Privacy Policy

• Account data — name, business, email, password (hashed), workspace settings.
• Customer Content — contacts, conversations, recordings, documents, and other data you submit; may include personal information about your clients/leads.
• Consumer prospecting data — names, postal addresses, phone numbers, email addresses and property characteristics about people who are not our users. We obtain it from public records (county assessor and recorder filings) and from commercial data suppliers; we do not collect it from the person it describes and we have no relationship with them.
• Usage data — log, device, and product-interaction data used to operate, secure, and improve the Service.
• Payment data — handled by Stripe; we store billing status and identifiers, not full card numbers.
• Cookies / analytics — see §9.

To provide, secure, and improve the Service; process payments; provide support; send service and (with consent where required) marketing communications; enforce our Terms; and comply with law. We use AI/model providers to generate Service output (see §4, and §5 for data from Google).

Prospecting data. We make consumer prospecting data available to the real estate professional who requests it, so that they can contact that consumer about their property. Several state privacy laws treat that as a “sale” or “sharing” of personal information, and you can tell us to stop — see §7. We do not make this data publicly available, and we do not provide it for use in any decision the Fair Credit Reporting Act regulates: it is not a consumer report and Alchemical AI LLC is not a consumer reporting agency.

Where the GDPR/UK GDPR applies, we process on the bases of contract performance, legitimate interests, consent (e.g. certain cookies/marketing), and legal obligation.

We share information with service providers that process data on our behalf:

• Property-data and contact-data suppliers — licensed sources of public-record property data and consumer contact information. We receive data from them; they do not receive Customer Content.
• Hetzner — server hosting for the Service
• Supabase — database & auth hosting
• Stripe — payments & tax
• Retell and Twilio — voice calls and text messages
• Google — email/calendar integration (your connected account)
• Postmark — transactional/outbound email
• AI model providers (DeepSeek, OpenAI, Anthropic, and others via our model router) — generating Service output. Outbound requests are screened to strip credentials, Social Security numbers and payment-card numbers (audio you upload for transcription is sent as recorded); other content you ask the assistant about, such as email or document text, is sent to the provider
• PostHog — product analytics

We maintain this subprocessor list and update it as integrations change. We may also disclose information to comply with law or protect rights, and in a merger/acquisition subject to this Policy.

When the owner or an admin of a workspace connects a Google account, TurnkeyHQ asks Google for access to the Google services that workspace turns on: Gmail, Google Calendar, Google Drive, Google Docs and Sheets, and Google Tasks. The connection belongs to that workspace and is used only for it. This section describes what we do with information we receive from Google APIs (“Google user data”). Where it differs from the rest of this Policy, this section governs Google user data.

What we access and why.

• Gmail, to send. We send the email you write or approve, from your own address. This permission does not let us read your mail.
• Gmail inbox (if you turn on inbox access). Message headers (sender, recipients, subject and date), message previews and, when you open a message or ask the assistant about it, its text. We use them to show your inbox; to archive, star, mark read, trash and restore messages; and to save reply drafts in your Gmail for you to review. Several times each weekday the assistant also looks at the last 14 days of threads with your existing contacts, using the headers and the first 100 characters of the latest preview, not message bodies, to suggest follow-ups for you to approve.
• Email matching (if an owner or admin of your workspace turns it on). The same headers and a preview of up to 500 characters from recent threads, not message bodies, to link conversations to your contacts: it adds an activity entry and tasks for what was promised, and it proposes new contacts and, when a day and time were agreed, an event on your own calendar, which are added only after you approve each one.
• Google Calendar. Your events (title, time, location, attendees and description) and your busy times. We use them to show your calendar, check when you are free, and book, move or cancel appointments such as property showings, including showings booked by phone with the voice assistant.
• Google Drive. Only the files TurnkeyHQ created in your Drive or that you open with it; this permission does not give us the rest of your Drive. We use their names and, for a file you or the assistant open, its text, to list and preview those files, create folders, save TurnkeyHQ documents to your Drive, and share a file with someone when you approve it.
• Google Docs and Sheets (if you turn them on). The documents and spreadsheets you ask the assistant to read, and the ones it creates or edits at your request.
• Google Tasks (if you turn them on). Your task lists and tasks: a sync copies them into your TurnkeyHQ tasks and adds your TurnkeyHQ tasks to Google Tasks, and the assistant lists, adds and completes Google tasks when you ask.
• Your Google account’s email address, to show which account is connected.

How we use it. Only to provide or improve the features described above, which you see and use in TurnkeyHQ. We do not sell Google user data. We do not use or transfer it for advertising (including retargeting and interest-based advertising) or to decide creditworthiness or lending, and we do not transfer it to data brokers or information resellers. We do not use Google user data to develop, improve or train generalised AI or machine-learning models.

