Privacy Policy

This Policy describes what data the Diplace platform (we, the Platform) collects about users, and how we use and protect it. Diplace is an international aggregator of opportunities for young people: internships, grants, olympiads, hackathons, sports and cultural events.

Who processes your data. The personal data operator is ИП Каирова Фарида Жакыпкановна, IIN 650328400996, Республика Казахстан, город республиканского значения Астана, район Есиль, проспект Қабанбай Батыр, дом 58Б, корпус 4. For any question about data: akm.work.acc@gmail.com.

By using the Platform you agree to this Policy. We process data in accordance with the applicable personal data protection law.

We collect only what the features you actually use require:

• Account data (via Google sign-in): email address, name and profile photo. We never request or store your password: authentication happens on Google's side.
• Your display name: the name you chose yourself in Account. Until you choose one, we show the shortened Google name (Name S.).
• In-service actions: saved opportunities and organizer subscriptions.
• Profile (optional): study stage, grade or year, age (optional), interests, fields, goals, English level, hours per week you can spend, your target horizon, your country of residence (needed for the prize), how you heard about Diplace, and a free-text note about yourself (up to 1000 characters). All of it can be edited or left empty.
• Programs and achievements: the stage of each programme (applied or accepted), results (e.g. 2nd place, 50% grant), your notes on them and the proof screenshots you upload.
• Ranking: once you sign up, the shared ranking shows your display name, points and portfolio level. Age, contacts and the achievement list are not shown there. You can remove yourself with a toggle in Portfolio. The ranking page is closed to search engines.
• Public portfolio (only if you enable it): the list of accepted programs and wins becomes visible to anyone holding a link to your page, together with your note on each achievement if you wrote one. It is hidden by default; toggle it in Portfolio. The page is closed to search engines: we forbid crawling and indexing, because it carries a child's name and a list of their wins. But the link can be forwarded to anyone, and whoever receives it sees the page without signing in. The page address is built from your Google name. Neither the ranking, nor the Teams section, nor a school dashboard links to it: only someone you gave the link to yourself can open it.
• An application to an organizer through Diplace (only if you send one): your name, your contact details and your answers to the organizer's questions. This data is passed to the organizer of that program and to nobody else: other visitors never see the application. It is passed only after you tick the consent box that names the organizer. You can send one application per program, and the organizer's answer shows in your account. The form appears only on programs where the organizer has switched on applications through Diplace; on the rest the button still leads to their own site.
• The Teams section (only if you use it): your post (name, what you take on, who you are looking for, the program name), your responses to other people's posts (a display name and a text about yourself) and your contact card: a Telegram handle, a WhatsApp number, Instagram, Discord, email and which one you prefer. A post is visible to every visitor, a response only to the author of the post, and the contact card to no one except the other side of an accepted response: when the author accepts a response, you both see each other's cards. We store responses and their state (awaiting reply, accepted, declined, withdrawn, expired, removed from contacts), reports the two sides file about each other and blocks. Phone numbers, emails, handles and links are not allowed in the text of a post or a response. You can delete the post and the card at any time, withdraw a pending response and remove an accepted exchange from your contacts. The Teams page is closed to search engines.
• Pro waiting list (only if you joined): your account and your email address, and for those who joined before 5 October 2026 also a mark of the gifted day. The email is needed for exactly one thing: to write to you when card payment goes live on the site. This list is not shared with anyone, and it is deleted together with your account.
• Consent at sign-in: the date when you accepted the terms and confirmed your age, and the version of the documents in force at that moment. We keep it so that we can show what exactly you agreed to.
• Reports: if you press Report, we store what the report is about, the reason you picked, your comment and your account. We never tell the author of a card or post who reported it.
• School code: if you arrived through your school's link of the form diplace.app/s/code, that code is remembered and written into your profile once. It credits the school for bringing you here. A school with a Diplace dashboard sees the short name («Aigerim K.»), points and portfolio level of its students, the sign-up date, plus how many programs each of them saved, applied to and got verified. Your email, messages and application texts are never shown to the school. If you leave the ranking in portfolio settings, the school stops seeing you.
• Subscription: whether you have Diplace Pro and until when. Payments happen outside the Platform; we never receive or store card details.
• Technical data: your IP address is processed at the moment data is written, to rate-limit requests and prevent automated abuse; it is not stored in our tables. The sign-in service (Supabase Auth) records the IP address and browser of each sign-in session to protect the account; those records are deleted with the session and with the account. If a page crashes in your browser, we record the error text and the page address (without your email or account identifier) and keep that record for 30 days. Plus anonymous visit and loading-speed statistics (Vercel Analytics and Speed Insights), which use no cookies and cannot identify you personally.

The catalog and filters are available without registration.

We use only the cookies the service cannot work without. There are no advertising or tracking cookies on the Platform.

