Privacy Policy

Data controller

The controller of your personal data, within the meaning of Article 4(7) GDPR, is:

Data Protection Officer (DPO)

As appointing a DPO is not mandatory given the size of the organisation and the nature of the processing, ASCEND has not appointed one. Any question about your personal data can be sent directly to the contact address above.

Data collected

ASCEND only collects the personal data you provide voluntarily when using the Application, and the data strictly necessary for its technical operation.

Purposes and legal bases

In accordance with Article 6 GDPR, each processing operation relies on an identified legal basis.

Performance of the contract (Art. 6(1)(b) GDPR)

Most data is processed to perform the terms of use and the subscription you have entered into:

• Creating and managing your user account
• Calculating your calorie needs and your personalised training programs
• Recording your progress (workouts, measurements, photos)
• Syncing your data across your devices
• Sending you functional notifications related to your program

Legitimate interest (Art. 6(1)(f) GDPR)

A few limited processing operations rely on the controller's legitimate interest:

• Keeping the Application secure and preventing fraud or abuse
• Improving the quality of the service using aggregated and anonymised usage data
• Answering your support requests

You can object to this processing at any time (see Article 11).

Legal obligation (Art. 6(1)(c) GDPR)

Some data may be kept to meet legal obligations, in particular accounting and tax obligations (10 years for accounting records relating to subscriptions).

Consent (Art. 6(1)(a) GDPR)

Any optional feature going beyond what is strictly necessary (for example, behavioural reminder notifications, syncing with Apple Health or Health Connect, editorial email communications) is only activated with your explicit consent, which you can withdraw at any time from the Application settings.

Recipients and processors

Your data is never sold, rented or transferred to third parties for commercial or advertising purposes.

It may be shared with the technical processors strictly necessary for the operation of the service, under a data processing agreement compliant with Article 28 GDPR:

This list may change if new technical processors become necessary (for example: an anonymised audience analytics provider, a web payment provider outside the app stores, a transactional email provider). Any change will be reflected in an updated version of this policy.

Transfers outside the European Union

Your data is stored in France (Supabase eu-west-3 data center, Paris). No transfer outside the EU takes place for the main storage.

Occasional and limited transfers outside the European Union may nevertheless occur, in particular in connection with Apple and Google (distribution, authentication, payments and notifications), RevenueCat (subscription management) and Anthropic (artificial intelligence features). These transfers are covered by appropriate legal safeguards:

• Apple's and Google's participation in the EU-U.S. Data Privacy Framework, recognised by the European Commission's adequacy decision of July 10, 2023
• The European Commission's Standard Contractual Clauses and the data processing agreements entered into with the processors concerned

You can obtain a copy of the safeguards applicable to any transfer by writing to ascend.webapp@gmail.com.

Retention period

Your data is not kept longer than necessary for the purposes described in Article 3.

Data security

ASCEND implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of your data.

• Encrypted communications: all communications between the Application and our servers are encrypted with TLS (HTTPS)
• Encryption at rest: databases and file storage are encrypted on Supabase's servers
• Strict isolation: each user can only access their own data, thanks to Row-Level Security (RLS) enforced on the server
• Passwords: your password is never stored in plain text. It is hashed with a standard cryptographic algorithm (bcrypt) and cannot be recovered, not even by the publisher
• Private photos: your progress photos are stored in private storage, only accessible through temporary signed URLs linked to your account
• Stronger authentication: you can sign in with Apple or Google, delegating security to these recognised providers

Despite these measures, no system can guarantee absolute security. If an incident is likely to affect your data, you will be informed as soon as possible in accordance with Article 34 GDPR, and the incident will be notified to the CNIL under the conditions of Article 33 GDPR.

Cookies and trackers

ASCEND is a native mobile application. It uses no browser cookies, no advertising pixels, no advertising identifiers (IDFA, GAID) and no third-party behavioural tracking tools for advertising purposes.

