Last updated: 16 November 2026

Privacy policy

EnroBoard is registration software for Model United Nations (MUN) conferences: schools register delegations, students apply as delegates or officers, advisors give their delegates’ details, and the conference’s team works through it all. Many of the people whose data it holds are school students, often under 18. This policy explains what EnroBoard stores, who is responsible for it, how long it is kept and what rights people have. It is written to be read by students, parents, advisors and conference organizers alike.

This is a starting point, not legal advice. Organizers should check it against the law that applies to them, and the platform operator should complete the bracketed details before going live.

Who is responsible

Each conference is the controller of the data collected through its forms and entered by its team. The conference decides which questions to ask, who on its team can see the answers and when they are deleted. Questions about a conference’s data go to that conference first: its contact is on its registration page.

The platform operator ([operator’s name and contact address]) runs EnroBoard and processes that data on the conference’s behalf, as a processor. The operator does not use conference data for any purpose of its own, does not sell it, does not show advertising and does not use it to train any AI system. The operator is the controller only of the data needed to run the platform itself: the registration details of each conference (organizer’s name and email, conference name and website) and technical logs.

What EnroBoard stores

• Conference organizers: name, email address, conference name, website and the admin password (stored only as a one-way hash).
• The conference’s team (secretariat, organizers, volunteers…): name, and optionally title, email and phone; for those who sign in, a username and a 6-digit PIN (encrypted when the operator has set an encryption key); their teams and what they may do.
• Registrants (advisors, students who apply): their email address, name, and a password if they choose one (stored only as a one-way hash).
• Answers to the conference’s forms: whatever the conference asks, for example a school’s name and address, an advisor’s contact details, the number of delegates, country preferences, experience and a motivation letter. The conference chooses the questions and should ask only for what it needs.
• Delegates’ details (Form II): for each position a delegation is given, what the conference asks about that delegate, typically name and email, and who is the ambassador.
• Uploaded files: receipts of payment and any documents a form asks for.
• Payments: amounts, dates, references, the receipt and whether the conference has confirmed it. EnroBoard never receives card or bank account details.
• Interviews: the time booked, and the notes and scores of the team members who conduct them.
• Emails: a record of the emails sent through EnroBoard (to whom, the subject, when and whether it was delivered).
• Technical data: sign-in sessions (random tokens, stored as hashes), counters of failed sign-ins per network address (to stop password guessing; deleted within a day), a record of changes made by the team, and the hosting provider’s request logs.

EnroBoard does not use cookies for tracking or advertising. It sets one cookie to keep a signed-in person signed in. While a form is being filled in, the answers are kept in that browser’s storage, so they aren’t lost if the page closes; they are removed once the form is sent, and signing out removes them too.

Why, and on what basis

The data is used only to run the conference’s registration: to accept delegations and applicants, allocate countries and positions, work out and check fees, hold interviews, send the emails that registration needs, and prepare the conference (lists per committee, placards and badges). Under the GDPR, the conference will usually rely on the agreement with participants, or its legitimate interests in running the conference (and, where required for minors, the consent of their parents or school). Conferences should explain this in their forms.

Who can see what

• The public sees only the conference’s registration page: its forms, key dates, committees and fees. Never anyone’s registration.
• Registrants see only their own registrations: their answers, their countries, their delegates’ details, their fees and payments, and their interview time. They don’t see the team’s notes or interview scores, or questions the conference keeps for its team.
• The conference’s team sees what their teams are allowed to: for example, the organizing team may review applications without seeing payments. Volunteers and others who don’t sign in see nothing.
• The conference admin sees everything in their conference. Conferences can never see each other’s data.
• The platform operator sees each conference’s registration details and usage counts, and has technical access to the database only to keep the service running, fix faults or meet a legal obligation.

Emails go through the platform’s email provider ([provider]) or, if the conference chooses, its own mailbox. Data is not shared with other products (including ResoBoard and DaisBoard) unless a conference connects them, which is not possible yet; when it is, it will be described here first.

Where it is kept, and how it is protected

[Hosting: e.g. the application on Vercel and the database on Turso, in the EU (Frankfurt).] Connections are encrypted (HTTPS). Passwords are hashed. When the operator sets an encryption key, PINs, the owner’s two-step secret, a conference’s mailbox password, answers to forms, delegates’ details, the team’s notes and uploaded files are encrypted at rest (AES-256-GCM), so a copy of the database alone doesn’t reveal them. Every request is checked on the server for who is signed in and what they may do; each conference’s data is separated in every database query. The owner panel requires two-step verification.

How long it is kept

A conference can set a date on which all registrations are deleted automatically (answers, registrants’ accounts, delegates’ details, files, payments, interviews, notes and the email record), and can delete them at any time. We recommend a date no later than a few weeks after the conference, once fees and certificates are done. A conference’s admin can export all of its data, and the operator deletes everything a conference holds when the conference is deleted. Database backups held by the hosting provider expire within [30] days.

Your rights

Anyone whose data is in EnroBoard can ask the conference for a copy, a correction or deletion, or object to its use; registrants can see and, while a form is open, change their own answers, and can withdraw an application. Students under 18 can make these requests themselves or through a parent or their school. If a conference doesn’t respond, contact the operator at [contact address]. You can also complain to your data protection authority (in Greece, the Hellenic Data Protection Authority).

Changes

If this policy changes in a way that matters, the date above changes and conference admins are told in EnroBoard.