Privacy Policy

• Account data — name, business, email, password (hashed), workspace settings.
• Customer Content — contacts, conversations, recordings, documents, and other data you submit; may include personal information about your clients/leads.
• Consumer prospecting data — names, postal addresses, phone numbers, email addresses and property characteristics about people who are not our users. We obtain it from public records (county assessor and recorder filings) and from commercial data suppliers; we do not collect it from the person it describes and we have no relationship with them.
• Usage data — log, device, and product-interaction data used to operate, secure, and improve the Service.
• Payment data — handled by Stripe; we store billing status and identifiers, not full card numbers.
• Cookies / analytics — see §8.

To provide, secure, and improve the Service; process payments; provide support; send service and (with consent where required) marketing communications; enforce our Terms; and comply with law. We use AI/model providers to generate Service output (see §5).

Prospecting data. We make consumer prospecting data available to the real estate professional who requests it, so that they can contact that consumer about their property. Several state privacy laws treat that as a “sale” or “sharing” of personal information, and you can tell us to stop — see §6. We do not make this data publicly available, and we do not provide it for use in any decision the Fair Credit Reporting Act regulates: it is not a consumer report and Alchemical AI LLC is not a consumer reporting agency.

Where the GDPR/UK GDPR applies, we process on the bases of contract performance, legitimate interests, consent (e.g. certain cookies/marketing), and legal obligation.

We share information with service providers that process data on our behalf:

• Property-data and contact-data suppliers — licensed sources of public-record property data and consumer contact information. We receive data from them; they do not receive Customer Content.
• Hetzner — server hosting for the Service
• Supabase — database & auth hosting
• Stripe — payments & tax
• Retell and Twilio — voice calls and text messages
• Google — email/calendar integration (your connected account)
• Postmark — transactional/outbound email
• AI model providers (DeepSeek, OpenAI, Anthropic, and others via our model router) — generating Service output. Outbound requests are screened to strip credentials, Social Security numbers and payment-card numbers; other content you ask the assistant about, such as email or document text, is sent to the provider
• PostHog — product analytics

We maintain this subprocessor list and update it as integrations change. We may also disclose information to comply with law or protect rights, and in a merger/acquisition subject to this Policy.

We retain information for as long as your account is active and as needed to provide the Service, then per our retention schedule and legal obligations. Account data is retained for up to 90 days after account deletion; Customer Content is retained for up to 30 days after deletion request unless legally required to retain longer. You can export or request deletion of Customer Content (see §7).

If you are a customer. Depending on your location you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object or withdraw consent. The Service supports data export and deletion (DSAR / right-to-be-forgotten). To exercise rights, use in-product controls or contact privacy@alchemicalai.com.

If you are not a customer and we hold prospecting data about you. You can ask us what we hold, ask us to delete it, and tell us not to sell or share it. Write to privacy@alchemicalai.com with the phone number, email address or property address the request concerns. We will ask you to verify that the information is yours before we act on it, so that someone else cannot make the request for you. An opt-out applies across the Service, not only to the business that contacted you.

We use technical and organizational measures including encryption in transit, tenant-isolation (row-level security), access controls, contact-PII encryption, and audit logging. No method is 100% secure; we work to protect your data and will notify you of breaches as required by law.

We use necessary cookies for authentication and session management. With your consent, we also use analytics cookies (PostHog) to understand product usage. When you first visit, a consent banner lets you accept or decline non-essential analytics. You can change your preference at any time by clearing your browser’s local storage for this site. If you decline, no analytics cookies are set and no usage data is sent to PostHog.

Data may be processed in the United States and other countries; where required we use appropriate transfer mechanisms (e.g. Standard Contractual Clauses). The Service is not directed to children under 16 and we do not knowingly collect their data.

We may update this Policy; material changes will be notified through the Service or by email. Questions or requests: privacy@alchemicalai.com.