Ascent

Privacy Policy

Version 1.2 · Effective · Last updated:

1. Data Controller

Ascent Projetos LTDA (hereinafter “Ascent”, “we”, or “the company”) is the controller of personal data collected through the website, Revit plugin, and web platform.

Privacy Contact:

  • Privacy Email: privacidade@ascent.app.br
  • Response Time: We confirm receipt within 7 business days and respond within 15 calendar days, per Art. 19 of the LGPD
  • Business Hours: Monday to Friday, 9am to 6pm (Brasilia time)

2. Data Collected

We collect different types of personal data based on your interaction with Ascent:

Registration Data:

  • Full name (required)
  • Email (required)
  • Phone (optional at sign-up and required when subscribing to a paid plan)
  • Company/Organization (optional, only if you provide it)
  • Geographic location: country, state, city (optional, only if you provide it)

Usage Data:

  • Access logs (IP, timestamp, browser)
  • Usage telemetry (which modules you use, frequency)
  • .rvt projects submitted (metadata, not the complete file)
  • Session duration and browsing patterns

Payment Data:

  • Processed exclusively by Asaas (we do not store card numbers)
  • Transaction history and receipts
  • Billing information (CPF or CNPJ)

AI-Generated Data:

  • Metrics extracted from your projects (element quantities)
  • Pattern analysis (common errors, optimization opportunities)
  • Personalized suggestions based on your workflow

The collection and processing of your data is based on the following articles of the LGPD (Law No. 13,709/2018):

  • Registration data collected during sign-up
  • You can revoke consent at any time

Performance of a Contract (Art. 7, II):

  • Data necessary for service provision (email, company)
  • Payment data for subscription processing
  • Access logs for security and auditing

Legitimate Interest (Art. 7, IX):

  • Usage telemetry for product improvements
  • AI analysis for personalized recommendations
  • Fraud prevention and abuse detection

4. AI and Automation Usage

Ascent uses externally trained AI models to offer advanced features. Here is how we operate with transparency:

AI Features:

  • Automatic Quantity Extraction: Processing of BIM elements to generate precise reports of materials and dimensions.
  • Optimization Suggestions: Analysis of your Revit projects to identify patterns and propose efficiency improvements.
  • Usage Pattern Analysis: Identification of workflows to personalize recommendations.

Data Transparency:

  • We DO NOT TRAIN: Your data is never used to train new AI models.
  • We DO NOT SHARE: Data is not shared with third parties for AI purposes.
  • CONTROL: You can turn off AI features by asking at privacidade@ascent.app.br.

Security:

  • Processing on secure servers with end-to-end encryption
  • Audited logs of all AI analyses

5. Third-Party Sharing

We share your data only with essential service providers, under confidentiality agreements.

Asaas (Payments):

Supabase (Cloud Storage):

  • Shared Data: All registration and project data
  • Purpose: Secure hosting and data synchronization
  • Location: US servers (GDPR compliant)
  • Privacy Policy: https://supabase.com/privacy

Meta (Meta Pixel):

Resend (Email Delivery):

Umami (Audience Measurement):

  • Shared Data: No personal data
  • Purpose: Audience measurement without cookies and without personal data

We Do Not Sell Data:

We never sell your personal data to third parties.

6. Data Retention

We keep your data only for as long as necessary. Here is our retention policy:

Registration Data:

  • While your account is active: Fully retained
  • After an account deletion request: Kept for 30 days (the period in which the account can be recovered) and then deleted, except for data the law requires us to keep: tax records are kept for 5 years (tax compliance requirement)

Telemetry Data:

  • Retention: 2 years from collection
  • Afterwards: Anonymized for statistical analysis

Project Data:

  • Under your control: You can delete at any time
  • Backup: Backups follow the provider’s policy for up to 30 additional days after deletion

Payment Data:

7. Data Subject Rights (LGPD Art. 18)

You have rights guaranteed by the LGPD. Here is how to exercise them:

1. Right of Access:

Obtain a copy of all your data in a portable format (CSV/JSON)

2. Right to Rectification:

Correct inaccurate information (name, email, company)

3. Right to Erasure:

Request deletion of all your data (right to be forgotten)

4. Right of Portability:

Receive your data in a structured format for transfer to another service

Withdraw consent for AI analysis and telemetry (with feature restrictions)

How to Exercise Your Rights:

