Privacy Policy | Youth Advance Global

1. Data Controller

Youth Advance Global (“YAG”, “we”, “us”) is the data controller for all personal data collected through this platform. For inquiries, contact privacy@youthadvanceglobal.org.

2. Data We Collect

We collect the following categories of personal data:

Account data: Full name, email address, password hash, country, city, date of birth, gender, phone number, profile photo.
Professional data: Affiliation (university, company, or organization), bio, LinkedIn/GitHub/website URLs, CV uploads.
Application data: Motivation statements, background summaries, track preferences, role selection, research submissions.
Financial data: Payment transaction records (processed by Stripe/PayPal — we do not store credit card numbers). Sponsorship justification statements and income information.
Technical data: IP addresses, browser user agent, session tokens, cookies.
Communication data: Contact form messages, in-platform messages, email correspondence.

3. How We Use Your Data

To create and manage your account
To process and review your conference applications
To process payments and issue receipts
To evaluate sponsorship requests
To send transactional emails (verification, password reset, application updates)
To communicate announcements relevant to your participation
To generate anonymized, aggregate analytics (e.g., geographic distribution of applicants)
To comply with legal obligations

4. Legal Basis for Processing (GDPR)

Contract performance: Processing your application and delivering conference services.
Legitimate interest: Platform security, fraud prevention, anonymized analytics.
Consent: Non-essential cookies, marketing communications.
Legal obligation: Financial record-keeping, responding to legal requests.

5. Data Sharing

We do not sell your personal data. We share data only with:

Payment processors: Stripe and PayPal (for transaction processing only).
Email provider: Resend (for sending transactional emails).
Cloud infrastructure: Vercel (hosting), Neon (database) — all data stored in secure, SOC 2-compliant facilities.
File storage: UploadThing (for uploaded documents and images).

We do not share data with advertisers, data brokers, or social media platforms.

6. Data Retention

Account data is retained while your account is active.
Application data is retained for 3 years after the relevant cohort ends.
Payment records are retained for 7 years (legal requirement).
Contact inquiries are retained for 2 years.
Deleted accounts: data is anonymized within 30 days of deletion request.

7. Your Rights

Under GDPR and applicable privacy laws, you have the right to:

Access: Request a copy of all data we hold about you.
Rectification: Correct inaccurate data.
Erasure: Request deletion of your account and associated data.
Portability: Export your data in a machine-readable format.
Restriction: Limit how we process your data.
Objection: Object to processing based on legitimate interest.

You can exercise these rights from your account settings or by emailing privacy@youthadvanceglobal.org.

8. Cookies

We use essential cookies for authentication and session management. Non-essential cookies (analytics) are only set with your explicit consent. You can manage cookie preferences at any time. We respect the Do Not Track browser signal.

9. Security

We implement industry-standard security measures including: HTTPS/TLS encryption, password hashing (Argon2id/bcrypt), rate limiting, input validation, CSRF protection, and regular security reviews. Despite these measures, no system is 100% secure. We encourage responsible disclosure of vulnerabilities to security@youthadvanceglobal.org.

10. Changes to This Policy

We will notify registered users by email of any material changes to this policy at least 14 days before they take effect.