ASCNDED Privacy Policy
Effective date: 24 July 2026
ASCNDED ("we", "us") is operated by Asynchronous OÜ, a company registered in Estonia. Contact for anything in this policy, including privacy requests: ascndedofficial@gmail.com.
This policy covers ascnded.com and the ASCNDED facial analysis service.
The short version
You upload photos of your face. We measure them, generate your report, and store your photos and results in your account so you can access them later. We do not use your photos to train AI models, we do not sell your data, and we do not use your face for advertising or to identify you anywhere else. Your facial measurements are biometric data, so we only process them with your explicit consent, which we ask for before you scan.
1. What we collect
You provide:
- Face photos (front and side) that you capture or upload
- Quiz answers: your goals, what you have tried, and related answers
- Body stats: height, weight, age band (all optional)
- Email address (collected at purchase)
- Support messages if you contact us
We generate:
- Facial measurements and analysis: landmark coordinates, ratios, proportions, face shape classification, and the report built from them. These are derived from the geometry of your face and are treated as biometric data.
- An AI-generated assessment of visible characteristics (for example skin condition impressions, beard coverage) produced from your photos.
Collected automatically:
- Payment data is handled by Stripe. We receive confirmation of payment and your email; we never see or store your card number.
- Site analytics via Google Analytics (pages visited, device type, approximate location from IP). Analytics cookies are only set with your consent via the cookie banner.
- Basic technical logs (IP address, browser type) for security and operations.
2. Biometric data and your explicit consent
Measurements derived from the geometry of your face are special-category (biometric) data under the GDPR and sensitive data under several other laws. We process them only after you give explicit consent, which we request on a separate screen before your scan starts.
We use your facial data for exactly one purpose: generating your analysis and report. We do not:
- use your photos or measurements to train, fine-tune, or improve AI models;
- use them to identify you or match you against any other person or database;
- sell them, share them for advertising, or disclose them except to the processors listed in section 4;
- process photos of anyone other than the account holder (uploading someone else's face is prohibited).
You can withdraw consent at any time by requesting deletion (section 7). Withdrawal does not affect processing that happened before it.
3. How we use your data and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Generating your analysis and report | Photos, facial measurements, quiz answers, body stats | Explicit consent (Art. 9(2)(a), Art. 6(1)(a)) |
| Storing your report and photos in your account | Same | Explicit consent; contract |
| Processing your purchase and providing access | Email, payment confirmation | Contract (Art. 6(1)(b)) |
| Sending service emails (access link, receipt) | Contract | |
| Sending marketing emails (product updates, rescan reminders) | Consent; you can unsubscribe any time via the link in every email | |
| Site analytics | Cookies, usage data | Consent |
| Security, fraud prevention, legal compliance | Technical logs, payment records | Legitimate interest; legal obligation |
Your report is generated by automated analysis; that automation is the product you purchase. It produces aesthetic information only and has no legal or similarly significant effect on you.
4. Who processes your data (processors)
| Processor | Role | Location |
|---|---|---|
| Supabase | Database, authentication, photo storage | EU region |
| Railway | Application hosting and compute | EU/US infrastructure |
| Google (Gemini API) | AI analysis of your photos to produce the perception portion of your report | EU/US. Per Google Cloud's terms for paid API services, submitted content is not used to train their models |
| Google Analytics | Site analytics (consent-based) | EU/US |
| Stripe | Payment processing | EU/US |
Where data leaves the EEA, transfers rely on the European Commission's adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified) and/or Standard Contractual Clauses.
5. Retention
| Data | Kept for |
|---|---|
| Photos, facial measurements, report | Until you request deletion, or automatically deleted 3 years after your last interaction with your account, whichever comes first |
| Account (email, purchase link) | Same as above |
| Payment and invoicing records | 7 years (Estonian accounting law) |
| Analytics data | Per Google Analytics retention settings (max 14 months) |
| Support emails | 2 years |
When retention ends, biometric data is permanently deleted from production systems and expires from backups on the backup cycle.
6. Security
Data is encrypted in transit and at rest. Photos are stored in access-controlled storage and served only via short-lived signed URLs tied to your account. Access to production data is restricted to the operators of the service. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authority as required by law.
7. Your rights
If you are in the EEA/UK: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Erasure requests remove your photos, measurements, and report; we retain only what payment law requires.
If you are in a US state with a privacy law (California, Illinois, Texas, Washington, and others): you have equivalent rights to know, access, delete, and correct, and rights specific to sensitive/biometric data. We do not sell personal information or share it for cross-context behavioral advertising, and we honor deletion of biometric data on request. Nothing in this policy permits retention of biometric identifiers beyond the schedule in section 5.
To exercise any right: email ascndedofficial@gmail.com from the address on your account. We respond within 30 days. You may also lodge a complaint with your supervisory authority; ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
8. Cookies
Essential cookies (session, payment) run without consent. Google Analytics cookies load only after you accept them in the cookie banner, where you can also refuse or change your choice.
9. Age
ASCNDED is for adults aged 18 and over. We do not knowingly process data of anyone under 18; if we learn we have, we delete it. Do not upload photos of minors under any circumstances.
10. Changes
We will post changes here with a new effective date. For material changes to how we handle biometric data, we will ask for consent again.
11. Contact
Asynchronous OÜ, Estonia · ascndedofficial@gmail.com