Privacy Notice
Last updated Aug 29, 2026
This notice explains what personal data CompeteHub collects, why, who sees it, how long we keep it, and what you can do about it.
It is written to be read. Where we do something that works in your favour — or that you might not expect — we say so plainly rather than burying it.
Who is responsible
CompeteHub is the controller of the personal data described here. You can reach us at the address at the end of this notice for any question about your data, including to exercise any of the rights below.
What we collect
We collect only what the platform needs to work.
- Account: your email address, handle, display name, language, date and number formatting preferences, and country.
- Profile, if you create one: headline, biography, years of experience, skills, work experience, education, portfolio links, and a résumé if you upload one.
- Contact details, if you provide them: a phone number, stored encrypted.
- Participation: the challenges you enter, the submissions you make and their contents, and any files you attach.
- Rewards: awards, interview nominations, prize amounts, and payout details if you are owed money. Bank details are stored encrypted.
- Security: a hash of your IP address and your browser’s user agent for each session. We never store your IP address itself.
- Communications: notifications we have sent you, and any report or dispute you raise.
Why we collect it
To run your account and let you sign in. To let you enter challenges and submit work. To judge entries and announce results. To pay prizes and administer interview nominations. To detect fraud, duplicate submissions and abuse. To meet our legal and accounting obligations.
We do not sell your data. We do not use it for advertising, and we do not share it with advertisers.
Who sees your profile — and only with your consent
An organizer cannot see your profile because you entered their challenge. They see it only if you have granted consent, per challenge, and you choose how much: your profile, your profile and résumé, or your profile, résumé and contact details.
Consent is checked at the moment of every read, not stored as a copy. When you withdraw it, the organizer loses access immediately — and any export they had already generated stops working.
You can see who looked
Every time an organizer views your profile, we record it: which organization, which fields they saw, and when. That record cannot be edited or deleted by them, by us, or by anyone — the database refuses.
The full list is in your data export. We think you should be able to check rather than take our word for it.
What is public
Your handle and display name are public. If you win a challenge, the result — your placing and whether you received a cash prize or a nomination — is published on the challenge page and counts towards your track record and the leaderboard.
The state of a nomination is not public. Whether you claimed it, declined it, or how the interview went is between you and that organization.
You can set your profile to private, which keeps it off the leaderboard and out of public view entirely.
Where your data is held
Our servers are currently in Milan, Italy. That means your personal data is transferred outside the Kingdom of Saudi Arabia and processed in the European Union.
We say this plainly because it matters, and because it is temporary: we intend to move to in-Kingdom hosting and are pursuing it. Until then, this transfer is what makes the service available at all, and you should know about it before you sign up.
How long we keep it
Not indefinitely, and not the same for everything.
- Your account and profile: until you delete your account.
- Records of who viewed your profile: two years, then deleted automatically.
- Exports an organizer generates about you: 30 days, then deleted automatically.
- Submissions and results: kept as part of the challenge record, because other people’s results depend on them. The text is removed if you delete your account.
- Financial records: kept as long as the law requires us to keep accounting records.
- Backups: 30 days.
How we protect it
Passwords are hashed with Argon2id and are never stored or recoverable in readable form. Phone numbers and bank details are encrypted in the database itself, not merely on the disk, so a database copy is not a contact list.
Everything travels over TLS and is encrypted at rest. Uploaded files are quarantined and scanned before anyone can see them, and are served from a separate domain so an uploaded file cannot run code against the site.
Sensitive actions — judging, releasing prize money, changing roles, administrative decisions — are written to an audit log that cannot be edited or deleted afterwards. That log never contains passwords, tokens, or amounts of money.
Your rights
You can exercise all of these yourself, from your account, without asking us.
- See and take a copy: download everything we hold about you as a single file, at any time.
- Correct it: edit your profile directly.
- Delete your account: we remove your personal data and anonymise what must remain.
- Withdraw consent: revoke an organizer’s access to your profile at any time, per challenge.
- Object or complain: write to us at the address below. You also have the right to complain to the Saudi Data & Artificial Intelligence Authority (SDAIA).
What deleting your account actually does
We remove your profile, contact details, résumé, saved payout methods, sign-in methods and the text of everything you submitted. Your sessions end immediately and your email address is replaced with one that cannot receive mail.
Some records stay, without your name on them: that an entry was made, results that were published, and records of money that moved. Other people’s results and our legal obligations depend on those. They no longer identify you.
Deleting is refused while something is outstanding — money we owe you, an open dispute, a live interview nomination, or you being the only owner of an organization. In each case we tell you exactly what to finish first. It is never a refusal, only a "not yet".
There is no way for an administrator to export or delete your account on your behalf. That is deliberate: such a path would be one compromised account away from the worst breach we could have.
Children
CompeteHub is not intended for children. You must be old enough to enter into a binding contract in your country to use it.
Changes to this notice
If we change this notice in a way that affects you materially, we will tell you through the platform before the change takes effect. The date at the top always reflects the current version.