Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how the Magento Association (“we”, “us”) processes personal data when you use the Magento Ambassador platform (the “Platform”). The Magento Association is the controller of the personal data described here.

1. Data we collect

Account data: first and last name, display name, primary email address, password (stored only as a secure hash), and the confirmation that you are at least 18 years old, including its timestamp.
Registration questionnaire: role/occupation, country and optional city, how you heard about the programme, your Magento experience, your motivation and community involvement.
Additional email addresses that you add and verify, used to match contributions to your account.
Linked social accounts: when you connect GitHub or LinkedIn, we store the provider account identifier, username, the profile data the provider returns, and access tokens.
Employment history: the companies you worked for, with start and end dates.
Contributions: the URLs and details you submit (blog posts, LinkedIn posts, podcasts/webinars, community events, speaking engagements), review outcomes and ratings, and any time entries you log.
Public GitHub activity (issues, pull requests, reviews, comments and related events) in an allowlist of public Magento repositories. This includes the GitHub username and user ID of each participant.
Event attendance provided by event organisers. If an uploaded email address does not match an account, we store only a one-way cryptographic hash of it, never the address itself.
Technical and communication data: a session cookie, records of the emails we send you, an audit log of changes to records, and error reports. Error reports may include your user identifier and the page you requested.

2. How we use your data

To create and secure your account, verify your email addresses and let you sign in.
To review contributions, calculate points and recognise Magento Ambassadors.
To attribute contributions to your employer at the time of the contribution, for company rankings.
To check your Magento Association membership status.
To send service emails (verification, password reset, welcome, submission confirmations) and, unless you opt out, reminders about inactivity.
To prevent abuse, detect duplicate submissions, and keep the Platform secure and running.

3. Legal bases

We process your data to provide the Platform you signed up for (performance of a contract) and for our legitimate interests in running a fair, secure recognition programme for the Magento community. This includes importing public GitHub activity and attendance data from event organisers. Where the law requires consent, we ask for it, and you can withdraw it at any time.

4. Automated processing

Points are calculated automatically from reviewed contributions using rules we keep internal to prevent gaming. Blog post submissions may also be analysed by an AI model. To do this, we fetch the public page content temporarily; we do not store a copy. AI ratings are advisory only. Ratings and approvals are always decided by human reviewers, and the Magento Association makes the final decision on Ambassador recognition.

5. What is public

The public leaderboard shows your display name, your points and, where applicable, the company you are attributed to. You can change your display name at any time on your account page. All other profile data is not public.

6. Sharing

We do not sell personal data. We share it only:

with Magento Association systems, to check your membership. We send them your verified email addresses for this;
with GitHub and LinkedIn when you choose to connect those accounts;
with service providers that host the Platform, deliver email, and run search and AI processing for us, under suitable contractual safeguards;
when required by law or to protect our rights and the safety of our community.

Some of these providers may process data outside your country. Where this happens, we rely on appropriate safeguards such as standard contractual clauses.

7. Retention

We keep your data for as long as your account exists. When an account is deleted, we scramble your personal data. Your country/region and your contribution records are kept in anonymised form, so that past company and programme totals stay accurate. If you unlink a social account, its stored tokens and profile data are removed.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or receive a copy of your data, and to object to processing. You can update most data yourself on your account page, where you can also unsubscribe from reminder emails. For other requests, contact the Magento Association through its official channels. You also have the right to lodge a complaint with your local data protection authority.

9. Cookies

The Platform uses only cookies that are strictly necessary: a session cookie that keeps you signed in and protects forms. We do not use advertising or tracking cookies.

10. Security

We protect your data with appropriate technical and organisational measures. These include hashed passwords, encrypted connections, access controls based on roles, and audit logging.

11. Changes

We may update this policy from time to time. We will publish the current version on this page with its date, and tell you by email about material changes.