What we hold, and for how long

Startup Ashoka 2026 is the flagship annual event of the InfoEdge Centre for Entrepreneurship at Ashoka University. The Centre owns the competition: the registration, the rules, the judging and the prizes.

This platform is built and run by Atlas, a startup initiative founded by two students, Bobby Yu at the University of Surrey and Ramit Sachdev at Ashoka University, on a single mission: to empower entrepreneurship. We are grateful to the Centre for the opportunity to serve its flagship event. Atlas is not part of the Centre or of Ashoka University, is not a registered company, and holds your information separately from the Centre.

Two organisations therefore hold information about you, for different reasons. This notice covers what Atlas holds. Your registration, your payment, your entry and your result belong to the Centre, and the Centre is the right place to ask about those.

Two places, and the order matters.

From the Centre

When you register and pay, the Centre’s form records your details and passes them to Atlas so the platform can recognise you when you sign in. That happens before you have signed in and before you have seen anything of ours.

From you

Everything you enter here after signing in: your profile, your idea, your team, and the message you send with an invitation.

Item by item, because “contact details and usage data” tells you nothing.

From your registration

Your name, Ashoka email address, contact number, what you told the form about having an idea or a team, and your answer to its Enrolment Program question. That answer is which degree you are on rather than what you study: UG with the year you started, or Masters, YIF or PHD. We are not told your subject. If you are an undergraduate it also tells us your year of study, which we work out from it rather than asking you twice. We also hold whether the Centre has marked your payment as verified and when, and nothing else about the payment.

When you sign in

You sign in with the Google account the University administers, and no password ever reaches Atlas. If you are turned away at the door we record the address you tried and why, whether that is because the Centre has not registered it or because your payment is not marked verified yet, so support can find a typo or a wait and let you in rather than leaving you locked out.

Your profile

A short bio, your skills, the tracks that interest you, your idea and whether you want it shown, and a picture chosen from a set we provide. There is no photo upload. Your contact number is copied here from your registration and you can change it; the original stays as you submitted it.

Your settings

Whether teammates may see your number, whether your idea is shown, whether you appear in the participant list, whether we email you when something is waiting, and light or dark mode. Your text size is remembered too, but only by your own browser rather than by us. Section 7 lists everything kept on your device.

Your acknowledgement

That you read this notice and accepted the terms, and when.

Your team

The team name, the track, what the owner has written that the team is building, the group chat link the owner adds, who is in the team, and the invitations and requests to join sent and received, including the short message either can carry.

How you use the platform

Signing in, how far you reached in setting up your profile, when teams form, when we last emailed you, and that you ran a search, never what you typed into it. It is how we find where people get stuck; the date of that email is how the platform keeps to one a day; and the search record exists only to stop the participant list being worked through mechanically.

What organisers do

Every action an organiser takes with their privileges: who did it, what they did it to, and the value before and after. It is why a change to your account can always be traced to a person, and why a correction to your name or email leaves a copy of the old one.

The hand-in exists, from the moment the event starts. Your team hands in links, not files: each one points at something your team keeps in a storage account of its own, and Atlas stores the link, the name of whoever on your team saved it, when, and what a stranger got when the platform opened the link once with no account, so that your team can see it will open for the judges. Every save is kept, so a broken link can be put back to an earlier one by an organiser. What your team hands in is not a private submission: the judges open it to score it, the organisers see every team’s links, and part of it is shown to every other participant, who can each mark it as a favourite; that is part of entering, not a choice, and the platform keeps which participant marked which team. The judges’ marks and notes are recorded against the judge and are visible to the organising team, who use them to decide results; participants never see them, and published results show outcomes only. When the organisers publish a result it appears on this platform, and each member of a team named in it is sent one email saying so. An organiser can also switch one account to see these screens before the event starts, to check them; that switch is a flag on the registration and is logged.

To run this event. That is the whole of it.

• Confirming that whoever is signing in is somebody the Centre registered.
• Showing you other participants so you can find teammates, and them you.
• Making teams work: invitations, membership, and the handover to your own group chat.
• Telling you by email that something is waiting for you here, at most once a day and only when there is. The email never says what it was, and a switch on your profile turns it off.
• Running the hand-in, the judging and the participants’ vote from the moment the event starts, and emailing each member of a team named in a published result, once.
• Supporting the Centre in running the competition.
• Answering support requests and fixing things when they break.
• Finding out where the platform confuses people, from counts of what people did rather than from reading what they wrote.

None of this is a choice, and we will not present it as one. You cannot take part in Startup Ashoka without the platform holding your registration details, so asking for your consent to that would offer a choice that is not really there. The screen at first sign-in asks you to acknowledge it instead: to read what is held, and confirm that you understand it. If you would rather Atlas did not hold your details, the way out is to withdraw from the competition with the Centre.

