Blank Page This policy explains what personal data Blank Page ML collects, why, how long we keep it, and your rights. We collect only what we need to run the placement check and the cohort. We don't sell your data, show ads, use analytics, or set cookies.
1. Who is responsible
Blank Page ML (TBR) ("we", "us") runs this website and the cohort. We are the data controller (under the EU GDPR) and the data fiduciary (under India's Digital Personal Data Protection Act, 2023) for the data described here.
For any privacy question, request or complaint, write to hello@blankpageml.tech. This address is also our grievance contact under Indian law.
2. What we collect and why
Placement check
- Email address, to send you one-time login codes and your result, and to allow one attempt per person.
- One-time codes. These are held only in the server's memory for up to 10 minutes and never written to our database.
- Your test: which question set you received, your answers as you save them, your score and per-topic breakdown, start and submission times, and how many times you resumed.
- Integrity counts (18+ only): how many times you looked away from the screen, left the camera frame, had a second face in view, switched away from the test window, or pressed a screenshot shortcut. These are simple numbers, not recordings.
- Consent record: when you accepted these policies, whether you said you are under 18, and, if so, your parent or guardian's email.
The camera check (18+ only)
During the test, a face-tracking model runs entirely inside your browser, on your device. It looks at your camera feed to estimate head position and count the events listed above. No video, images, or face data are recorded, stored, or sent to us or anyone else. Only the resulting counts reach our server.
When you turn on the camera, your browser downloads the model files from jsDelivr and Google Cloud Storage. Like any website, these services see your IP address when your browser requests the files. The camera check is switched off for under-18s.
Application
- Your name, email, year and major, and your answer to "Why this cohort?"
- Whether you asked to be considered for a need-based fee waiver. This tells us something about your financial situation, so we use it only to decide on waivers and treat it confidentially.
- Whether you are under 18 and, if so, your parent or guardian's name and email.
Contact form
If you use the contact form, we receive your name, email address and message by email so we can reply. The message isn't stored in our database.
Technical data
- Your IP address is used briefly, in memory only, to limit how many login codes can be requested. It is not stored in our database.
- Our hosting provider keeps short-lived technical logs of requests (time, page requested, response). We use these only to keep the site running and secure, and they are rotated automatically.
- During the test, your browser keeps a session key in session storage, so refreshing the tab doesn't log you out. It is deleted when you close the tab. We use no cookies, analytics, or tracking of any kind.
3. Legal basis
- Running the placement check and processing applications: steps you ask us to take before joining the cohort (GDPR Art. 6(1)(b)), and your consent (DPDP Act, s. 6).
- Integrity counts and the camera check: your consent, given before the test starts (GDPR Art. 6(1)(a); DPDP Act, s. 6). You can decline by not taking the check.
- Security logs and rate limiting: our legitimate interest in protecting the service (GDPR Art. 6(1)(f)).
- Fee waiver information: your explicit request and consent.
4. Who processes data for us
We use a small number of service providers, who process data only on our instructions:
- Microsoft Azure: hosting and our database (Germany West Central region), and sending emails (Azure Communication Services, with data location Germany).
- Cloudflare: domain name service, delivering the website, and forwarding email sent to hello@blankpageml.tech.
- Google (Gmail): our staff inbox. When you finish the placement check, a summary of your result and integrity counts is emailed to us for review.
- jsDelivr and Google Cloud Storage: delivering the camera model files, and only if you turn on the camera.
If you join our Discord server, Discord's own privacy policy applies to what you share there. Some providers may process data outside your country; where they do, they rely on recognised safeguards such as the EU Standard Contractual Clauses. We never sell or rent personal data.
5. How long we keep it
- Login codes: up to 10 minutes, in memory.
- Placement results, integrity counts, and applications: until 12 months after the cohort ends, then deleted. Our database also automatically removes its oldest records once it reaches a small size limit.
- Technical logs: rotated automatically, usually within days.
You can ask us to delete your data earlier at any time.
6. Your rights
You can ask us to:
- give you a copy of your data
- correct it
- delete it
- restrict or object to its use
- withdraw your consent at any time. This doesn't affect processing we've already done.
Email hello@blankpageml.tech and we'll reply within 30 days.
You can also complain to a data protection authority: in the EU, the authority in your country or in Germany; in India, the Data Protection Board of India, after first contacting us.
7. Children
If you are under 18, a parent or guardian must agree to this policy and the Terms for you, and we record their contact details. For under-18s, we switch off the camera check and window tracking. A parent or guardian can exercise any of the rights above on the child's behalf.
8. Security
The site is served only over HTTPS. Test answers are graded on our server, which keeps the answer key private. Access to stored data is limited to the operator. No system is perfectly secure, but we keep what we store to a minimum.
9. Changes
If we change this policy, we'll update the date above. If a change affects how we use data you've already given us, we'll email you.