01Who we are & scope
Innovanet Software Ltd, [registered address — to be confirmed] (trading as "Ascent"), is the controller for account, website, sales and product-usage data described here. For customer-site data processed only on a business customer’s instructions, we generally act as processor/service provider under a Data Processing Addendum. Contact hello@ascent.dev. This notice covers the Ascent website, hosted application, developer portal, API and support interactions.
02Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, email, organisation, role, authentication identifiers | You, identity provider |
| Commercial | Plan, orders, invoices, tax location, payment token/status | You, payment processor |
| Connected property | Domains, CMS identifiers, Search Console & analytics data, permissions | You & connected providers |
| Content & instructions | Prompts, brand inputs, approvals, generated drafts, publish actions | You & authorised users |
| Technical & usage | IP address, device/browser, logs, events, diagnostics, API calls | Automatically |
| Support & feedback | Messages, attachments, surveys and notes | You |
| Public web data | Public pages, sitemap content, search results, competitor signals | Public sources & search providers |
03Purposes & lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Provide accounts, audits, generation, publishing, monitoring, support & billing | Contract; legitimate interests; legal obligation |
| Secure the Service, prevent abuse, maintain audit logs | Legitimate interests; legal obligation |
| Improve reliability & features using minimised usage data | Legitimate interests; consent where required |
| Send requested product communications & service notices | Contract; legitimate interests |
| Send marketing & set non-essential tracking | Consent where required; otherwise opt-out |
| Comply with law, disputes & enforcement | Legal obligation; legitimate interests |
04AI & automated processing
Ascent may use automated systems to prioritise SEO opportunities, generate content, estimate potential, recommend actions and — only when you configure it — publish or reverse changes. These decisions ordinarily concern website operations rather than legal or similarly significant effects on individuals. You select off, human-approved or automatic modes per task. We provide explanations, logs, reversal controls and a contact route for concerns.
05Sharing & subprocessors
- Cloud hosting, database, authentication, monitoring and support providers.
- Search, analytics, CMS and AI providers you choose or enable.
- Payment, tax and marketplace providers.
- Professional advisers, auditors and authorities where legally required.
- A successor in a merger, financing or sale, subject to appropriate protection.
We maintain a subprocessor list naming provider, purpose, processing location and transfer mechanism. We do not train Ascent or third-party foundation models on identifiable Customer Content without your separate opt-in.
06International transfers
Where personal data moves outside its origin country, we use applicable safeguards — adequacy decisions, standard contractual clauses, the UK addendum/IDTA or another lawful mechanism — plus supplementary measures where required. Actual corporate and hosting locations are being finalised.
07Retention
| Data | Retention rule |
|---|---|
| Account & contract | Term plus up to 7 years where needed for tax, claims and audit |
| Operational content & project data | Active term; 30-day export window; deletion within 60 days thereafter |
| Security & API logs | 12 months unless an incident requires longer |
| Consent records | Duration of processing plus the limitation period |
| Backups | Rolling encrypted backups deleted within [90 days — to be confirmed] |
08Your rights & choices
Depending on your location, you may request access, correction, deletion, portability, restriction or objection; withdraw consent; opt out of marketing, sale/sharing or targeted advertising; limit certain sensitive-data use; and appeal a denied request. Requests: hello@ascent.dev. We verify only as reasonably necessary and never require verification for an opt-out where prohibited. You may complain to your data-protection authority.
09Cookies & tracking
Strictly necessary technologies operate the service and security. Analytics, personalisation and advertising technologies remain disabled until valid consent where required. "Reject all" is as easy as "Accept all", and you can reopen settings and withdraw consent at any time. See the Cookie & Consent Notice for categories and vendors.
10Security, children & changes
We use administrative, technical and organisational safeguards, but no system is completely secure. The Service is for business users and not directed to children. We post material changes and obtain consent where required.
11Regional supplements
Where applicable thresholds are met (for example under US state privacy laws), we disclose categories collected, purposes, sources, recipients and retention; state whether personal information is sold or shared; provide "Do Not Sell or Share My Personal Information" and sensitive-data limitation mechanisms; honour opt-out preference signals; and avoid discriminatory treatment. Applicability and roles are being confirmed for each launch market.