The part worth reading twice, because it is the one people assume rather than check.

Any other participant

Your name, picture, bio, skills and track interests, your enrolment programme and year of study, whether you are already in a team, and your idea if you have chosen to show it. Not your email address, not your phone number, and nothing about your payment.

Your teammates

The same, plus your phone number unless you switch that off, and the rest of your team: who is in it, and who owns it. The number is there so you can start a group chat. Atlas has no messaging of its own, deliberately, so that chat is somewhere else and this notice does not reach it.

Everybody, about teams

Every team is visible to every participant as a card showing its name, its track, how many people are in it, what its owner has written that the team is building, and who is on it: each member’s name and picture, which open that person’s card, with the owner marked as such. The switch below takes you off those cards as well, and a team of four with one person hidden shows three and says that one is not shown.

Anyone searching

Searching for an exact email address or an exact name tells someone whether that person is here, and shows them the name, whether they are already in a team, and whether they have finished setting up. It never shows an email address or a phone number, it needs the whole address rather than part of it, and each account is capped to a set number of searches an hour.

Organisers and support staff

Everything in section 3, including your contact details, your payment status and whatever you have written about yourself, because they need it to repair an account or fix a team at 03:00. Their console shows them a narrower slice, but their permissions are the wider one, and we would rather tell you what they can see.

Judges

What your team hands in, and your team’s name and category. Nothing about you as an individual: no profile, no contact details, no list of who is on the team. Their marks and notes go to the organising team, and never to participants.

The Centre

Everything, on request. It is the Centre’s event.

What you write is checked against word lists before it is stored. A short list refuses some wording outright; a longer one blocks nothing and records a mark for organisers while the text goes live; and the message you attach to an invitation, or to a request to join a team, is checked against a narrower list that only ever refuses, because the person you sent one to would have read it long before anybody looked. The terms of use set this out field by field. These checks look for nothing else, and nothing tells you when a mark has been recorded, with one exception: if what your team is building trips the longer list, your team is shown a line saying an organiser has been asked to look and that it is still showing on the card in the meantime. Nothing equivalent is shown for a marked bio, idea or team name.

Every cookie this platform sets is its own, and none of them is for advertising or for tracking you. There are five and they exist to keep you signed in: your sign-in token and the token that renews it; two short-lived cookies that carry you through the hop to Google and back, one proving the trip is yours and one remembering the page you were heading for, both deleted as soon as you land; and your “keep me signed in” preference, which is a preference rather than a credential and so is left alone when you sign out.

Your browser keeps six small things of its own, and not one of them reaches us. Light or dark mode and your text size, so the page is not the wrong colour or the wrong size for a moment on the way in; three notes of which walkthroughs you have already been shown, so they are not replayed at you; and one note that you have been told your phone number can be edited. They live in your browser’s own storage rather than in a cookie, we cannot read them, and clearing your browsing data clears them.

Vercel’s page-view counter is built into the site, and it is the only measurement of any kind on it. It sets no cookie and writes nothing to your device. For each page you open it records the address, the time, the page you came from, roughly where your connection is, and your browser, operating system and device type. To tell one visit from another it makes a scrambled value out of your request, which Vercel says is discarded after a day. We have set it to cut off the part of an address after a question mark before the count is sent, so the address of the page you are on reaches Vercel and whatever was attached to it does not. That trim is on the page’s own address. The page you came from is reported by your browser rather than by us, and reaches Vercel as your browser sends it.

We would rather describe that than call it anonymous: a page, a time, a rough location and a browser version are still information about a visit.

The records Atlas keeps about you contain no IP address, no browser fingerprint and no location. Two exceptions: the sign-in system underneath records the address you signed in from, as sign-in systems do, and the companies in section 8 keep their own short-lived server logs, which are theirs to describe rather than ours.

Atlas is two people; the machinery underneath belongs to other companies. These are all of them, named rather than described as “our service providers”. All four are used on their ordinary published terms, because Atlas is not big enough to have negotiated anything special with any of them.

Supabase

Runs the database, and therefore holds everything the platform stores. The database and its backups sit in a data centre in Mumbai. Supabase itself is a United States company. That is a statement about the database and not about everything: email is the exception, and Resend is below.

Vercel

Serves the pages, and so sees the requests your browser makes for them. It also provides the page counter in section 7. A United States company; the parts that run our code run in Mumbai.

Resend

Sends the platform’s email, and so sees your name, your email address and the message. A United States company. Its sending region is Tokyo, so an email addressed to you is the one thing on this platform that is handled outside the Mumbai region. The only other thing that goes with it is a short scrambled code standing for you, which is there so that a failed send retried a second later cannot reach you twice; it is not your name, your address or anything readable about you. The message itself is not kept once it has been sent.

