Privacy Policy — AscendFlare

This policy explains what Apex Root Solutions LLC ("we") collects when you use AscendFlare (the "Service"), why, how long we keep it, whom we share it with, and the choices and rights you have. It applies to the Service and to emails we send about it. It does not cover the platforms you connect (Google, Apple, Meta, TikTok, LinkedIn and others), which handle your data under their own policies.

The short version. We never ask for, see or store a password for any platform; connections use OAuth or keys the platform issues, encrypted at rest and revocable from the Connections page. Nothing is published, launched or spent without a person's explicit confirmation, and every such action is recorded in an audit log you can export. We do not sell personal data, do not use it for advertising, and do not use your data to train AI models. We set only strictly necessary cookies, so there is no tracking and no cookie banner. You can export everything and delete your workspace or account yourself, at any time.

1. Who is responsible

AscendFlare is provided by Apex Root Solutions LLC, a limited liability company organised under the laws of the State of Delaware, with its registered office in Wilmington, New Castle County, Delaware, and its principal place of business in Cedar Hill, Dallas County, Texas.

For your account data, we are the controller. For the data you bring into a workspace — the apps you analyse, the content you approve, the accounts you connect — your organisation is the controller and we act as its processor on its instructions; a Data Processing Addendum, available in the application, governs that processing for customers subject to the GDPR or UK GDPR. Contact for all privacy matters: support@apsoluts.com.

2. What we collect, why, and for how long

Data	Source	Purpose	Legal basis (GDPR)	Retention
Account: email address, name and profile image (from Google sign-in, if used), sign-in timestamps	You / Google	Create and secure your account, send sign-in links and service emails	Performance of a contract	Life of the account; deleted with it
Sessions: hashed session token, IP address, browser user-agent, last-seen time	Your browser	Keep you signed in, let you review and revoke devices, detect abuse	Legitimate interest (security)	Until revoked or expired (30 days); expired rows purged daily
Workspace membership, role, invitations (invitee email)	You	Access control	Performance of a contract	Life of the workspace
Public store listings and public reviews of the apps you analyse (review text, star rating, reviewer display name and date as the store publishes them)	Google Play, Apple App Store	Analysis, recommendations and drafting	Legitimate interest (providing the service you requested)	Raw reviews removed 90 days after the last analysis; listing cache 6 hours; analysis cache 24 hours
Recommendations, drafts, ad concepts, campaign records, posts, rendered images and videos, approvals	You / generated	The service	Performance of a contract	Life of the workspace; unattached renders 90 days
Platform credentials: OAuth access and refresh tokens, API keys, system-user tokens, granted scopes, expiry	The platform, with your authorisation	Perform the actions you approve; check token health	Performance of a contract	Until you disconnect or delete the workspace; encrypted at rest (AES-256-GCM), revoked at the platform where supported
Performance data from platforms: impressions, clicks, spend, installs, reach, post insights	Connected platforms	Reporting, spend caps, automatic pauses, feedback into recommendations	Performance of a contract	13 months
Audit log: actor email, IP address, timestamp, action, before/after values for every publish, launch, pause, post, setting change and deletion	Generated	Accountability, dispute resolution, compliance, security investigations	Legitimate interest; legal obligation	Append-only; retained for the life of the account and 3 years after closure
Alerts and notification delivery records (recipient, channel, result)	Generated	Warn owners about spend, expiring tokens and failures	Legitimate interest	90 days
Usage metering: AI tokens, cost, videos generated, per workspace and month	Generated	Budget caps, billing	Performance of a contract	Life of the workspace plus 7 years for billing records
Operational logs and error reports: request id, route, timing, error messages (secrets and tokens scrubbed), truncated IP	Generated	Reliability, security, debugging	Legitimate interest	30 days
Support correspondence	You	Answer your requests	Legitimate interest	3 years

We do not collect special-category data, and the Service is not directed at children under 18; we delete any account we learn belongs to a minor.

3. Public reviews and other people's data

When you analyse an app, we fetch the listing and a sample of recent public reviews exactly as the store shows them to anyone. Reviews contain the reviewer's display name and text, which can be personal data. We use them only to find themes and evidence for recommendations, quote them only in drafts you see, strip them from stored listings 90 days after the last analysis, and never contact reviewers or combine reviews with other sources. If you are a reviewer and want a quote removed from a workspace, write to support@apsoluts.com.

4. Cookies

The Service sets only cookies that are strictly necessary to operate it:

ascend_session — keeps you signed in (30 days, HttpOnly, Secure, SameSite=Lax).
ascend_ws — remembers which workspace you selected (1 year).
Short-lived signed state cookies during sign-in and platform connection (10 minutes), which protect against cross-site request forgery.

We use no analytics, advertising or third-party cookies and no fingerprinting. Because there is nothing to consent to, we do not show a cookie banner.

5. How we use AI

Listing text, public reviews and your existing drafts are sent to our model provider, Anthropic, to generate recommendations, copy, ad concepts and posts. Prompts never include your credentials or your users' account data. Anthropic processes this data under its commercial API terms, which prohibit training on customer content; we do not train models on your data either. Video generation for reels sends the script to the video provider named in the sub-processor list. Both usages are metered per workspace and capped by the workspace owner.

