Privacy notice
Your Fellowship data, explained.
Last updated: 5 August 2026
This notice supplements the general UgurLabs Privacy Policy and applies when you create an account for, apply to, or participate in the UgurLabs Fellowship.
Controller
Ugurlabs UG (haftungsbeschränkt), Fährstraße 217, 40221 Düsseldorf, Germany. Email: support@ugurlabs.com. Further company details are available in the Legal Notice.
Personal Data We Process
Account and authentication data
Clerk user ID, verified email address, display name, authentication and verification events, session information, and security signals. UgurLabs does not receive your plain-text password.
Application data
Public display name, country code, adult confirmation, optional personal blog and YouTube channel URLs, projects used, sharing approach, motivation, intended AI use, applicable rules version, application status, decision message, and private administrator notes.
Submission data
Content type, title, public and canonical URL, publication date, project covered, intended audience, learning-value summary, testing and evidence description, AI-use declaration, privacy and disclosure confirmations, private participant note, status, and timestamps.
Review and recognition data
Quality-gate result and reason, criterion scores, total score, participant feedback, private review notes, public citation, monthly-round entry, internal ranking, gift name and value, delivery status, and delivery notes.
Operational data
Transactional email recipient, message content and delivery status, provider identifiers, retry errors, webhook event identifiers, administrator actions, previous and new status values, and timestamps used for security, consistency, and auditability.
Most data comes directly from you. Clerk supplies the verified account details, and we inspect the public content URL you submit. Do not submit special-category personal data, customer or tenant data, secrets, credentials, or confidential information.
Purposes and Legal Bases
Account, application, and participation
To authenticate you, assess your request to join, provide the private dashboard, accept submissions, administer participation, review work, and deliver any recognition gift. The legal basis is Art. 6(1)(b) GDPR.
Fairness, integrity, and security
To prevent duplicate, deceptive, unsafe, or fraudulent submissions; apply the published rules consistently; keep an audit history; secure accounts; and defend decisions. The legal basis is our legitimate interests under Art. 6(1)(f) GDPR.
Public recognition
To operate the public showcase, Fellow directory, and recognition archive as core parts of the program relationship. The legal basis is Art. 6(1)(b) GDPR. Public visibility begins only after work is accepted and the Fellow designation is earned.
Legal and accounting duties
To retain records relating to delivered gifts, disputes, or legally required documentation. The legal basis is Art. 6(1)(c) GDPR where a duty applies and otherwise Art. 6(1)(f) GDPR for the establishment, exercise, or defence of legal claims.
Required and Optional Information
A verified account and the fields marked as required are needed to evaluate an application or submission and to operate the program fairly. Without them, you cannot apply or submit work. Blog and YouTube channel links in the application and private participant notes in a submission are optional. The public website remains available without an account.
Reading this notice is an acknowledgement, not consent to unrelated processing or marketing. Joining the Fellowship does not subscribe you to advertising or promotional email.
Manual Review and Decision-Making
UgurLabs manually reviews every application and submission. No decision to select a participant, accept content, or award a gift is made solely by automated means. A human reviewer applies the published quality gate and rubric; the monthly ranking uses those human-entered scores and is manually finalized. There is no public leaderboard.
What Becomes Public
Applications, unaccepted work, personal scores, complete rankings, feedback, email addresses, private notes, and audit records are not public. Each participant can see only their own private program records. Authorized UgurLabs administrators can access the records needed to operate and review the program.
After a participant has at least one accepted submission, their public display name, optional blog or YouTube channel links, accepted content title and URL, project name, summary, publication date, Fellow status, and any public recognition citation may appear in the showcase, Fellow directory, or recognition archive. The original work remains hosted by the participant's chosen publishing platform under that platform's privacy terms.
Service Providers and Recipients
Personal data is available to authorized UgurLabs administrators and the following processors only to the extent required for their stated role:
Clerk, Inc. (United States)
Account registration, verified email, authentication, sessions, and account security. Provider DPA.
Supabase Pte. Ltd. (Singapore)
Managed PostgreSQL infrastructure for private Fellowship records. The primary database region selected by UgurLabs is Frankfurt, Germany; support operations and subprocessors may involve other countries. Provider DPA.
Vercel Inc. (United States)
Website hosting, server-side execution, request routing, technical logs, and security. Provider DPA.
Plus Five Five, Inc., operating as Resend (United States)
Delivery and status tracking for transactional Fellowship email when email notifications are enabled. Provider DPA.
We do not sell Fellowship data or share it with advertising networks. If delivering a gift would require personal data to be given to a provider not listed here, we will tell the recipient before doing so and transfer only what is necessary.
International Transfers
The primary Fellowship database is located in Frankfurt, Germany, but this does not make the complete service EU-only. Clerk, Vercel, Resend, Supabase, and their subprocessors may process data in countries outside the European Economic Area. Where required, transfers are protected by an applicable adequacy decision, including the EU-U.S. Data Privacy Framework for certified recipients, and/or the European Commission's Standard Contractual Clauses contained in the provider DPAs. Copies of relevant safeguards may be requested from us, subject to protection of confidential information.
Retention
Account identifiers are retained while the Clerk account exists. Private applications, submissions, reviews, scores, and decisions remain available while the account and relevant program relationship continue so the participant and administrators can understand the complete history. If active participation ends but the account remains, this private history stays available on the website; you may request deletion or earlier anonymization as described below.
When a Clerk account is deleted, active participation ends, pending email is suppressed, the public Fellow entry and accepted-work listings are removed, and the local email address and display name are pseudonymized. The original work on an external blog or YouTube remains under the participant's control.
After account deletion, pseudonymized application, review, submission, award, and audit records are kept only while needed to document program integrity, prevent repeat abuse, resolve disputes, or establish, exercise, or defend legal claims. An automated retention process removes direct account identity and application, participation, submission, and review free text before the end of the third calendar year following deletion. Non-identifying award snapshots and append-only audit metadata may remain where needed to document program integrity, gift delivery, or legal claims, unless they must be removed earlier by law.
Completed notification and webhook records are retained only while needed to deliver, retry, troubleshoot, and prove the relevant event, and are automatically deleted after 180 days. Records required by tax, commercial, or accounting law are retained for the applicable statutory period. Backups expire according to the providers' documented backup cycles.
Leaving and Account Deletion
Leaving the active Fellowship stops future submissions but does not by itself remove legitimately accepted public work or Fellow recognition. Deleting the Clerk account ends access and unlists the public Fellow entry, channel links, and accepted-work listings. You may also contact us to request deletion or delisting. A request may be limited where retention is required by law or necessary for overriding legitimate grounds, and we will explain any such limitation.
Your Rights
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, and data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation. Email support@ugurlabs.com to exercise a right. We may ask you to verify your identity.
You may also complain to a supervisory authority. The authority responsible for our establishment is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.
Changes to This Notice
We will update this notice when the program, providers, or legal requirements change. Material changes will be shown in the authenticated website or sent as a transactional notification. Updated program rules must be accepted before a participant can make another submission.