Google

Three things, and the second has only been true since 2 September 2026. It provides the sign-in, using the Ashoka account the University already administers for you; it sees the sign-in, and Atlas never receives or stores a password. It holds the Centre’s registration form and its responses, which the platform now reads directly: that is how your registration becomes an account without anybody retyping it. And it hosts Atlas’s own mailbox, so a question or a request you send us arrives there.

The Centre

Not a supplier but the other half of the picture: the Centre gave us your registration details and receives your submission after the event.

What the platform can read of that form is deliberately narrow. It holds no Google password and no long-lived key of its own. It proves its identity to Google each time and is handed a credential that lasts five minutes and can read spreadsheets and nothing else. It has no access to Drive at all, so if you attached a payment screenshot to your registration, the platform cannot open it. That is a property of the credential rather than a promise about what we do with it.

What is actually in place, described rather than certified.

• The rules about who can read what are enforced by the database itself, not by the pages you see. A page cannot decide to show you something the database will not hand over.
• The organiser console holds no master key. It runs on the signed-in organiser’s own account and cannot override those rules, which is a property of how it is built rather than a policy someone has to remember.
• Atlas never receives or stores your password, because you sign in through Google. Judges and administrators use accounts we create for them with a password, and those are not participant accounts.
• Everything is encrypted in transit, and the database is backed up daily.
• Access to the database and the hosting is limited to the two of us. Nobody else has an account on any of it.
• Every privileged action is written to a record that cannot be edited from inside the platform.

31 October 2026

Everything Atlas holds, including the records of people who registered and never signed in, and of people whose sign-in was refused.

What your team submits

It is the Centre’s, because it is the Centre’s competition and the Centre keeps the entries. Atlas holds links, not files. After the event it passes your team’s links to the Centre, and deletes the links, the saves, the marks and the favourites it holds on 31 October with everything else. The files themselves are in an account of your own and we never touch them.

Counts

Numbers that identify nobody, such as how many people registered and how many teams formed, may be kept beyond that date with the Centre’s agreement.

The deletion is carried out by a person on the day rather than by a program running on a timer, because we would rather someone had to look at it than have participant data disappear unattended. And we do not describe any of this as making your data anonymous: with three hundred students carrying a programme, a year, a team and a set of timestamps, it would not be true.

The first two of these are switches you control yourself. The rest are requests to either address in section 13, and none of them needs a reason.

Hide yourself, right now

The switch on your profile takes you out of the participant list, out of search and off your team’s public card immediately, and you can switch it back. The same goes for hiding your number from teammates and hiding your idea from your card.

Stop the emails

The same profile page has a switch for the “something is waiting” email, and the link at the foot of every one of them goes straight to it. Turning it off stops that email and nothing else is affected: your account, your team and your invitations all carry on, and you see them when you open the Team tab. It does not stop the Centre writing to you about the competition itself.

Ask what we hold

We will tell you, and send you a copy. There is no export button in the platform; a person prepares it by hand.

Correct something

Most of it you can edit yourself. Your name and your email came from the Centre and are corrected by asking us. We would much rather fix a typo than have you carry it.

Ask us to remove you

At any time, and no reason is needed. It does mean you can no longer use the platform, and taking part in Startup Ashoka runs through it, so in practice this is how you withdraw. Whether you stay registered with the Centre is between you and the Centre. If you are in a team we will tell you what removal does to your teammates before we do it, because that part cannot be undone.

Complain

To us first, if you are willing, because we would rather hear it. Beyond that, to the Centre, and to Ashoka University, which has people whose job this is. India’s data-protection law also provides for a Data Protection Board once the relevant parts of it are in force, and nothing here is meant to stand between you and any route open to you.

We will reply within seven days. That is our own commitment rather than a legal minimum, and it is deliberately shorter than anything the law would require of us.

We have written down what we would do if information here were exposed or lost: what counts as a breach, who decides that it is one, who is told and in what order, and what happens if the person who normally handles it cannot be reached. We have not yet given the Centre a copy, and we will say here when we have.

If your information were caught up in something like that we would tell you, through the Centre and on the channels it uses to reach participants. We would say what happened, what of yours was involved, what we had done about it, and what you might want to do yourself.

The limits of that, stated rather than left out: the plan has been written but has never had to be used, and no restore from backup has been tested end to end. We are not going to promise you a date for that test, because we have already passed one.

Two routes, deliberately, because either may be the right one depending on what you are asking. Neither is a formal office with a statutory title; they are the actual people.

The Centre

InfoEdge Centre for Entrepreneurship, Ashoka University, entrepreneurship@ashoka.edu.in, best for anything about the competition, your registration or your entry.

Atlas

Bobby Yu and Ramit Sachdev, admin@itsatlas.org, best for anything about this platform and the information it holds. It reaches both of the people who actually hold the database.

