confirmations. No marketing emails are sent through Resend.
- SAGE University administration — receives participant lists (name, college, events attended) for Google-branded certificate issuance and campus reporting.
We do not sell, rent, or trade your data. We do not share data with advertisers, analytics platforms, or any party not listed above.
Data Stored on Your Device
localStorage— JWT authentication token, cart contents (event IDs and quantities), UI preferences (e.g. Spidey easter egg toggle). No personal data beyond the signed JWT is stored client-side.- Cookies — the portal sets no cookies. Third-party payment/email services may set their own cookies on their domains during redirect flows.
Deletion & Anonymisation
12 months after ARKFEST 26 (i.e. after 3 October 2027), all personally identifiable data is either:
- Deleted — accounts, participant records, team rosters, payment references.
- Anonymised — aggregate statistics (registrations per event, attendance counts) may be retained for future fest planning with no link to individual identities.
You may request early deletion by emailing arkfest26@gmail.com, subject to any pending payment obligations.
Contact
Data use questions? Email arkfest26@gmail.com.