Draft. This policy is pending approval by the Securinets INSAT board. Until it is approved, the forms on this site stay in “coming soon” mode and no personal data is collected.
Who we are#
Securinets INSAT is a student association hosted at INSAT (Institut National des Sciences Appliquées et de Technologie), 676 INSAT, Centre Urbain Nord BP, 1080 Tunis Cedex, Tunisia. Contact: securinets@insat.ucar.tn.
What we collect and why#
| Form | Data | Purpose | Retention |
|---|---|---|---|
| Membership application | name, email, field of study, year, interests, department, experience, Discord handle, motivation | process your application and contact you | until the application is closed, then 12 months |
| Notify me | email, followed events | one email when registration opens | deleted 30 days after the event, except “all events” followers |
| The Signal newsletter | a monthly email | until you unsubscribe | |
| Partner contact | company, name, work email, interest, message | answer partnership requests | 24 months |
| Hidden-flag submissions | email, flag validity, hashed IP | credit points when the ranking launches | one season |
Every email subscription uses double opt-in: nothing is sent before you confirm from the link we email you. Every email carries an unsubscribe link.
We never store raw IP addresses. Rate limiting and abuse audits use a salted, monthly-rotating hash.
Where the data lives#
Form submissions are stored in Supabase (PostgreSQL) in the European Union (Frankfurt) with row-level security enabled; only the site’s server functions can read or write them. Emails are sent through Resend. The site is served by Cloudflare Pages.
Analytics#
We use Umami, a cookieless analytics service. It stores no personal data and needs no consent banner. No advertising or cross-site tracking is used.
Anti-spam#
Forms are protected by Cloudflare Turnstile. Turnstile may process technical data about your browser to tell people from bots; see Cloudflare’s privacy policy.
Your rights#
Under Tunisian organic law n° 2004-63 on the protection of personal data, and under the GDPR for visitors in the European Union, you can ask to access, correct, export or delete your data, and object to its processing. Write to securinets@insat.ucar.tn. We answer within 30 days.
Hidden flags#
The hidden flags on this site are a game for members (see the ranking page). They are not security vulnerabilities. Real security issues go to security@securinets.tn; see the security page.
Changes#
We will update this page when the forms or providers change. The date at the top is the last revision.