For a copy of what Atlas holds, a correction to it, or deletion, write to Atlas. We hold the database, so a request that comes straight here is one we can answer straight away. Anything about the competition, your registration or your entry is the Centre’s. Neither is a gate: if you pick the one we would not have picked, nothing is lost and nothing is delayed by more than the message it takes us to pass it on, which we will tell you we have done.

This is version 1.7, published on 24 September 2026. Version 1.6 was published on 21 September 2026, version 1.5 on 18 September 2026, version 1.4 on 17 September 2026, version 1.3 on 8 September 2026, version 1.2 on 3 September 2026, version 1.1 on 26 August 2026 and version 1.0 on 21 August 2026. What changed in each is below.

Version 1.7 is the one section 3 promised: the hand-in and judging screens now exist, and this page says what they hold. From the moment the event starts your team can hand in links, and the platform keeps each link, who saved it, when, and what a stranger got when it opened the link once with no account. New readers: the judges see what your team hands in and your team’s name; the organisers see every team’s links and every judge’s marks and notes; and every other participant sees part of what your team hands in and can mark it as a favourite, which the platform records against their account. New things kept: the links and their save history, the judges’ marks and notes recorded against the judge, each participant’s favourites, and a flag an organiser can set on one registration to see these screens early, which is logged. One new purpose: emailing each member of a team named in a published result, once. Nothing goes to any new company, nothing further is shared with the ones already named, participants never see a judge’s marks, and the deletion date is unchanged: all of it goes on 31 October with everything else.

Version 1.6 adds something rather than correcting something, and it is the first version of this page that does. The platform can now send you one email a day when something is waiting for you on your Team tab. The email says only that: not who, not what, not the message anybody wrote to you, because those stay on the platform. There is a switch on your profile that turns it off, and a link to that switch at the foot of every one of them. Section 3 now lists that setting and the one new thing we keep because of it, which is the date we last emailed you; section 4 lists the sending as a purpose; and section 11 tells you how to stop it. So this version does collect something new, and we would rather say that than repeat the sentence below. It is one date per person, nothing about you is shared with anybody who did not already have it, and the deletion date is unchanged. One new company is involved, and it is the reason to read the box in section 7 again: the organisers can now post an Instagram reel into the announcements, and an Instagram post drawn on a page you are reading is fetched by your browser from Instagram, which sets a cookie of its own when it answers, whether or not you watch the video and whether or not you have an account there. Nothing about you is sent to them by us; what reaches them is the request your browser makes. And one leaves: Vimeo, which the platform never used, is no longer shown inside it.

Version 1.5 is six corrections, found by checking this page claim by claim against the code. Section 2 now says the invitation email is the only notice somebody who never signs in receives if they are invited, because that email only goes out once a payment is verified. Section 3 now corrects how your payment screenshot is kept from us: it is not removed before it reaches Atlas, our importer simply has no field for it and never writes it down. Section 6 now says the public card marks who owns a team, and that a team is told, not left wondering, when what it is building trips the longer word list. Section 10’s retention count now says “that date” rather than “those dates”, because there has been one date since 28 August. And this section’s own opening sentence now says 1.5 rather than repeating 1.4’s number, so the banner and this page agree from the first day this version is served. Nothing new is collected, nothing is kept for longer, and the deletion date is unchanged.

Version 1.4 corrects one thing, and it is about being turned away at the door. Section 3 said we record the address you tried when the Centre has not registered it. Since 5 September that is not the only reason: a registration the Centre has not yet marked as paid is also turned away, and that attempt is recorded the same way, with its reason. The section now says both. Nothing new is collected, nothing is kept for longer, and the deletion date is unchanged.

Version 1.3 tells you two things about companies already named here that this page did not say before. Google does more than provide the sign-in: it holds the Centre’s registration form and its responses, which the platform has read directly since 2 September 2026, and it hosts the mailbox you would write to. And our mail provider’s sending region is Tokyo, which makes an email the one thing here handled outside the Mumbai region. Neither is a new company, neither collects anything new, and the deletion date is unchanged. Both were true before this page said them, which is why they are written as a correction rather than as a change. Section 8 carries both, along with the limit on what the platform can read of that form.

Version 1.2 was mostly correction: it described what the platform actually holds and does, and dropped several sentences that described what we had asked for or intended rather than what exists. Two things were more than that: section 11 says that asking us to remove you costs you the platform, and section 3 no longer names how a hand-in might be shown to other participants, only that it might be. If we change this notice again we will say so here, with the date and what changed, rather than replacing the page quietly. The one change we already know is coming is section 3’s paragraph about the hand-in and judging screens, before those screens open.

This notice is written in English only. We cannot produce it in other languages, so please write to either address in section 13 and we will explain any part of it.

The other two pages are the terms of use, which set out the basis on which you use the platform, and the code of conduct, which is about how people treat each other here.