MeritCore

Privacy policy

Last updated: 23 September 2026

This policy explains what Astrik Winners Portal ("the portal", "we", "us") collects when you visit or use it, why, who can see it, how long we keep it, and what you can ask us to do with it. It covers this website only. Services we connect you to, such as GitHub, have their own privacy policies.

Who we are

Astrik Winners Portal is run by Astrik. For anything about your personal data, including the requests described below, email privacy@resourcefulpvtltd.com.

What we collect

When you visit

  • The pages you open and, once you are signed in, the actions you take, with the time, your IP address and your browser's identification (its user agent). We use this to keep the portal secure and to investigate problems.
  • A random visitor id, held in a cookie until you close your browser, so the pages of one visit can be read together. It is linked to your account once you sign in.
  • If the portal's anti-bot check is switched on, the join form runs a Cloudflare Turnstile challenge, which Cloudflare processes.

When you create an account

  • Your name, email address, password and whether you joined as a client or a freelancer. Your password is stored only as a one-way hash; nobody, including us, can read it back.
  • Optionally, your phone number, used only to send you a confirmation code by text message.
  • The version of the terms you accepted and when.
  • Confirmation and password-reset codes, stored only as hashes and valid for a short time.

On your profile

Everything on a profile is what you choose to write: headline, the kinds of work you do, introduction, location and time zone, years of experience, hours and availability, work preferences, website and LinkedIn links, skills, languages, past projects with screenshots, and a profile picture. Your profile never asks for your date of birth or a government ID number. Identity verification, described below, is separate.

Payment details (how you want to be paid) are encrypted before they are stored.

When you take part in contests

  • Clients: the contest briefs you write, the files you attach, your decisions on applications and entries, the awards you make and the ratings you give.
  • Freelancers: your applications, your entries, the code you push to the private repository created for your entry in a code contest, the files you upload as delivery, and the progress the portal reads from that repository, such as commits and milestones claimed.
  • GitHub: when you connect your GitHub account, we store your GitHub user id and username so we can give you access to your entry repository. Entry repositories belong to the portal's GitHub organisation until an award is paid, when the winning repository is transferred to the client.
  • Ratings: after an award is paid, the client may rate the freelancer with stars and a comment.
  • Your record: a merit score, rank and delivery record, calculated from what you have done on the portal.

Notifications

  • The emails we send you, such as confirmation codes, decisions on your applications and awards. We keep a copy of each email we send.
  • Your notification choices: whether to hear about new contests and winners, and whether by email.
  • If you allow browser notifications, your browser's push subscription (an address at your browser maker's push service, with its keys) and a label for the device.

Identity verification

The portal may ask you to verify your identity before you publish a contest, before you apply to one, or before clients can see your payment details. The check is done by Didit, an identity verification provider: you show your identity document, and usually a photo of your face, to Didit directly, on Didit's own pages.

When Didit has decided, we receive and keep, as proof of the check:

  • the result (approved, declined or in review), Didit's reference for the check and, if it is declined, the reason;
  • what Didit read from your document, such as your name, document type and number, date of birth, nationality, and issue and expiry dates, and the scores of its document, liveness and face-match checks;
  • copies of the images from the check: the front and back of your document, the portrait on it and the photo of your face. We copy them to our own storage server, because Didit's links to them stop working after a while.

Only the portal's administrators can see these details and images. The member's own screens show only the result. Every time an administrator opens one of the images, it is recorded. The information Didit sends us also appears in the administrators' activity log, which is deleted as described under How long we keep it.

Cookies and storage in your browser

We use two cookies. Both are needed for the portal to work. We use no advertising or analytics cookies and no third-party trackers.

  • wp.auth keeps you signed in. It is deleted when you close your browser, unless you tick Keep me signed in; then it lasts one week.
  • wp.visitor holds the random visitor id described above and is deleted when you close your browser.

Your light or dark mode choice and whether the side menu is folded are kept in your browser's local storage, not on our servers. Colours you choose for your account are saved with your account so they follow you from device to device.

Why we use your data

  • To run your account and the contests you take part in: showing your profile to the people who need it, passing applications and entries to clients, creating repositories, and recording awards.
  • To keep the portal safe: confirming that accounts belong to real, reachable people, stopping abuse and spam, and investigating problems.
  • To tell you what you need to know: codes, decisions and awards, plus the announcements you chose to receive.
  • To show the public leaderboard and talent pages, which give credit for work done on the portal.
  • To offer optional AI assistance, described below.

We do not sell your personal data, and we do not use it for advertising.

