Privacy policy
Last updated 6 November 2026. How Ascend uses your information.
Who is responsible
ICarta Ltd, Sun House, 2-4 Little Peter Street, Manchester M15 4PS, is the controller of your personal information. Contact us about anything here at hello@howllmsactuallywork.com.
What we collect, and why
| What | Why | Our lawful basis |
|---|---|---|
| Your email address and name (from Google or the email link) | To create your account and sign you in | Contract |
| Your goal, the aim you describe, time and deadline, field, tools, experience and how you like to learn | To build and pace your plan, and to tailor questions and examples to you | Contract |
| Your quiz and diagnostic answers, how sure you said you were, lesson progress, practice and review results | To work out where you stand, adapt what comes next, and bring ideas back for review | Contract |
| What you write for feedback, the tutor, the prompt workbench and the capstone, and the replies | To give you feedback and keep it so you can read it back | Contract |
| Your credential page name and the ideas on it, if you publish one | To show the page you asked for | Consent, which you can withdraw by taking it down |
| Your email preferences, and a record of emails sent | To send only what you asked for, and never twice. If you ask for the getting-started emails we use what you have done on the site (for example whether you have started a lesson) to decide whether one is useful, send no more than six in all, and stop on one click | Consent for getting-started emails, reminders and the weekly note; contract for essential messages |
| Your answer to the one-question follow-up email (what got in the way, and any note you add) | To learn what to improve | Consent: you choose to answer, and it is deleted with your account |
| Payment status and a customer reference from Stripe (not your card details) | To give you the access you have paid for | Contract, and legal obligation for tax records |
| Usage events (such as opening a lesson), the type of AI call made and its cost, and which wording of the terms you saw | To keep the service working, control costs, and see what to improve | Legitimate interests |
| A scrambled form of your network address (never the address itself) and the result of a bot check | To stop automated abuse of sign-up and the quiz | Legitimate interests |
We do not sell your information, and we do not use it for advertising. We make no decision about you that has a legal or similarly significant effect by automated means: the AI feedback and the capstone review are study aids you can read, dispute or repeat, not a gate on anything you are entitled to.
The AI provider
The AI features send text to Anthropic’s API: what you write for feedback, tutor messages, workbench prompts and capstone work, the lesson being discussed, and, for plan summaries and for wording quiz questions in your field, your goal, field, tools and the aim you described. We do not send your name or email address. A short summary of each call (which feature, how big it was and what it cost) is kept by us, not the content. Anthropic’s commercial terms say it does not train its models on content sent through its API, and that API inputs and outputs are deleted within 30 days unless the law or its safety rules require them to be kept longer. Its data processing terms, which include the UK transfer addendum, form part of those terms.
Who else handles your information
- Cloudflare hosts the service and stores its database. The database is held in Cloudflare’s Western Europe region; the service itself runs on Cloudflare’s global network, so requests can be handled in other countries too.
- Google (Firebase Authentication) handles sign-in with Google and email links. Google Fonts are also loaded from Google when you view a page, which sends your address to Google.
- Stripe takes payments and holds your payment details.
- Anthropic provides the AI model, as above.
- Resend sends our emails, once email is switched on.
- Cloudflare Turnstile, if switched on, checks that a visitor is a person.
Some of these are in the United States or elsewhere outside the UK. Where that applies we rely on the safeguards the law allows, such as the UK addendum to standard contractual clauses or an adequacy decision.
Cookies and similar storage
We use only what is needed to run the service, so there is no cookie banner. No advertising or analytics cookies are used.
sid: keeps you signed in. Secure, not readable by scripts, kept for up to 14 days.anon_id: remembers an anonymous visitor’s quiz so they can pick it up and bring it into an account. Secure, not readable by scripts, set for a year, but the quiz it points to is deleted 90 days after the last visit.- On the sign-in and account pages, Firebase’s sign-in code keeps a sign-in token in your browser’s storage, and the sign-in page keeps the email address you typed there until you finish signing in.
If we ever add anything beyond this list, we will update it here and ask for your consent first wherever the law requires it.
How long we keep it
- Your account information and learning record: until you delete your account, which removes it from our live systems straight away. Copies in database backups are replaced on the provider’s normal cycle. That cycle is at most 30 days.
- An anonymous visitor’s quiz and its events: 90 days after their last visit, unless they sign up and it becomes part of their account.
- Usage events: up to 400 days, or until you delete your account.
- Records of payments: kept by Stripe and by us for as long as tax law requires. At present that is six years.
- Scrambled address records for abuse prevention: about two days.
Your rights
You can ask to see what we hold, have it corrected or deleted, restrict or object to how we use it, take it with you, and withdraw consent. Most of this you can do yourself on your account page: download everything as a file, or delete your account. For anything else, write to hello@howllmsactuallywork.com. If you are unhappy with our answer you can complain to the Information Commissioner’s Office (ico.org.uk), and you may have similar rights with a regulator where you live.
Children
Ascend is not for anyone under 16. If you think a child has signed up, tell us and we will delete the account.
Security
Sign-in is handled by Google’s authentication service; our own session keys are stored only as a one-way hash; connections are encrypted; and what each account can see is separated in the software and tested. No system is perfectly secure, and if something went wrong that put you at risk we would tell you and the regulator as the law requires.
Changes
If we change how we use your information in a way that matters, we will tell you before it applies. The date at the top shows the latest version.