Your information

Your data, and what we do with it

Last updated 8 October 2026

CORE uses information to run engineering competitions, assess ability and develop opportunities for participants. This policy explains how CORE and Ruliax AI collect, analyse, retain and share that information, including the commercial services we are developing.

Who we are

CORE International Olympiad is operated by Ruliax AI, which also provides its assessment technology. References to "we", "us" and "our" mean Ruliax AI in its operation of CORE. This policy covers the CORE website, registration, personal advisor invitations and the CORE-related processing described below. Contact secretariat@coreolympiad.org for privacy questions and requests.

Ruliax AI's wider community and employer services may have additional notices when offered. Those notices do not replace the permissions you have already given or the commitments made in your advisor invitation.

Information we collect

• Account and registration information: name, email, sign-in identifiers, handle, university, country, degree, year and field of study. Password authentication is handled by our sign-in provider.
• Professional and academic material: your CV or resume, portfolio, project files, code, reports, and GitHub, LinkedIn or personal website links you provide. Registration currently requires a CV; additional work and profile links are optional.
• Assessment information: submitted answers, conversation transcripts, scores, rubric evaluations, response timing, session activity and integrity indicators. A voice assessment may also process audio and its transcript; the session notice will specify what is recorded and retained before you begin.
• Derived information: skills, subject strengths, experience summaries, score breakdowns, skill charts and possible opportunity matches inferred from your submissions and assessment record. These are estimates and may be incomplete or inaccurate.
• Advisor and partner information: professional name, title, institution, university profile, business contact details, correspondence, selected involvement and any photo submitted. Invitations may be prepared using publicly available university directories and academic profiles.
• Usage and operational records: page counts, invitation opens and first form interactions, sign-in and security records, support messages, delivery status and records of permissions, submissions and policy versions.

We receive information from you, your sign-in provider, your use of the services and publicly available university, academic and professional profiles. We may use public professional information to verify affiliations and enrich the relevant assessment or opportunities profile. Please do not upload confidential third-party material or unnecessary sensitive information such as government identity numbers or health records.

Social sign-in and profile links

When you use Google, GitHub or LinkedIn sign-in, we receive the account identity and basic profile information made available through the permissions shown by that provider, such as your name, email, identifier or username. Social sign-in does not give us your provider password. We do not request access to your mailbox, private repositories, files or contacts for sign-in.

Authentication information supports account access and security. Separately, professional profile links, including a GitHub or LinkedIn link, can form part of your skills profile and any employer-facing information you authorize us to share. A profile link and permission to access private account content are different things.

How and why we use information

• Competition delivery: register entrants, administer assessments, check eligibility and integrity, calculate and review results, provide support and maintain competition records.
• Profiles and opportunities: analyse academic and professional material, describe skills, support candidate discovery and match interested participants with jobs, internships, research, projects, gigs and relevant events, subject to the choices described below.
• Service development: analyse participation, assessment quality and reliability, investigate errors, evaluate scoring and matching methods, and develop competition, education and talent services. This includes improving question quality, skill inference, matching relevance and the reliability of our services.
• Communications and business operations: send account and competition messages, advisor receipts and requested opportunity communications; manage academic, sponsor and employer relationships; prevent misuse and meet legal obligations.
• Research and reporting: produce aggregated or anonymized statistics on participation, skills and assessment outcomes for product development, research and sponsor reporting. Anonymized reporting removes identifying information; records under a handle remain personal information where they can be linked to you.

Where applicable data protection law requires a lawful basis, we use performance of our agreement for necessary account and competition services; consent for optional profiles, opportunity communications and authorized disclosures; legitimate interests for proportionate security, administration, professional outreach and service analysis where those interests are not overridden by your rights; and legal obligations where required. We obtain consent where required for a particular activity.

Required data sync with Ruliax AI

Ruliax AI operates CORE as well as supplies the necessary technology to operate the olympiad; your registration and assessment data are synced with Ruliax AI so it can deliver and evaluate your assessment.