AI processing. When the assistant works with Google user data, in chat or in the follow-up suggestions and email matching described above, the content it needs is sent to the AI model provider that produces the result: DeepSeek by default; OpenAI or Anthropic when DeepSeek does not answer; or the model you pick in chat, from DeepSeek, OpenAI, Anthropic or MiniMax. Facts the assistant remembers from your conversations, and in some workspaces from email subjects, are sent to OpenAI to build the search index it recalls them from. If you choose OpenAI voice playback, the assistant’s replies are sent to OpenAI to be read aloud. We send Google user data to these providers to produce your result, not to train their models. The screening described in §4 removes credentials, Social Security numbers and payment-card numbers first; other content, such as email or document text, is sent as it is.

Storage. Google access and refresh tokens are stored encrypted in our database, and disconnecting Google deletes them. We keep other Google user data where a feature needs it: assistant conversations, including what the assistant read from Google for you (for example, up to 3,000 characters of an email’s text); contacts, activity entries and tasks created from your email; follow-up suggestions with the email subject and preview they came from; tasks copied from Google Tasks; and facts the assistant remembers. This data is stored in your workspace in our database (Supabase, in the United States), separated from other workspaces by row-level security, and processed on our servers (Hetzner, in Finland). An email you open is also kept in your browser for up to an hour, and signing out clears it.

Retention and deletion. Stored Google user data stays until you delete it, for example by clearing a conversation or deleting a contact, or until your workspace is deleted. Disconnecting Google stops new access but does not delete what is already stored. To have us delete the Google user data we hold, or your whole workspace, email privacy@alchemicalai.com. Our staff carry out the deletion; it is not automatic.

Sharing. We transfer Google user data only: to the service providers that run the Service for you, namely Supabase (database), Hetzner (servers), the AI model providers named above, and Sentry, which receives error reports that can contain parts of the data being processed when an error happens; when you send or approve a message or a Drive share, to the service that delivers it (your Gmail or Google Drive, Postmark, Twilio or Retell) and the people you chose; for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition or sale of assets, and then only after obtaining your explicit prior consent.

Human access. Our staff do not read your Google user data unless you ask us to for specific messages, files or other data (for example, in a support request), it is necessary for security purposes (such as investigating a bug or abuse), it is necessary to comply with applicable law, or the data has been aggregated and is used for internal operations. When one of our administrators opens an assistant conversation in our admin tools, they must record which of these reasons applies, and each opening is logged. The content the assistant fetched from Google stays hidden unless they reveal it, and revealing it is logged too.

Disconnecting. The workspace owner or an admin can disconnect Google under Settings → Google Workspace. Disconnecting asks Google to revoke TurnkeyHQ’s access and deletes the stored tokens. If the same Google account is also connected to another TurnkeyHQ workspace, its access there stays. You can check or remove TurnkeyHQ’s access at any time at myaccount.google.com/permissions.

We retain information for as long as your account is active and as needed to provide the Service, then per our retention schedule and legal obligations. To have us delete your workspace and its Customer Content, email privacy@alchemicalai.com; our staff carry out the deletion after confirming the request, and it is not on an automatic timer. When a workspace is deleted we keep three kinds of record. Billing and payment records, for accounting. Records of opt-outs (for example a STOP reply, an unsubscribe or a do-not-call request), which we keep honoring on that channel across all of TurnkeyHQ, so a number or address that opted out is not messaged that way again from any workspace. And, for four years after the last message or consent, a de-identified record of consent and of messages sent, so that we can answer legal claims: these hold a one-way hash of the number or address, never the number or address itself, no names and no message content, and they are then deleted. Copies of deleted data in our backups expire within 30 days. You can export or request deletion of Customer Content (see §7).

If you are a customer. Depending on your location you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object or withdraw consent. The Service supports data export and deletion (DSAR / right-to-be-forgotten). To exercise rights, use in-product controls or contact privacy@alchemicalai.com.

If you are not a customer and we hold prospecting data about you. You can ask us what we hold, ask us to delete it, and tell us not to sell or share it. Write to privacy@alchemicalai.com with the phone number, email address or property address the request concerns. We will ask you to verify that the information is yours before we act on it, so that someone else cannot make the request for you. An opt-out applies across the Service, not only to the business that contacted you.

We use technical and organizational measures including encryption in transit, tenant-isolation (row-level security), access controls, contact-PII encryption, and audit logging. No method is 100% secure; we work to protect your data and will notify you of breaches as required by law.

We use necessary cookies for authentication and session management. With your consent, we also use analytics cookies (PostHog) to understand product usage. When you first visit, a consent banner lets you accept or decline non-essential analytics. You can change your preference at any time by clearing your browser’s local storage for this site. If you decline, no analytics cookies are set and no usage data is sent to PostHog.

Data may be processed in the United States and other countries; where required we use appropriate transfer mechanisms (e.g. Standard Contractual Clauses). The Service is not directed to children under 16 and we do not knowingly collect their data.

We may update this Policy; material changes will be notified through the Service or by email. Questions or requests: privacy@alchemicalai.com.