  • Panel: Go to the panel > Profile, to access and correct your data, or Profile > Danger zone tab, to delete your account
  • Email: Send a request to privacidade@ascent.app.br
  • Response Time: We confirm receipt within 7 business days and respond within 15 calendar days, per Art. 19 of the LGPD

8. Information Security

We implement technical and administrative measures to protect your data:

Encryption:

  • HTTPS (TLS 1.2+) for all communications
  • AES-256 for data at rest on Supabase

Access Control:

  • RLS (Row Level Security) on the database
  • JWT authentication with secure tokens
  • Restricted employee access (under NDA)

Auditing:

  • Logs of all sensitive data operations
  • Continuous monitoring of suspicious access
  • Automatic alerts for unauthorized access attempts

Security Incidents:

In the event of a data breach, we will notify you via email within 72 hours (per LGPD, art. 48)

9. Content Platform Integrations

Ascent runs an internal content hub (Ascent Studio) that connects to external platforms to publish on the company’s official channels and read those channels’ metrics. This section describes what each integration accesses and how to revoke it.

Google and YouTube API Services

Ascent Studio uses YouTube API Services. By using this integration, you agree to the YouTube Terms of Service and are subject to the Google Privacy Policy.

  • Data accessed: identification of the connected channel, metadata of videos uploaded through us, and YouTube Analytics performance reports
  • Purpose: publishing and scheduling videos you authorized, and displaying channel metrics inside the panel
  • Limited Use: data obtained through Google APIs is used only to operate the features you authorized. We do not use it for advertising, do not sell it, and do not transfer it to third parties, except when strictly necessary to operate the service, with your explicit consent, or to comply with a legal obligation. We follow the Google API Services User Data Policy, including its Limited Use requirements
  • Google Drive: Studio creates organization folders in a shared drive owned by Ascent itself, through a service account. The integration does not access any user’s personal Google Drive
  • Revocation: at any time at myaccount.google.com/permissions, or by disconnecting the account in the panel

Meta and Instagram

  • Data accessed: identification of the connected professional account, content published through us, and reach and engagement metrics
  • Purpose: publishing and scheduling content you authorized, and displaying metrics inside the panel
  • Meta Privacy Policy: https://www.facebook.com/privacy/policy
  • Revocation: disconnect the account in the panel, or remove the app’s access in your Instagram account settings

Credential storage

Access tokens for connected accounts are isolated in the database, reachable only by the server processes that run publishing and metrics collection. No panel user can read them, under any role. Disconnecting an account deletes its token.

10. Data Deletion and Access Revocation

This section details how to delete your data. It complements section 7, which describes your rights as a data subject.

Delete your account and data

  1. Open the panel at painel.ascent.app.br
  2. Go to Profile, tab Danger zone, and choose Delete account
  3. Confirm with your password

Access is revoked immediately. Data is permanently erased after 30 days. This window exists to allow recovery in case of regret or an unintended request: within that period, simply contact us to reverse it.

Disconnect a social account

In the panel, under Studio, section Connections, remove the account. Its access token is deleted with it and Ascent Studio stops publishing or collecting metrics for that account. This does not delete anything already published on the external platform.

Request by email

If you cannot access the panel, send your request to privacidade@ascent.app.br from your registered email address. We confirm receipt within 7 business days and respond within 15 calendar days, per the LGPD.

What remains after deletion

Records required by legal or tax obligations are retained for the periods described in section 6, kept segregated, and are not used for any other purpose.

11. Changes to This Policy

This Privacy Policy may be updated periodically. When that happens:

Minor Changes (Technical Revisions):

  • Updated without prior notice
  • Check the version history (at the bottom of this page)

Material Changes (New Rights/Obligations):

  • Email notification 30 days before taking effect
  • You can withdraw consent if you disagree
  • Service continuity during the transition period

Previous Versions:

Available upon request. Contact privacidade@ascent.app.br

12. Contact

Questions about privacy? Contact us:

Data Protection Officer (DPO):

Mailing Address:

Ascent Projetos LTDA
São Paulo - SP
Brazil

Regulatory Authority:

National Data Protection Authority (ANPD)
https://www.gov.br/cidadania/pt-br/acesso-a-informacao/lgpd

13. Version History

  • v1.2 (10/21/2026, effective 11/26/2026): response deadlines to data subjects, retention after deletion, payment processor (Asaas), panel paths, and third parties (Meta, Resend, and Umami)
  • v1.1 (07/28/2026): previous version, with content platform integrations and data deletion
  • v1.0 (Jun 2026): initial version

Last updated: October 21, 2026

Back to Top