The Application only stores on your device the minimal technical data needed for it to work (sign-in session, display preferences, local cache). This data stays on your device and is never used for commercial purposes.

Minors

The Application is strictly reserved for people aged 16 or over.

ASCEND does not knowingly collect personal data from anyone under 16. If you are a parent or legal guardian and believe that a minor under 16 has created an account without your permission, contact us at ascend.webapp@gmail.com. The account will be suspended immediately and the associated data deleted.

For users aged 16 to 18, use of the Application requires the prior consent of a parent or legal guardian.

Profiling and automated decisions

ASCEND carries out no profiling for advertising or commercial purposes. Your data is never used to show you targeted advertising, nor shared with advertising networks or behavioural data brokers.

The Application automatically calculates your calorie needs, your macronutrients and your training program from the information you have provided. These calculations are strictly deterministic and based on published scientific formulas (Mifflin-St Jeor method for basal metabolic rate). They produce no legal effects concerning you and are not an "automated decision" within the meaning of Article 22 GDPR.

The artificial intelligence features generate answers from the information you choose to send. These answers may be inaccurate or incomplete and should be checked before you act on them. They are not a diagnosis, a prescription or medical advice, and produce no legal effect or binding decision concerning you.

You can always change your calorie and macronutrient targets manually in the Application, or ask for human assistance through the messaging features, depending on your subscription plan.

Your rights

In accordance with Articles 15 to 22 GDPR and the French "Informatique et Libertés" law, you have the following rights over your personal data at any time:

Right of access (Art. 15 GDPR)

You can ask for confirmation that your data is being processed and obtain a copy of all the data concerning you.

Right to rectification (Art. 16 GDPR)

You can ask for any inaccurate or incomplete data to be corrected. Most corrections can be made directly from your profile in the Application.

Right to erasure, or "right to be forgotten" (Art. 17 GDPR)

You can request the permanent deletion of your data. Deletion takes place within 30 days at the latest, subject to legal retention obligations (in particular accounting obligations).

Deletion can be started in the Application from Profile → Settings → Delete my account, or requested without reinstalling the Application from the page Delete your ASCEND account.

Right to restriction of processing (Art. 18 GDPR)

You can ask for the processing of some of your data to be temporarily suspended, for example while a request for rectification is being checked.

Right to data portability (Art. 20 GDPR)

You can ask to receive your data in a structured, commonly used and machine-readable format (JSON), in order to transfer it to another service.

Right to object (Art. 21 GDPR)

You can object, on grounds relating to your particular situation, to processing based on legitimate interest.

Right to withdraw your consent (Art. 7 GDPR)

For processing based on your consent (optional notifications, health syncing, etc.), you can withdraw your consent at any time from the Application settings, without affecting the lawfulness of processing carried out before.

Post-mortem instructions (Art. 85 of the French "Informatique et Libertés" law)

You can set instructions about what happens to your data after your death, either general (with a certified trusted digital third party) or specific to the Application (by writing to us directly).

Residents of other countries

If you live outside the European Union (for example in the United States, the United Kingdom, Canada or Australia), you benefit from the same rights described above, in addition to any rights granted by the law of your country. ASCEND does not sell or share your personal data for cross-context behavioural advertising.

How to exercise your rights

To exercise any of these rights, write to us at ascend.webapp@gmail.com, stating clearly which right you wish to exercise. We may need to verify your identity if there is any doubt about who is making the request. We answer every request within one month at most, which may be extended by two further months for particularly complex requests (with prior notice).

Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

Changes to this policy

This policy may change to reflect legal, technical or organisational developments (adding a processor, changing retention periods, etc.).

Any substantial change will be notified in advance by email or by notification in the Application, at least 15 days before it takes effect. The version of the policy in force is always available from the Application and shows its update date at the top.

The version history is available on request at the contact address.

Contact and complaints

Write to us

For any question about this policy or to exercise your rights:

Complain to a supervisory authority

Independently of any action with the controller, you have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), which is the competent supervisory authority, or with the data protection authority of your country of residence: