Privacy Policy

1. Introduction & Who We Are

Ascentra (“we”, “us”, or “our”) is a boutique operations practice run by me, Teresa Patricia Kerins. This Privacy Policy explains what information I collect through ascentra.polsia.app and through our working correspondence, how I use it, and the rights you have over it. I write this in plain English so a reader can actually understand what is happening with their data.

Ascentra delivers AI-augmented business operations and administrative support to a small number of growing small businesses at a time. Because we work closely with each client, we hold sensitive operational data — financials, vendor relationships, customer records — and we treat that responsibility accordingly. The practices described here apply to every surface through which Ascentra touches your information: the website, the contact and intake forms, the post-payment engagement cycle described in Section 4, and any related correspondence.

2. Information We Collect

I collect information you provide to us directly, information generated automatically by your use of the site, and information that is generated as you move through the post-payment engagement. The subsections below describe each surface in plain terms.

Contact-form enquiries

• Your name
• Your email address
• The message you submit

Submissions are routed to a ContactMessage record behind our forms surface and are used solely to reply to you. We never add you to a marketing list without an opt-in.

Post-payment intake wizard

After a payment clears, we send you a token-gated welcome link. The link opens a structured intake form at /onboarding/intake/[token] that asks for:

• Name, email, company name, and phone number
• Current tools, pain points, goals, and any additional context you choose to share in a free-text field
• A structured intake submission covering scope, deliverables, and timeline confirmations

That intake keeps a record separate from your contact-form enquiry. It is intentionally a closed lane — only the holder of the link can open it, and the link expires after fourteen days. Free-text answers may be summarised using AI-assisted tooling to prepare our kickoff, but intake text never leaves the Polsia-hosted environment to a third-party AI processor.

Engagement records

For paying clients, we maintain an internal client record that reflects the engagement in flight: company, primary contact, plan purchased, amount paid, deliverable status, and the engagement-level documents we keep on your behalf.

Engagement deliverables

Where an engagement produces a written deliverable — a one-time quote PDF, a workflow audit report, or an engagement summary — we render that document server-side through our pdf module and email it to you. Those documents live in your inbox and our internal record; we do not retain additional copies beyond what the engagement requires.

AI-assisted summarisation

Intake free-text answers may be summarised with AI-assisted tooling to draft my kickoff notes. No third-party AI processor receives your data outside of the Polsia platform.

Analytics data

The Polsia analytics beacon stores a visitor identifier (polsia_vid) in your browser's localStorage to help us understand aggregate page views and visitor sessions. This identifier is first-party and is never shared with advertising networks. See our Cookie Policy for full details.

3. How We Use Your Information

I use the information collected through the site and through the post-payment engagement cycle to:

• Reply to your enquiry and contact-form submissions
• Schedule consultations and operations assessments through Calendly
• Process payment and confirm your engagement through Stripe
• Trigger the post-payment intake cycle described in Section 4 — the welcome email, the intake wizard token, and the kickoff preparation that follows
• Deliver and follow up on the contracted services
• Send service-related communications tied to a specific engagement — we do not use this channel for general marketing
• Analyse aggregate site usage to improve the experience

We will not use your personal information for marketing communications without your explicit consent, and we do not profile visitors for advertising purposes.

4. The Post-Payment Engagement Cycle

Once you complete a payment for a retainer or a one-time engagement, an automated cycle kicks off. It is worth describing it openly, because the data does move between a small set of well-named systems:

• Stripe checkout.You complete payment on a Stripe-hosted page. Ascentra never sees your full card number, expiry, or CVV — the stripe-billing module is intentionally card-data-free.
• Signed webhook. Stripe sends a signed event to /api/webhooks/stripeon the Ascentra deployment. The webhook is the single source of truth for new engagements — if the webhook does not acknowledge, the cycle does not start.
• Onboarding record. An OnboardingClient row is created in our database and tied to your purchase.
• Six-message email cadence. A scheduled sequence of six service-related emails goes out (welcome, onboarding steps, intake link, kickoff prep, retention follow-up) via the email module.
• Token-gated intake wizard. The fourth email delivers a single-use IntakeToken that opens the structured intake form at /onboarding/intake/[token]. The token expires after fourteen days.
• Kickoff preparation. Your intake answers populate an intakeData JSON field on the onboarding record and feed into the engagement record described in Section 2.

The intake wizard is read by me and the small operations team that supports my work, and may be summarised using the AI-assisted tooling described above. The welcome link is for you; please don't forward it.

5. Data Retention

We keep personal information only as long as needed to fulfil the purposes set out in this policy — then we delete it or anonymise it. As a working guide:

• Contact-form submissions. Kept while the enquiry is active and for up to twelve months from the last interaction, then deleted.
• Consultation / Operations Assessment leads. Kept for up to twenty-four months from the last interaction so we can pick the conversation back up if you return.
• Engagement records and deliverables. Retention follows the duration of the active engagement plus the period required for tax, legal, or warranty obligations. Engagement-specific records are deleted or anonymised when that period ends.
• Intake tokens. The single-use IntakeToken is invalidated once the intake form is submitted, and any unused token is purged after its fourteen-day window.
• Aggregate analytics identifiers. Retained in accordance with our Cookie Policy.

Where we have a legal, regulatory, or tax retention obligation, the relevant data is kept for the period the law requires, even if it is longer than the working windows above.

6. Cookies & Tracking

This site uses first-party analytics cookies and a localStorage visitor identifier (polsia_vid) to understand how visitors use the site. We do not run advertising or retargeting cookies, and we do not fingerprint visitors.

For a full breakdown of the cookies and storage identifiers used on this site, how to manage them, and your rights under GDPR/CCPA, please read our Cookie Policy.

7. Third-Party Services

To run the website and deliver the engagement cycle I rely on a small set of trusted third-party providers. Each one receives only the data needed for its role and is bound by its own privacy and security practices.

Stripe, Inc. — payment processing

Payments on this site are processed by Stripe, Inc. Ascentra never receives, stores, or transmits your full card number, expiry, or CVV — the stripe-billing module is intentionally card-data-free. All payment data is transmitted directly to Stripe under their own privacy policy and security standards.

Calendly — scheduling

Calendly powers scheduling for kickoff calls and Operations Assessment bookings. When you choose a time, Calendly receives your name, email, and the slot you have selected. Their handling of that data is governed by Calendly's Privacy Policy.

Meta Pixel & Conversions API — aggregate analytics and ad attribution

We use the Meta Pixel and the Meta Conversions API to understand aggregate site performance and to attribute paid-ad results. First-party server logs are hashed before transmission, and we do not enrich event data with anything that would let Meta personally identify a visitor we have not already identified to Stripe or Calendly.

Polsia — hosting and first-party analytics

Ascentra is hosted on the Polsia platform. Polsia runs ascentra.polsia.app and processes operational data — server logs, the first-party polsia_vidanalytics beacon, and the data layer described in Section 2 — under Polsia's own privacy and security practices.

8. Data Security

Your data sits on secure servers provided by the Polsia platform. We apply reasonable technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. IntakeToken links are single-use and time-limited, and the database access behind the operations console is gated to the people who actively deliver the engagement.

Payment security is handled by Stripe, Inc. under their own security standards (see Third-Party Services). Ascentra never receives or stores raw payment card details.

No method of transmission over the internet or electronic storage is completely secure. We use commercially reasonable protections; we cannot guarantee absolute security against every possible threat.

9. We Do Not Sell Your Data

Ascentra does not sell, rent, or trade your personal information to third parties for commercial purposes, and we do not share your data with advertising networks or data brokers.

10. Your Rights (GDPR / CCPA)

Depending on where you live, you may have the following rights over your personal data:

• Access— request a copy of the personal data we hold about you.
• Correction— ask us to correct inaccurate or incomplete data.
• Deletion— ask us to delete your personal data, subject to any legal retention obligations.
• Data portability— request a machine-readable copy of the personal data you have provided to us, where technically feasible.
• Objection / restriction— object to, or ask us to restrict, certain processing of your personal data.

To exercise any of these rights, please email ascentra@polsia.app. We will respond within a reasonable timeframe and in accordance with applicable law.

11. Children's Privacy

Ascentra's services and website are not directed to minors. We do not knowingly collect personal information from children under thirteen years of age (as defined by the U.S. Children's Online Privacy Protection Act, COPPA) or under sixteen years of age (as defined by the EU General Data Protection Regulation, GDPR). If you believe we have inadvertently collected personal information from a child, please let us know at ascentra@polsia.app so we can promptly delete it.

12. Changes to This Policy

When the underlying practices change — new tools in the engagement cycle, a new third-party provider, a shift in the data we hold — this policy is updated and the “Effective date” at the top is moved forward. I encourage you to review this page periodically so you stay informed about how your information is handled.

13. Contact Information

For privacy-related enquiries, please reach out at:

• Privacy enquiries: ascentra@polsia.app
• General contact: ascentra@polsia.app