6. Who we share data with

Platforms you connect, to carry out the actions you approve (for example sending an approved listing description to Google Play, or an approved post to Instagram). They act as independent controllers under their own terms.
Sub-processors that run the Service on our behalf — hosting (Fly.io, United States), object storage and database replication (Cloudflare R2), transactional email (Resend), the AI model provider (Anthropic), video generation (HeyGen, when enabled) and error monitoring (Sentry). The current list, with locations and transfer safeguards, is in the application under Legal → Sub-processors. Each is bound by a data-processing agreement. We give workspace owners 30 days' notice before adding one.
Your workspace: members see the data in their workspace according to their role; the audit log shows who did what, including email address and IP address of the actor, to the workspace's owners.
Endpoints you configure: if an owner sets an alert or event webhook, we send audit events and alerts to that address; you control where it points.
Legal and safety: to comply with a law, court order or lawful request; to enforce our Terms; or to protect the rights, safety or property of Apex Root Solutions, our users or the public. Where lawful, we will tell you first.
Business transfers: in a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data and have not done so in the preceding 12 months, and we do not "share" it for cross-context behavioural advertising as those terms are defined in US state privacy laws.

7. Platform-specific commitments

Google. AscendFlare's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google Play Console, Google Ads and YouTube is used only to read and edit the listings, campaigns and channels you connect, is never used for advertising unrelated to your account, and is never sold or transferred to data brokers.
Meta (Facebook, Instagram, Meta Ads). Data received from Meta APIs is used solely to manage the Pages, Instagram accounts and ad accounts you connect, in accordance with the Meta Platform Terms and Developer Policies. You can remove AscendFlare's access from your Facebook settings at any time; disconnecting in AscendFlare also revokes it. To request deletion of Meta-sourced data, delete the connection or the workspace, or write to support@apsoluts.com.
TikTok. Content is posted only to your own account with the audience, interaction and commercial-content settings you choose per post; data from the TikTok API is used only to publish and report on those posts.
YouTube. The Service uses YouTube API Services; by connecting YouTube you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies. You can revoke access at Google security settings.
LinkedIn, Apple (App Store Connect, Apple Ads). Tokens and keys are used only for the listing, page and campaign actions you approve and are deleted when you disconnect.

8. Security

Platform credentials are encrypted with AES-256-GCM under a key held outside the database, with versioned key rotation. All traffic uses TLS. Sign-in is passwordless (single-use links or Google) and every session can be reviewed and revoked. Roles limit who can approve, publish or connect. Every write to a platform requires an individual confirmation and is recorded in a tamper-evident, hash-chained audit log. The database is continuously replicated for point-in-time recovery. Logs are scrubbed of secrets. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify affected workspace owners without undue delay and, where the GDPR applies, within the 72-hour window it sets.

9. Where data is processed

The Service is operated from the United States and its hosting, storage, email, AI and monitoring providers process data there. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers to us and our sub-processors rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA), supplemented where a provider is certified under the EU-US Data Privacy Framework. A copy of the clauses we use is available on request.

10. Your rights and choices

Self-service. From the Account page you can export your account data and (as an owner) your workspace data as JSON, revoke sessions, disconnect any platform, change your workspace timezone and alert settings, and delete a workspace or your account. Deleting a workspace revokes platform access where the platform supports it, removes stored media and data, and keeps only the audit trail for the period above.
Access, correction, deletion, restriction, portability, objection. If you are in the EEA, UK, Switzerland, or a US state with a privacy law (including California, Colorado, Connecticut, Virginia, Utah, Texas and others), you may exercise these rights by email to support@apsoluts.com. We will respond within 30 days (45 days where US state law provides) and will not discriminate against you for exercising them. You may appeal a decision by replying to our response; EEA/UK users may also complain to their supervisory authority.
Data in a customer's workspace. If your data was placed in a workspace by one of our customers (for example, you are a reviewer, or a member of their team), we will refer your request to that customer and help them respond.
Email. Service emails (sign-in links, security notices, alerts you enabled, legal notices) are part of the Service; alerts can be switched off on the Account page. We send no marketing email without a separate opt-in, and every marketing email has an unsubscribe link.
Do Not Track / Global Privacy Control. We do not track users across sites, so these signals change nothing; we honour them by design.

11. Retention and deletion in practice

A daily job enforces the schedule in the table above: it strips raw reviews from apps not re-analysed in 90 days, removes performance rows older than 13 months, expired sessions and sign-in tokens, alerts older than 90 days, finished job records older than 30 days, and rendered media not attached to a published post after 90 days. Backups and replicas roll off within 30 days. The audit log is never edited or pruned automatically; it is deleted at the end of its retention period after account closure.

12. Changes to this policy

We will post updates at this address with a new effective date and, for material changes, notify workspace owners by email at least 14 days before they take effect.

Contact

Apex Root Solutions LLC, a limited liability company organised under the laws of the State of Delaware, with its registered office in Wilmington, New Castle County, Delaware, and its principal place of business in Cedar Hill, Dallas County, Texas. Email: support@apsoluts.com. Please include the email address of your AscendFlare account so we can verify the request.