1. Scope and controller
This Privacy Policy applies to wayascension.com and the Way of Ascension service (collectively, the “Service”). The person or legal entity operating Way of Ascension (“Way of Ascension”) is the controller of personal information processed for the operation of the Service, except where a service provider acts as an independent controller under its own terms.
Privacy inquiries and requests concerning personal information may be addressed to privacy@wayascension.com.
2. Information collected
The Service presently collects and processes:
- Founder registration information: the email address submitted by a visitor, the registration source, registration and confirmation timestamps, confirmation status, and assigned founder number.
- Confirmation information: a cryptographic hash of a randomly generated confirmation token and its expiry. The raw token is placed in the confirmation link and is not stored in the database.
- Technical and security information: request metadata reasonably necessary to deliver and secure the Service, including information processed by Cloudflare as described below.
- Correspondence: information voluntarily provided in communications concerning the Service.
The Service does not presently use advertising trackers, sell personal information, or request payment information.
3. Purposes and legal bases
Personal information is processed only as reasonably necessary:
- to record and confirm a requested founder registration, assign a founder number, and provide material information about the Service;
- to prevent automated abuse, fraud, disruption, and other malicious activity;
- to operate, maintain, diagnose, and improve the reliability and security of the Service; and
- to comply with applicable law and enforce legal rights.
Where the United Kingdom or European Economic Area data protection laws apply, processing is based, as appropriate, on steps taken at the visitor’s request, consent to receive communications, legitimate interests in operating and securing the Service, and compliance with legal obligations. Consent may be withdrawn at any time without affecting prior lawful processing.
4. Service providers and disclosures
Personal information is disclosed only where necessary to operate the Service, comply with law, protect legal rights, or complete a corporate reorganisation. Current principal service providers are:
- Cloudflare, for hosting, content delivery, security, DNS, and Turnstile bot detection;
- Neon, for managed PostgreSQL database services; and
- Resend, for delivery and operational records of confirmation email.
These providers may process information in countries other than the visitor’s country of residence. Where required, such transfers are governed by applicable contractual or statutory safeguards and the provider’s own data-protection commitments.
5. Cloudflare Turnstile addendum
Founder registration uses Cloudflare Turnstile to distinguish legitimate visitors from automated traffic. According to Cloudflare, Turnstile evaluates limited security signals, including an IP address, TLS fingerprint, user-agent header, sitekey, and associated origin. These signals are used to protect the Service and to maintain and improve Turnstile’s bot-detection capabilities.
Cloudflare states that it acts as a processor when handling these signals on behalf of Way of Ascension to secure the Service, and as a controller when processing signals to improve Turnstile. Cloudflare may use strictly necessary cookies or equivalent mechanisms for this security purpose.
Further information is provided in Cloudflare’s Turnstile Privacy Addendum and Privacy Policy. Questions about Way of Ascension’s use of Turnstile should be directed to Way of Ascension at the address in Section 1. Questions concerning Cloudflare’s independent processing may be directed to Cloudflare using the contact details in its policies.
6. Retention and security
Founder registration records are retained while reasonably necessary to administer the founder programme, launch and operate the Service, maintain the integrity of assigned founder numbers, and satisfy legal obligations. Unconfirmed links expire after seven days; requesting another link replaces the pending token. Provider records are retained under the applicable provider’s own retention schedule.
Reasonable technical and organisational safeguards are used to protect information. Confirmation tokens are generated using a cryptographically secure random source, stored only in hashed form, and redeemed through a transactional process. No method of electronic storage or transmission can, however, be guaranteed to be completely secure.
7. Rights and choices
Subject to applicable law, a person may request access to, correction of, erasure of, restriction of, or portability of personal information, and may object to particular processing or withdraw consent. Identity may be verified before a request is fulfilled. Certain information may be retained where required by law or necessary to establish, exercise, or defend legal claims.
A person may also lodge a complaint with the competent data protection authority. Communications may be discontinued by using an unsubscribe mechanism where one is provided or by contacting the address in Section 1.
8. Children
The Service is not directed to children under sixteen years of age, and Way of Ascension does not knowingly collect personal information from such children. A parent or guardian who believes that a child has submitted information should contact Way of Ascension so that appropriate action may be taken.
9. Amendments
This Privacy Policy may be amended to reflect changes in the Service, applicable law, or service providers. The effective date will be revised when a material amendment is published. Where required by law, additional notice or consent will be obtained.