Privacy policy

1. Who operates Ascend API

Ascend API is operated by Adenihun Abdulhawal, an individual operator based in Oyo State, Nigeria. In this policy, “Ascend API”, “Ascend”, “we”, “us” and “our” refer to that operator. For privacy questions or requests, email thesage196@gmail.com. We do not publish a street or business address for privacy correspondence; email is our published contact channel.

2. The data we process

Depending on how you use the service, we may process:

• Account data: email address, authentication identifiers, sign-in and account-security events. Supabase Auth manages passwords and authentication credentials; Ascend API does not receive or store your account password.
• Project and API configuration: connected project name and URL, encrypted project connection credentials, imported schema metadata, endpoint definitions, API descriptions and prompts, API-key identifiers, hashed API keys, scopes and settings.
• Workspace data: workspace names, membership roles, invited email addresses, invitation status, notification data and audit events.
• Operational metadata: request identifier, HTTP method, endpoint route template, response status, latency, API-key identifier, workspace identifier and a keyed one-way digest derived from the caller IP address when IP protection is configured. The application database does not intentionally store raw caller IP addresses in gateway analytics.
• Support correspondence: information you include when you email us about your account, security, privacy or the service.

Do not put passwords, access tokens, payment-card information or unrelated personal information into API names, endpoint descriptions, prompts or other configuration fields.

3. Customer database requests and payloads

Ascend API forwards authorised API requests to the Supabase project you connect and returns the response. Request and response payloads are processed in transit to perform the operation, but the application does not intentionally write those payload bodies to its gateway analytics tables. Gateway analytics are limited to the operational metadata described above. Your connected Supabase project receives and processes the data according to its own configuration, access policies and provider terms.

You decide which tables and columns to expose, who receives API keys, and whether your connected database contains personal or sensitive data. You must have the necessary rights and lawful basis to process that data, configure Row Level Security and other database permissions correctly, and give your own users any required privacy information. Do not use Ascend API to expose sensitive or confidential records without appropriate safeguards.

4. How we use data and our lawful bases

We use information for the following purposes:

• To create and secure accounts, authenticate users, save configurations and provide the service, where processing is necessary to perform our agreement with you.
• To route API calls, apply permissions, enforce quotas, maintain auditability, detect abuse, troubleshoot faults and protect users and infrastructure, where we have legitimate interests in operating a secure service and those interests are not overridden by your rights.
• To respond to support and privacy requests and comply with applicable legal obligations.
• To provide optional AI-assisted endpoint drafting when that feature is enabled for the service.

Where a particular activity requires consent under applicable law, we will request it separately. You may withdraw consent where consent is the basis for processing; this does not affect processing already lawfully carried out.

5. Optional AI-assisted drafting

If the service operator enables AI-assisted endpoint drafting, the prompt you submit and the selected table and schema context needed to generate suggestions are sent to OpenAI for processing. Ascend API does not intentionally send connected-database row contents or stored connection credentials for this feature. If AI drafting is not enabled, endpoint suggestions use the local rules-based generator. Do not include customer records, passwords, keys or sensitive personal information in prompts. OpenAI processes information under its own terms and privacy documentation.

6. Security and storage

Connected-project runtime credentials are encrypted server-side before storage. The separate secret key that may be supplied for one-time schema discovery is sent to the server over HTTPS for that schema request and is not saved as a stored project credential. Ascend API keys are stored as one-way hashes; the raw key is displayed only when created. Access to application records is controlled through server-side checks and database Row Level Security. No online service can guarantee absolute security, so keep your credentials private and tell us promptly if you suspect unauthorised access.

7. Service providers and disclosures

We share information only where needed to operate the service, meet legal obligations or protect rights and security. Depending on the features in use, recipients may include:

• Supabase: application authentication, database storage and the connected Supabase services you choose to use.
• Vercel: application hosting, deployment, request delivery and, if configured, custom-domain provisioning.
• OpenAI: optional AI-assisted endpoint drafting, only when configured and used.
• Google: Gmail processing of support and privacy correspondence sent to our published contact address and, if configured, Google OAuth sign-in.
• Authorities and professional advisers: where disclosure is required by law or reasonably necessary to establish, exercise or defend legal claims or protect users and the service.

These providers may process data in countries outside Nigeria. The provider, service settings and infrastructure region can affect where processing takes place. Where applicable data-protection law requires safeguards for an international transfer, we will use the required transfer mechanism or other lawful safeguard. We do not sell personal data or use it for third-party targeted advertising.

Our hosting, authentication, email and database providers may also independently process network identifiers and service metadata in their platform logs for delivery, security and reliability. Those provider-side records are governed by the providers’ own retention and security controls and are not all controlled by Ascend API’s in-app retention job.

8. Retention periods

We keep information only for as long as it is reasonably needed for the purpose described in this policy, subject to legal requirements and the exceptions below. Our current automated retention schedule is:

• Gateway request metadata: 30 days.
• Rate-limit and abuse-protection counters: 2 days.
• Accepted or expired workspace invitation records: 30 days after acceptance or expiry.
• Notifications: 180 days.
• Application activity logs and workspace audit events: 365 days.
• Revoked authentication session identifiers after account closure: 30 days, to prevent still-unexpired access tokens from being reused.

Account, workspace, project and API configuration is retained while the relevant account or workspace remains active, unless it is deleted earlier. When an account is closed, its account data and owned Ascend API assets are removed from the active application database. Encrypted disaster-recovery backups and provider-held operational records may remain until those systems rotate or delete them under their own retention schedules. We may retain limited records where required by law or necessary to establish, exercise or defend legal claims.

9. Your privacy rights and how to make a request

Subject to the conditions and exceptions in applicable law, you may request access to your personal data, correction of inaccurate information, erasure, restriction of processing, portability, or object to processing. You may also withdraw consent where we rely on it. These rights are not absolute in every circumstance.

To make an access, correction, restriction, objection or portability request, email thesage196@gmail.com from the email address associated with your account. State the type of request and provide enough information for us to locate the relevant account. We may ask for additional information to verify your identity. Do not send passwords, API keys or database credentials.

To delete your account while signed in, open Settings → Delete account, enter your account email and type DELETE MY ACCOUNT. For security, the deletion action requires a recent sign-in. If you cannot access your account, email thesage196@gmail.com with the account email and a request to delete it; we will verify the request before acting.

Deleting an account also removes workspaces owned by that account and their Ascend API assets, which ends access for other members of those workspaces. It does not delete records in your external Supabase database. If you believe your rights have not been respected, you may lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng.

10. Changes to this policy

We may update this policy when the service, our processing activities or applicable law changes. We will update the effective date on this page. Where a change materially affects how we use personal data, we will provide additional notice through the service or another appropriate channel.

11. Contact

Privacy contact: Adenihun Abdulhawal, operator of Ascend API, Oyo State, Nigeria. Email: thesage196@gmail.com.