Who can see what

  • Anyone, without an account: the public list of open contests, including the name of the client who posted each one. If you are a freelancer, the leaderboard and talent pages show your name, picture, headline, location, merit score, average rating and number of ratings, delivery record, wins and whether your identity has been verified.
  • Signed-in members: your profile and contest briefs. Past projects you have not marked as shareable are shown only to you.
  • Clients: a client can see a freelancer's payment details only after announcing that freelancer as the winner of one of the client's own contests, so the award can be paid, and can still see them after it is paid. No other client can see them. If the portal requires identity verification for this, the details are shown only once the freelancer is verified. A client also sees the applications to their own contests, and the code and progress of every entry in them.
  • The portal's administrators: what they need to run and protect the portal, including payment details, the activity log and your identity verification record, with the copies of your identity document and photo.

Services that process data for us

  • GitHub: entry repositories, the code in them and your connected GitHub account.
  • Our email delivery provider: delivers the emails the portal sends.
  • A text message gateway: sends confirmation codes, if you give a phone number and text codes are switched on.
  • Your browser maker's push service (for example Google, Mozilla, Apple or Microsoft): delivers browser notifications, if you allow them.
  • Cloudflare: the anti-bot check on the join form, if it is switched on.
  • Didit: identity verification, if it is switched on. Didit keeps its own copy of your check under its own privacy policy.
  • An AI model provider: optional AI features, if they are switched on (see below).

Files attached to contests and uploaded as delivery, and the copies of identity documents and face photos from identity verification, are kept on our own storage server.

AI features

When the administrators switch them on, some features send text to an AI model provider (Google Gemini, Anthropic Claude or OpenAI, whichever the portal uses) to draft or summarise. For example:

  • a first draft of your profile introduction, from what you have typed on the profile form;
  • suggestions for improving your profile, and matching you to suitable contests;
  • help writing a contest brief, or a draft approach for an application;
  • notes that help a client read applications, entries and progress.

What is sent is the text involved: profile content (never payment details), briefs, applications, and details about an entry's repository such as file names and commit messages. Code itself is sent only if the administrators switch that on.

AI output is shown to people as drafts and notes. It does not accept, reject, rank or pay anyone: scores and rankings are calculated by the portal, and decisions are made by people.

How long we keep it

  • Your account, profile and contest records: for as long as your account exists.
  • The activity log (pages opened, IP addresses, browser details, and what the portal exchanged with the services listed above, including Didit's answers): deleted automatically after 90 days, unless the administrators set a different period.
  • Emails we have sent: kept as a record of what we sent.
  • Identity verification results, the details Didit read and the copies of your document and photo: for as long as your account exists. They are deleted sooner if an administrator resets the check or you start a new check, which replaces them.

Deleting your account

To have your account deleted, email privacy@resourcefulpvtltd.com. An administrator deletes it; you cannot do it from your own screens. When your account is deleted:

  • Removed: your name, email address, phone number, password, GitHub connection, profile picture, notification choices, payment details, registered devices and signed-in sessions; the details and images from your identity verification, including the copies of your identity document and photo; the IP addresses and browser details in the activity log; any reason you gave for withdrawing an entry; and emails waiting to be sent to you.
  • Taken off the portal at once: your profile. It stays in our database, where nothing on the portal reads it, together with a note of when your account was deleted and by which administrator.
  • Kept, credited to "a deleted member": records other people depend on, such as contests, entries, awards and ratings. A paid award must still show that it was paid.
  • Kept: copies of emails already sent to you. A repository transferred to a client after a paid award belongs to that client.

If nothing on the portal refers to your account, it is removed entirely.

Your choices and rights

  • See and correct your data: most of what we hold is on your profile and your notification settings, and you can change it yourself at any time.
  • Stop announcements: turn them off in your notification settings, or use the unsubscribe link in any announcement email. Browser notifications can be turned off in your browser.
  • Ask us for more: email privacy@resourcefulpvtltd.com to ask for a copy of your data, to have something corrected or deleted, or to object to how we use it. We will reply within 30 days.
  • Complain: if you are unhappy with how we handle your data, you can also complain to the data protection authority where you live.

Security

Passwords and codes are stored only as one-way hashes, payment details are encrypted, copies of identity documents can be opened only by administrators and every opening is recorded, pages are served over an encrypted connection, and each role can open only what it needs. No system is perfectly secure, so please use a password you do not use anywhere else.

Children

The portal is for adults entering into paid work. It is not meant for children, and we do not knowingly collect their data.

Changes to this policy

When we change this policy, we update it on this page and change the date at the top.