Effective 11 September 2026
Privacy Policy
This policy explains what Apex Root Solutions LLC, a limited liability company organised under the laws of the State of Delaware, with its registered office in Wilmington, New Castle County, Delaware, and its principal place of business in Cedar Hill, Dallas County, Texas (“Apex Root Solutions LLC”, “we”) collects when you use AscendFlare (the “Service”), why, how long we keep it, whom we share it with, and the choices and rights you have. It applies to the Service at this address and to emails we send about it. It does not cover the platforms you connect (Google, Apple, Meta, TikTok, LinkedIn and others), which handle your data under their own policies.
Who is responsible
For your account data, Apex Root Solutions LLC is the controller. For the data you bring into a workspace — the apps you analyse, the content you approve, the accounts you connect — your organisation is the controller and we act as its processor on your instructions; our Data Processing Addendum governs that processing for customers subject to the GDPR or UK GDPR. Contact for all privacy matters: support@apsoluts.com.
The short version
- We never ask for, see or store a password for any platform. Connections use OAuth or keys the platform issues, encrypted at rest and revocable from the Connections page.
- Nothing is published, launched or spent without a person’s explicit confirmation, and every such action is recorded in an audit log you can export.
- We do not sell personal data, do not use it for advertising, and do not use your data to train AI models.
- We set only strictly necessary cookies; there is no tracking, so there is no cookie banner.
- You can export everything and delete your workspace or account yourself, at any time.
What we collect, why, and for how long
| Data | Source | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Account: email address, name and profile image (from Google sign-in, if used), sign-in timestamps | You / Google | Create and secure your account, send sign-in links and service emails | Performance of a contract | Life of the account; deleted with it |
| Sessions: hashed session token, IP address, browser user-agent, last-seen time | Your browser | Keep you signed in, let you review and revoke devices, detect abuse | Legitimate interest (security) | Until revoked or expired (30 days); expired rows purged daily |
| Workspace membership, role, invitations (invitee email) | You | Access control | Performance of a contract | Life of the workspace |
| Public store listings and public reviews of the apps you analyse (review text, star rating, reviewer display name and date as the store publishes them) | Google Play, Apple App Store | Analysis, recommendations and drafting | Legitimate interest (providing the service you requested) | Raw reviews removed 90 days after the last analysis; listing cache 6 hours; analysis cache 24 hours |
| Recommendations, drafts, ad concepts, campaign records, posts, rendered images and videos, approvals | You / generated | The service | Performance of a contract | Life of the workspace; unattached renders 90 days |
| Platform credentials: OAuth access and refresh tokens, API keys, system-user tokens, granted scopes, expiry | The platform, with your authorisation | Perform the actions you approve; check token health | Performance of a contract | Until you disconnect or delete the workspace; encrypted at rest (AES-256-GCM), revoked at the platform where supported |
| Performance data from platforms: impressions, clicks, spend, installs, reach, post insights | Connected platforms | Reporting, spend caps, automatic pauses, feedback into recommendations | Performance of a contract | 13 months |
| Audit log: actor email, IP address, timestamp, action, before/after values for every publish, launch, pause, post, setting change and deletion | Generated | Accountability, dispute resolution, compliance, security investigations | Legitimate interest; legal obligation | Append-only; retained for the life of the account and 3 years after closure |
| Alerts and notification delivery records (recipient, channel, result) | Generated | Warn owners about spend, expiring tokens and failures | Legitimate interest | 90 days |
| Usage metering: AI tokens, cost, videos generated, per workspace and month | Generated | Budget caps, billing | Performance of a contract | Life of the workspace plus 7 years for billing records |
| Operational logs and error reports: request id, route, timing, error messages (secrets and tokens scrubbed), truncated IP | Generated | Reliability, security, debugging | Legitimate interest | 30 days |
| Support correspondence | You | Answer your requests | Legitimate interest | 3 years |
We do not collect special-category data, and the Service is not directed at children under 18; we delete any account we learn belongs to a minor.
Public reviews and other people’s data
When you analyse an app, we fetch the listing and a sample of recent public reviews exactly as the store shows them to anyone. Reviews contain the reviewer’s display name and text, which can be personal data. We use them only to find themes and evidence for recommendations, quote them only in drafts you see, strip them from stored listings 90 days after the last analysis, and never contact reviewers or combine reviews with other sources. If you are a reviewer and want a quote removed from a workspace, write to support@apsoluts.com.
Cookies
The Service sets only cookies that are strictly necessary to operate it:
ascend_session— keeps you signed in (30 days, HttpOnly, Secure, SameSite=Lax).ascend_ws— remembers which workspace you selected (1 year).- Short-lived signed state cookies during sign-in and platform connection (10 minutes), which protect against cross-site request forgery.
We use no analytics, advertising or third-party cookies and no fingerprinting. Because there is nothing to consent to, we do not show a cookie banner.
How we use AI
Listing text, public reviews and your existing drafts are sent to our model provider, Anthropic, to generate recommendations, copy, ad concepts and posts. Prompts never include your credentials or your users’ account data. Anthropic processes this data under its commercial API terms, which prohibit training on customer content; we do not train models on your data either. Video generation for reels sends the script to the video provider named in the sub-processor list. Both usages are metered per workspace and capped by the workspace owner.