Data sync with Ruliax AI is required to take the assessment. It covers the registration details, CV, submitted work, responses and assessment records needed to administer, evaluate and maintain your competition entry, including an internal assessment and skills record. Without this processing, we cannot provide the assessment.

An opportunities profile and employer connections are offered together through an optional choice, separate from required competition processing. They do not control the required assessment sync. You can manage these choices in registration or contact secretariat@coreolympiad.org.

As additional services become available, their notices will explain relevant data uses and choices.

AI assessment and profiling

Ruliax AI's assessment approach uses AI to present questions through text or voice, process and log responses, and evaluate answers against rubrics prepared during question authoring. Algorithms may also analyse timing and session activity for integrity checks, and combine assessment results with submitted academic or professional material to generate skill summaries and charts. Session-specific instructions explain the format and permitted assistance.

Scores, flags and inferred skills can be wrong. You can contact secretariat@coreolympiad.org to challenge an assessment result or profile inference and request review by a person. CORE does not make an employer's hiring decision or guarantee that a score predicts job performance.

We use assessment and profile analysis to evaluate and improve our rubrics, scoring methods and skill models. Processing of personal information follows the purposes and legal bases described in this policy. Any materially different model-training purpose will be disclosed before it begins, with consent where required. The assessment notice identifies relevant AI providers, the information they process and retention arrangements.

Profiles and paid employer access

Ruliax AI is developing commercial candidate discovery, assessment and matching services. Employers, recruiters and clients may pay for profile search, assessment services, introductions or recruitment services. Sponsorship and employer fees can support the competition and platform.

The required assessment record supports competition delivery and evaluation. If you choose an opportunities profile, we can also combine your registration, CV, portfolio, professional links and results into a profile for candidate discovery and matching. This can include derived skills, charts and experience summaries. Profiles may use a handle, although recognizable work or public links can identify you.

Authorized employer access can include profile search, skill comparisons, relevant work and introductions. The sharing permission presented to you specifies the information and recipients covered. If you select the optional opportunities-profile permission in registration, you authorize Ruliax AI to create your profile and share it, including skills and assessment summaries, contact details, CV and submitted work, with relevant employers, recruiters, clients and other opportunity providers. This includes paid profile access, candidate matching, introductions and recruitment services to connect you to opportunities. If you leave it unchecked, this sharing is not authorized. Earlier permissions that required a separate approval continue to apply until you explicitly accept the updated choice.

Paid access to identifiable profiles may qualify as a sale or sharing under applicable privacy laws. We provide the notices and choices those laws require. You can contact secretariat@coreolympiad.org to exercise applicable sale or sharing opt-out rights.

Advisor and partner records

We use professional contact information to invite advisors and manage academic and partner relationships. We keep invitation, response and permission records, including timestamps, the form version and the wording accepted, so we can explain and evidence those relationships.

For an accepted faculty advisor, publication and partner verification follow the authorization in their invitation. This can include their name, title, institution, role, university profile link and a photo they upload on our website and in sponsorship or university outreach materials, and a redacted acceptance record shared privately with prospective partners.

Advisor emails, invitation links and private notes remain private. Advisor participation does not imply endorsement by their institution or endorsement of Ruliax AI products. Advisors may request changes or removal at secretariat@coreolympiad.org. Updating this policy does not expand an existing advisor's authorization.

Communications and external links

Opening or subscribing to a YouTube channel is not required to register or compete. Older registration records may retain a channel-related checkbox value; it is not proof of a subscription and is not an eligibility condition. YouTube and other external sites apply their own privacy policies.

Essential account, assessment and advisor messages are separate from optional opportunity or promotional communications. You can withdraw optional communication choices through registration or by emailing secretariat@coreolympiad.org; where provided, you can also use the message's unsubscribe link. Essential service messages may still be needed while you use the service.

Recipients and service providers

• Authorized CORE and Ruliax AI personnel who need information for the purposes described here, including appropriate assessment reviewers and support staff.
• Supabase for registration authentication, database and file storage; Cloudflare for hosting, delivery, application infrastructure, advisor records and uploaded advisor photos; and Resend for transactional messages such as advisor receipts.
• Assessment and AI providers as identified in the relevant assessment notice before processing begins.
• Employers, recruiters, research or university partners for the particular profile access or introduction you authorize. Sponsors may receive aggregate participation and skills reporting, authorized advisor profiles and candidate information covered by the relevant participant permissions.
• Professional advisers, authorities or a successor operator where necessary for legal obligations, protection of rights, or a merger, acquisition or transfer of the service, subject to appropriate confidentiality and continued privacy obligations.

We share information needed for the purposes described in this policy. Providers may also process operational information under their own applicable terms. An employer receiving information with your permission is responsible for its subsequent processing under its own notice and the applicable law.

Storage, security and international processing

Information is processed using our hosting, authentication, storage and communications providers. Processing may occur outside your country, including in the United States and other countries where the relevant services operate. Where transfer safeguards are legally required, appropriate arrangements must be in place, such as recognized adequacy mechanisms or approved contractual protections. Contact us for information about an applicable transfer.

We use access controls and authenticated storage for private records. No internet service can guarantee absolute security. Keep your account credentials and personal invitation links private, and report suspected unauthorized access to secretariat@coreolympiad.org.

Retention and deletion

We retain account, registration, submitted material and derived profiles while needed to provide the services you use. Retention depends on account activity, your selected services, competition recordkeeping, outstanding requests or disputes, and applicable legal requirements.

On a verified deletion request, we aim to remove the account and its active uploaded material within 30 days, unless a lawful exception or permitted extension applies. We may retain limited results, permission history, advisor acceptance evidence, security records or records needed for legal claims for as long as necessary for that purpose. Access to retained records is restricted; they are not a basis for continuing withdrawn optional marketing or profile uses. Backup copies may remain until the provider's backup cycle expires.

Truly anonymized statistics may be retained for research, service development and reporting. Deleting your account does not necessarily remove information already lawfully received by an independent recipient, but we will address required downstream deletion notifications and explain relevant limits.

Your rights and controls

Depending on the law that applies, you may request access, correction, deletion, portability, restriction, objection to certain processing, withdrawal of consent, or review of an automated decision. You may also have rights to opt out of sale or sharing and complain to your local data protection authority.

Write to secretariat@coreolympiad.org. We may verify your identity before acting and will respond within applicable legal deadlines. Withdrawing consent does not undo lawful processing already completed. We will explain any lawful reason we cannot fully satisfy a request. Optional profile or opportunity choices can be withdrawn without affecting your competition eligibility.

Cookies and usage measurement

The registration app uses necessary authentication cookies. Browser storage also supports preferences such as theme. Our first-party measurement records public page totals, invitation opens and first form interactions, and registration progress, CV selection, validation or upload failures, active time on registration steps, upload and submission timings, sign-in outcomes, tracking-delivery failures, and completion. Invitation engagement is associated with the invitation record; registration events are associated with the signed-in account and record step numbers, fixed field names and event categories, durations and timestamps. Sign-in diagnostics use temporary attempt identifiers to connect an initiation with its outcome, without retaining passwords or OAuth tokens. Public page counts are totals, not a list of identified visitors.

These counters do not store IP addresses, typed form contents, analytics cookies or cross-site identifiers. Hosting and security services may separately process network and request information. There are currently no advertising pixels or third-party analytics scripts on the public CORE site. Additional optional tracking would require an updated notice and any choices or consent required by law. Usage measurement is distinct from analysis of CVs and assessment records described above.

Younger participants

Competition eligibility is published for each session. If you are below the age at which you can agree to these terms or the relevant data processing in your jurisdiction, contact us with a parent or guardian before registering. Requirements differ by country. We may restrict access or remove information collected without a required authorization.

Changes and existing permissions

We will update the date when this policy changes. Material changes affecting existing participants or advisors will be brought to their attention, including by email where appropriate. A new policy does not retrospectively expand an earlier consent. Before using existing personal information for a materially different purpose, we will assess the applicable requirements and seek fresh permission where required. Original advisor permissions and consent records remain authoritative for their scope.

Contact

CORE International Olympiad, operated by Ruliax AI
secretariat@coreolympiad.org