• Sign-in cookies (Supabase): keep you logged in between visits; up to 400 days, renewed on each visit, removed on sign-out.
• Language cookie: remembers the interface language, stored for one year.
• School code cookie: set when you follow a school link and lives for 30 days, so you can scan the code at school and sign up at home in the evening. It contains no data about you, only the school code, and serves exactly one purpose: to credit the school for bringing you here. If you never sign in, the code goes nowhere and expires after 30 days. It used to last a year; we shortened it to something reasonable.
• Consent cookie: lives for 15 minutes and holds only the edition date of the Privacy Policy you accepted in the sign-in dialog. It is needed because signing in through Google reloads the tab: without it we could not record in your profile which edition of the documents you agreed to.

Answer drafts in the application review are saved in your browser's storage, not on our server. That is convenient, but on a shared computer (a school classroom, for example) you should sign out and clear the site data afterwards.

In addition, the browser storage holds three service marks: the catalog version (so the list is not downloaded again), your chosen colour theme (light or dark) and the last portfolio level shown. They contain no personal data. Besides them, the browser temporarily keeps what you started and have not finished: drafts of your application review text, Teams post and response (erased after sending or after 7 days), and, for the duration of sign-in and no longer than 15 minutes, the action you are signing in for, such as saving a program. All of this stays only in this browser and is not sent to us.

Three features run on the Anthropic Claude or Google Gemini language model: each request is processed by one of them. That means part of the text you enter, and in one case a file you uploaded, is sent to Anthropic or Google for processing:

• Application review: the question from the application and your answer to it (up to 6000 characters) are sent, along with the program description. What comes back is the review: what is already strong, what is missing, how to rewrite it.
• Mentor: your profile data is sent: study stage, grade, university year, age, country, goal, fields and interests, preferred format, English level, how much time you can spend, your planning horizon and your free-text note about yourself, if you wrote one. Together with it go your programs on the Platform: the titles of programs you saved or had an application review for, programs you applied to or are preparing for, your achievements with their result (without places or amounts) and the number of verified ones, and your answers to the steps of earlier plans ("I will do it", "Not for me", "Not now" with the reason). We keep these answers with your Mentor plan while the account exists, so that the next plan does not repeat what you turned down.
• Checking an achievement proof: when a moderator reviews your proof, they can ask the model for a hint. In that case the file you uploaded (a screenshot of a diploma, certificate or admission letter) is sent to the model together with your name from your profile, the programme title and the result you claimed. The model answers whether your name, a date and an organisation name can be read on the image and whether it looks like a genuine document. A human still makes the decision: the model's answer is a hint, not a confirmation. The moderator triggers this by hand, not for every proof.

We do not store the text of your answer. We save the review result, a technical checksum of the text (so that reviewing the same answer twice does not consume your limit) and checksums of individual sentences. The latter let us show what exactly you changed on a re-check. The text cannot be reconstructed from them.

About the program. To give advice that fits the program rather than general words, we read the program's public page in advance and, if it cannot be opened, search for it by title. Such a request contains only the program title and its catalog description: your text never goes there.

Call log. So that neither a bug nor someone's persistence can use the service without limit, every model call is logged: the time, the feature, the model, the number of tokens and the price. The text of the request and the answer is not in the log. Limits run on this log: one request at a time and no more than a few dozen per hour and per day. The log is kept for 90 days.

The review is a model's opinion, not an admissions decision. Do not enter other people's personal data, documents, or anything you are not willing to pass to a third-party service. All three features are optional: if you do not use the application review and the Mentor, nothing is sent to the model, and a proof file goes to the model only if a moderator asks it for a hint.

• provide access to personal features (saved, subscriptions, portfolio);
• match opportunities to you and rank higher the ones that fit your age, interests and goal;
• display your name and photo in the interface;
• compute the shared ranking and the school standings;
• show a school that has a Diplace dashboard its own students: a short name («Aigerim K.»), the points and the number of programs saved, applied to and verified;
• keep the service running and secure, and improve it using anonymous statistics;
• respond to your inquiries.

We do not sell your data and do not use it for ad targeting.

We use infrastructure providers solely to operate the service:

• Supabase: storing account data, the opportunities database and proof files;
• Google: authentication (sign-in with a Google account);
• Anthropic (Claude) or Google (Gemini): text processing in the application review and Mentor features, and the uploaded proof file during a manual achievement check (see section 4). Each request is processed by one of these models;
• Vercel: site hosting and anonymous analytics;
• WhatsApp (Meta): only if you press a contact button, and then the conversation happens inside the messenger;
• Jina AI: reading publicly available program pages when they do not open directly. We send it the address of a third-party page only; your data does not go there;
• Google Search: finding the official page of a program while preparing a review. The program name is sent, not your details;
• The program organizer: if you send an application through Diplace yourself: your name, contact and answers go to the organizer named in the consent checkbox.
• The school whose link you came through, if it has a Diplace dashboard: a short name («Aigerim K.»), points, level, sign-up date and the number of programs saved, applied to and verified (section 5). A student who left the ranking is not visible to the school.

Where data is processed. All of the providers listed are located outside the Republic of Kazakhstan: Supabase and Vercel in the European Union and the United States, Google, Anthropic and Jina AI in the United States. By using the Platform and accepting this Policy you consent to the cross-border transfer of your data to these providers to the extent necessary to run the service. We have no other way to provide it.

