Privacy Policy

Who we are

This policy covers mcmediaunit.org and its Kunchanada Dashboard and administration services, operated for Maliyadeva Media Unit at Maliyadeva College, Kurunegala, Sri Lanka. BreadCrumb Labs provides website development and technical services. Contact Maliyadeva Media Unit at contact@mcmediaunit.org about personal information or this policy.

Information we collect

School registrations include school names, addresses, logos, coordinator names, email addresses and phone numbers, and teacher-in-charge details. Contestant registrations include names, dates of birth, competition categories, contact numbers identified as WhatsApp-connected, and submission links or files where the relevant feature is available.

We also process society-email verification information, messages to the Media Unit, account credentials, session information, and technical information needed to operate and protect the service. Our registration workflow retains a registration credential record that authorized administrators may access. Use a password unique to this service.

How information is used

We use this information to create and authenticate school accounts, verify society email addresses, assess eligibility, manage competitions and submissions, answer enquiries, communicate event information, and prevent misuse. Providing a WhatsApp-connected number does not by itself mean an automated WhatsApp messaging service is enabled.

Access and service providers

Authorized organizers and administrators access information needed for their responsibilities. Hosting, database, authentication, media-storage and email providers process relevant information to deliver these services. These include Supabase and Cloudinary, and Google Drive if the upload integration is enabled. Providers may process information outside Sri Lanka under their own applicable terms and privacy policies. We may disclose information where required by law or necessary to address fraud, abuse, or safety concerns.

Google Drive uploads and Google user data

If Google Drive uploads are enabled, an authorized Drive account owner connects the upload application, identified in Google Cloud as mmu-fileuploads. The integration uses the granted permissions to upload and manage competition-submission files and their related metadata. Contestants are not required to grant access to their own Drive accounts when files are submitted to the organizer’s connected account.

Google access and refresh tokens are used only to operate the authorized integration and must be kept server-side. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. Any use or transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

The connected account owner can revoke access through Google Account permissions. Revoking access stops future authorized API access but does not automatically delete existing files or registration records. Contact us to request deletion of associated information or submissions.

Cookies and browser storage

We use session cookies and browser storage for authentication, remembering that a school account has been used, and preferences such as theme. External video players and linked services may process information under their own policies. You can manage cookies in your browser, although blocking essential cookies may prevent login.

Retention and security

We retain information for registration, competition administration, support, and applicable recordkeeping needs. Contact us to ask about retention or request deletion. We use access controls and authentication to protect information, but no online system can guarantee absolute security.

Students and school responsibility

The service supports school activities and may process information about minors. School representatives must obtain the necessary authorization from contestants and, where required, parents or guardians before submitting their information or media. Do not upload unnecessary personal information about students.

Your requests and policy updates

You may contact us to request access, correction, or deletion of your information, or to raise a privacy concern. We may verify your identity and authority to act for a school or contestant before processing a request. Applicable legal and recordkeeping obligations may affect what we can delete. Updates to this policy will be published here with a revised effective date.