Last updated 24 October 2026
Privacy Policy
The short version: Finalist stores the competitions, case briefs and work you add, so you can come back to them, and sends parts of it to AI providers to generate coaching. We never sell your data, we never use it to train AI models, and you can download or delete everything at any time.
Who we are
Finalist (finalist.golash.in) is part of golash and is run by Krishna Gahlod, an individual based in Mumbai, Maharashtra, India (“we”). Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the data fiduciary for the personal data described here.
What we collect, and why
| Data | Why |
|---|---|
| Name, email, password (stored only as a secure hash) | To create your account and sign you in. |
| Competitions, case briefs, rules and files you upload (we keep the extracted text, not the file) | To set up your workspace and coach you on it. |
| Everything you write in your workspace (research, structure, slides, answers) | So your work is saved and the coach can review it. |
| Your consent records (what you agreed to and when) | To show we have your consent, as the DPDP Act requires. |
| Technical data (IP address, browser, request logs, rate-limit counters) | To keep the service secure and prevent abuse. |
Finalist uses one essential cookie to keep you signed in. We don't use advertising trackers.
Who processes your data
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting the website | Global |
| Neon | Database where your account and workspaces are stored | United States |
| Google (Gemini API), Groq, NVIDIA | AI coaching: the relevant parts of your brief and work are sent when you use a coach feature | United States / global |
| Tavily | Web search when you use “Rules & judging” (only the competition and organiser names are sent) | United States |
| Resend | Sending password-reset emails | United States |
| Cloudflare | Domain and the golash bar script | Global |
We don't train AI models on your data. The AI providers handle requests under their own terms: some keep them for a limited time to monitor abuse, and on free API tiers some providers (including Google) may use submitted content to improve their services. Don't put personal details (yours or anyone else's) into your case work unless they're needed.
How long we keep it
- Your account and workspaces: while your account exists. Delete a workspace, or your whole account, at any time and it's erased.
- If your account is inactive for 24 months, we'll email you and delete it 30 days later unless you sign in.
- Password-reset links expire after 30 minutes. Rate-limit counters reset within a day.
- Messages you send us: up to 12 months after the conversation ends.
Your rights under the DPDP Act
- Access and a copy: download all your data from Account & privacy.
- Correction: edit anything in your workspaces directly, or write to us.
- Erasure and withdrawing consent: delete your account from Account & privacy. Withdrawing is as easy as giving consent; we then stop processing and erase your data unless the law requires us to keep it.
- Nomination: nominate someone to exercise these rights for you if you die or become unable to, by writing to us.
- Grievances: write to our Grievance Officer (below). If you're not satisfied with our response, you can complain to the Data Protection Board of India.
Age
Finalist accounts are for people aged 18 or older; we ask you to confirm this when you sign up. We don't knowingly process children's data, and if we learn an account belongs to someone under 18, we delete it.
Security and breaches
Data is encrypted in transit, passwords are hashed, and each workspace is only accessible to its own account. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires, and report it to CERT-In where required.
Grievance Officer
Krishna Gahlod, Grievance Officer, golash
Email: grievance@golash.in
Mumbai, Maharashtra, India
We acknowledge grievances within 48 hours and resolve them within 30 days.
Changes
If we change this policy in a way that matters, we'll update the date above and ask for your consent again the next time you sign in.