Privacy Policy

Last updated: March 28, 2026

1. Introduction

This Privacy Policy explains how Ascend collects, uses, stores, and protects your personal data when you use our platform. By using Ascend, you agree to the practices described in this policy.

This policy applies to all users of the Ascend web application, including athletes, coaches, and administrators.

2. Data Controller

The data controller responsible for your personal data is:

WoTo VOF

• KvK: 91637872
• BTW: NL865720435B01
• Oosteinde 167, 2611VD Delft, The Netherlands
• Email: [email protected]

WoTo VOF has not appointed a Data Protection Officer as we are not required to do so under GDPR Article 37. For any data protection inquiries, please contact us at [email protected].

3. Data We Collect

Account Data

When you create an account, we collect your name, email address, and a hashed version of your password. We never store your password in plain text.

Profile Data

Information you add to your profile, such as your display name, profile picture, bodyweight, and other training-related details.

Training Data

Training programs, exercises, sets, reps, weights, and other data you enter to track your training progress.

Payment Data

Payment processing is handled by Stripe. We do not store your credit card numbers or full payment details on our servers. We only store Stripe customer and subscription identifiers to manage your account.

Usage and Analytics Data

We collect anonymized usage data such as page views, feature usage, and interaction patterns to improve the platform.

Video Data

If you use video features, videos are uploaded to and hosted by Mux. We store references to your video assets but the video files themselves are processed and stored by Mux.

Device and Browser Information

We may collect device type, browser type, operating system, and IP address for security, analytics, and service improvement purposes.

4. Legal Basis for Processing (GDPR Art. 6)

We process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the Ascend service you signed up for, including managing your account, training data, and coaching relationships.
• Legitimate interest — analytics and platform improvement, fraud prevention, and ensuring the security of our service.
• Consent — where you have given explicit consent, such as for optional analytics cookies or marketing communications. You may withdraw consent at any time.
• Legal obligation — processing necessary to comply with legal requirements, such as tax and accounting obligations for payment records.

5. How We Use Your Data

• Provide and operate the Ascend platform and its features
• Process payments and manage subscriptions via Stripe
• Send transactional emails (account verification, password resets, important updates)
• Collect anonymized analytics to understand usage patterns and improve the platform
• Ensure the security and integrity of our service
• Comply with legal obligations

6. Third-Party Processors

We share your data with the following third-party service providers who process data on our behalf:

7. International Transfers

Our primary hosting infrastructure is located in the European Union (Germany). Some of our third-party processors (Stripe, Mux) are based in the United States. For these transfers, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of data protection.

8. Cookies

We use the following types of cookies:

• Session and authentication cookies — essential for keeping you logged in and maintaining your session. These are strictly necessary and cannot be disabled.
• PostHog analytics cookies — used to collect anonymized usage data to help us improve the platform.
• Cloudflare security cookies (__cf_bm) — used for bot management and protecting the service from malicious traffic.
• Stripe fraud detection cookies — used by Stripe to detect and prevent fraudulent payment activity.

Session/authentication cookies and Cloudflare security cookies are strictly necessary for the platform to function and do not require your consent. PostHog analytics cookies are only set with your consent. You can manage your cookie preferences at any time through the cookie settings on our platform. Stripe fraud detection cookies are set by Stripe as part of their payment processing service.

9. Data Retention

We retain different categories of data for different periods:

• Account and profile data — retained while your account is active; deleted upon account deletion request.
• Training data — retained while your account is active; deleted upon account deletion request.
• Payment and billing records — retained for 7 years after the transaction date, as required by Dutch tax law.
• Analytics data — anonymized and aggregated; individual session data retained for up to 12 months.
• Server logs and IP addresses — retained for up to 90 days for security purposes.
• Video data — deleted from Mux upon account deletion request or when removed by the user.
• Backups — purged within 30 days of a deletion request.

10. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to restrict processing — request that we limit how we use your data.
• Right to object — object to processing based on legitimate interest.
• Right to withdraw consent — withdraw any previously given consent at any time.
• Right to lodge a complaint — file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at https://autoriteitpersoonsgegevens.nl.

To exercise any of these rights, contact us at [email protected].

Withdrawing your consent does not affect the lawfulness of any processing carried out before the withdrawal.

11. Security

We take appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit using TLS for all connections
• Encryption at rest for stored data
• EU-based hosting infrastructure
• Regular security reviews and updates

12. Children

Ascend is intended for users aged 18 and older. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected data from a minor, we will take steps to delete that information promptly.

13. Automated Decision-Making

We do not use automated decision-making or profiling as defined under GDPR Article 22. No decisions with legal or similarly significant effects are made about you based solely on automated processing.

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by GDPR Article 34. We will also notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

15. Obligation to Provide Data

Providing your name, email address, and password is required to create an account and use Ascend. Without this data, we cannot provide the service. All other data (profile details, training data, video content) is voluntary and can be added or removed at your discretion.

16. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email at the address associated with your account. We encourage you to review this policy periodically.

17. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• WoTo VOF, Oosteinde 167, 2611VD Delft, The Netherlands