Who we share data with
- Platforms you connect, to carry out the actions you approve (for example sending an approved listing description to Google Play, or an approved post to Instagram). They act as independent controllers under their own terms.
- Sub-processors that run the Service on our behalf — hosting, object storage and database replication, transactional email, the AI model provider, video generation, and error monitoring — listed with locations at /legal/subprocessors. Each is bound by a data-processing agreement. We give workspace owners 30 days’ notice before adding one.
- Your workspace: members see the data in their workspace according to their role; the audit log shows who did what, including email address and IP address of the actor, to the workspace’s owners.
- Endpoints you configure: if an owner sets an alert or event webhook, we send audit events and alerts to that address; you control where it points.
- Legal and safety: to comply with a law, court order or lawful request; to enforce our Terms; or to protect the rights, safety or property of Apex Root Solutions LLC, our users or the public. Where lawful, we will tell you first.
- Business transfers: in a merger, acquisition or sale of assets, subject to this policy.
We do not sell personal data and have not done so in the preceding 12 months, and we do not “share” it for cross-context behavioural advertising as those terms are defined in US state privacy laws.
Platform-specific commitments
- Google. AscendFlare’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google Play Console, Google Ads and YouTube is used only to read and edit the listings, campaigns and channels you connect, is never used for advertising unrelated to your account, and is never sold or transferred to data brokers.
- Meta (Facebook, Instagram, Meta Ads). Data received from Meta APIs is used solely to manage the Pages, Instagram accounts and ad accounts you connect, in accordance with the Meta Platform Terms and Developer Policies. You can remove AscendFlare’s access from your Facebook settings at any time; disconnecting in AscendFlare also revokes it. To request deletion of Meta-sourced data, delete the connection or the workspace, or write to support@apsoluts.com.
- TikTok. Content is posted only to your own account with the audience, interaction and commercial-content settings you choose per post; data from the TikTok API is used only to publish and report on those posts.
- YouTube. The Service uses YouTube API Services; by connecting YouTube you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies. You can revoke access at Google security settings.
- LinkedIn, Apple (App Store Connect, Apple Ads). Tokens and keys are used only for the listing, page and campaign actions you approve and are deleted when you disconnect.
Security
Platform credentials are encrypted with AES-256-GCM under a key held outside the database, with versioned key rotation. All traffic uses TLS. Sign-in is passwordless (single-use links or Google) and every session can be reviewed and revoked. Roles limit who can approve, publish or connect. Every write to a platform requires an individual confirmation and is recorded in a tamper-evident, hash-chained audit log. The database is continuously replicated for point-in-time recovery. Logs are scrubbed of secrets. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify affected workspace owners without undue delay and, where the GDPR applies, within the 72-hour window it sets.
Where data is processed
The Service is operated from the United States and its hosting, storage, email, AI and monitoring providers process data there (locations are listed on the sub-processors page). If you are in the European Economic Area, the United Kingdom or Switzerland, transfers to us and our sub-processors rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum or IDTA), supplemented where a provider is certified under the EU-US Data Privacy Framework. A copy of the clauses we use is available on request.
Your rights and choices
- Self-service. From the Account page you can export your account data and (as an owner) your workspace data as JSON, revoke sessions, disconnect any platform, change your workspace timezone and alert settings, and delete a workspace or your account. Deleting a workspace revokes platform access where the platform supports it, removes stored media and data, and keeps only the audit trail for the period above.
- Access, correction, deletion, restriction, portability, objection. If you are in the EEA, UK, Switzerland, or a US state with a privacy law (including California, Colorado, Connecticut, Virginia, Utah, Texas and others), you may exercise these rights by email to support@apsoluts.com. We will respond within 30 days (45 days where US state law provides) and will not discriminate against you for exercising them. You may appeal a decision by replying to our response; EEA/UK users may also complain to their supervisory authority.
- Data in a customer’s workspace. If your data was placed in a workspace by one of our customers (for example, you are a reviewer, or a member of their team), we will refer your request to that customer and help them respond.
- Email. Service emails (sign-in links, security notices, alerts you enabled, legal notices) are part of the Service; alerts can be switched off on the Account page. We send no marketing email without a separate opt-in, and every marketing email has an unsubscribe link.
- Do Not Track / Global Privacy Control. We do not track users across sites, so these signals change nothing; we honour them by design.
Retention and deletion in practice
A daily job enforces the schedule in the table above: it strips raw reviews from apps not re-analysed in 90 days, removes performance rows older than 13 months, expired sessions and sign-in tokens, alerts older than 90 days, finished job records older than 30 days, and rendered media not attached to a published post after 90 days. Backups and replicas roll off within 30 days. The audit log is never edited or pruned automatically; it is deleted at the end of its retention period after account closure.
Changes to this policy
We will post updates at this address with a new effective date and, for material changes, notify workspace owners by email at least 14 days before they take effect.
Contact
Apex Root Solutions LLC, a limited liability company organised under the laws of the State of Delaware, with its registered office in Wilmington, New Castle County, Delaware, and its principal place of business in Cedar Hill, Dallas County, Texas. Email: support@apsoluts.com. Please include the email address of your AscendFlare account so we can verify the request.