The Platform also has Share buttons (Telegram, WhatsApp, X) and links to organizer sites, Google search and our social profiles. Following them takes you to third-party sites governed by their own rules. We do not hand your data to those services: you make the click yourself.

We do not provide data to any other third parties, except where directly required by law (e.g. a lawful request from authorized bodies).

We keep data while your account exists. Deleting the account automatically removes: your profile and questionnaire, your display name, saved items, subscriptions, your programs and achievements with their notes, the proof files, Teams posts, responses, the contact card and blocks, applications sent to organizers through Diplace, Mentor plans, application review results, AI usage counters and the AI call log, the school code and your row in the Pro waiting list.

Periods not tied to the account:

• applications sent to organizers are kept for up to 12 months from submission and are then deleted automatically, even if the account remains;
• posts in the Teams section are kept for up to 12 months from publication and responses for up to 12 months from the response, then deleted automatically; the contact card is kept until you delete it yourself or delete the account;
• reports about cards and posts are kept for up to 12 months after review: they are needed to spot repeat offenders;
• AI usage counters are kept for up to 12 months and serve limits only;
• the AI call log is kept for 90 days;
• hosting logs and browser crash records are kept for up to 30 days; we do not write personal details into them;
• an account not signed into for more than 24 months may be deleted after 30 days of notice to the email on file.

The Platform is intended for youth and school students of all grades. Browsing the catalog is open to everyone without registration. An account can be created from the age of 14. From 14 to 17 a person uses the free features on their own and pays for a subscription with their own money or with a parent's consent; a parent or legal guardian may at any time ask us to delete the account or refund a payment. Both conditions are confirmed at sign-in: they are stated next to the sign-in button, tapping the button means you agree, and the date of that confirmation and the edition of the documents are stored in the profile. If we learn that an account was created by a child under 14, we delete the account and the data linked to it.

Why 14, and why the age differs by country. Under the Civil Code of Kazakhstan, from 14 a person manages their own income and makes small everyday transactions on their own (Art. 22), while below 14 transactions are made for the child by the parents (Art. 23). But in Germany, the Netherlands, Hungary, Lithuania, Luxembourg and Slovakia the law requires a parent's consent below 16, and some countries set their own threshold. We do not verify age with documents and do not ask for a date of birth: that would mean collecting more data about a child than we collect today. So the condition is simple and stated plainly: if your country requires more than fourteen, sign up only with your parent's knowledge. A parent can write to us at any time and demand deletion, and we act on it; how to do that is at the end of this section.

We collect minimal data. The shared ranking shows only the name, points and level: no age, no contacts, no achievement list; one toggle removes you from it, and the page itself is closed to search engines. The achievement list and the personal portfolio page are hidden by default and open only if the user enables sharing. Uploaded proof screenshots are stored privately and are not visible to other users.

A note on applications to organizers. If you apply to a program straight through Diplace, your name, contact and answers go to the organizer of that program. Such a transfer requires your explicit consent at the moment you send it. An organizer sees applications only through their dashboard and only for their own programs; we grant that access by hand and by arrangement. If you are under 18, send the application together with a parent.

A note on the Teams section. A post is visible to every visitor, while contacts are visible to no one: they sit in a private card. When responding, a person writes about themselves, and the author decides whether to accept; only after acceptance do both sides see each other's cards, and nobody else does. The author may decline without explaining, and a person can respond to a post only once. A card may include a WhatsApp number: only the person you accepted a response with will see it. There is no chat on Diplace: you talk in the messenger you choose, under its rules. If the user is under 18, the section should be used with a parent's knowledge, and new people should be met only in public places with adults aware. Any post can be hidden by reports, and either side of a response can report the other: the response closes, the person is blocked for the one who reported, and a moderator reviews the report.

A note on AI. The application review and Mentor features send the text you enter to a third-party model (section 4). If the user is under 18, they should be used with a parent's knowledge.

If you are a parent or guardian and want us to delete your child's data, remove them from the ranking or turn off the public portfolio, email akm.work.acc@gmail.com: we will do it.

You have the right to:

• access your data and learn how it is processed;
• correct inaccurate data: name and profile are edited in Account;
• delete your account and all related data: in the same Account section, or by writing to us;
• download all your data as a single file: the Download my data button in Account; if something goes wrong, email akm.work.acc@gmail.com.

Data access is protected at the database level: a user sees and edits only their own saved items, subscriptions, profile and programs. Proof screenshots live in private storage: accessible only to the owner and a moderator, and the moderator sees them together with the applicant's name and email, as verifying an achievement is otherwise impossible. During review a moderator may send the file to the language model for a hint, and then it goes to the model (section 4). The verified mark is set only by a moderator on the server: a user cannot set it themselves. Service access keys are stored only on the server and are never sent to the browser.

We may update this Policy. The current version is always available on this page with its effective date.

For data processing questions, email akm.work.acc@gmail.com.