Privacy Policy

Last updated June 25, 2026

alkemy is operated by DevDash Labs, Inc. ("alkemy", "we", "us"). This policy explains what personal information we collect when you visit alkemyos.com or use the alkemy application (together, the "Service"), how we use and share it, and the choices you have. We wrote it to be readable. If anything is unclear, email privacy@alkemyos.com.

This policy covers both our public website and the signed-in alkemy application. Where this policy and a separate written agreement we have with your organization (for example, an order or pilot agreement) differ, that agreement controls for the data it covers.

Who this Service is for

alkemy is a United States company, and the Service is built for US-based businesses and professionals. We do not target or actively offer the Service to individuals in the European Union, the United Kingdom, or the EEA, and we have not appointed an EU or UK representative. If you access the Service from the EU or UK, you do so on your own initiative, and the Service may not meet local requirements such as the GDPR. The commitments in this policy are framed around United States law.

The two roles we play

• For information about our website visitors and account holders — your account, profile, billing, and how you use the Service — we decide why and how it is processed. In privacy terms, we are the "controller" of that data.
• For the information you load into the application to do your work — your company lists, prospect and contact records, objectives, uploaded files, and chat messages (your "Customer Content") — we act as a "processor": we handle it on your behalf and only to provide the Service to you. Your organization decides what goes in and why.

Information we collect

Account and profile data. When you sign up we collect your name, work email, and password (your password is managed by our authentication provider, AWS Cognito, and is not stored in our own database), and optionally your title, phone number, a short bio, and your organization, team, and role.

Customer Content. To use the application you upload and create content: company and prospect lists (including CSV and spreadsheet imports), contact details such as names, emails, phone numbers, and LinkedIn profiles, research objectives and prompts, uploaded documents, chat messages with our AI assistant, and the outputs the Service generates for you.

Information about people you research. A core part of the Service gathers professional information about individuals at the companies you research — for example executives and employees — such as name, role, employer, work history, education, board memberships, and public profile or LinkedIn information. We gather this from public sources and from third-party data-enrichment providers, on your instruction, to help you map relationships and prioritize outreach. See "Information about researched individuals" below for how those people can exercise their rights.

Billing data. When you purchase credits or a subscription, our payment processor, Stripe, collects your billing details and payment information. We receive a customer identifier, billing email, and transaction metadata; full card numbers are handled by Stripe and not stored by us.

Usage and analytics data. We use PostHog to understand how the Service is used. This includes events like sign-ups, page views, clicks, feature use, errors, and billing events, linked to your account using your email address as an identifier. We also log AI model usage to meter credits.

Technical and log data. Like most online services, we receive technical information such as device and browser type, and approximate location derived from your IP address, along with cookies and similar technologies described below.

Support communications. When you contact us or use the in-app support form, we receive your message, related diagnostic context, and any screenshot you choose to send.

How we use information

We use the information above to:

• provide, operate, and secure the Service, including authentication and keeping each organization's data separate;
• run the AI research, scoring, drafting, and chat features you request;
• process payments, manage credits and subscriptions, and prevent abuse of free credits;
• respond to support requests and communicate with you about the Service;
• understand and improve how the Service is used, using analytics;
• detect, prevent, and investigate fraud, abuse, and security incidents; and
• comply with our legal obligations and enforce our agreements.

We do not sell your personal information, and we do not use your Customer Content to train our own AI models or our providers' AI models.

AI processing

To research companies, score and qualify them, draft outreach, and answer your questions, the Service sends relevant inputs — your prompts, the company and contact data in your project, and the contents of files you upload — to AI model providers, which return generated outputs.

A few things you should know:

• AI outputs are produced by automated systems and can be incomplete, out of date, or wrong. They are meant to assist a professional, not replace one — keep a human in the loop and verify anything important before you rely on it.
• We do not use your Customer Content to train AI models, and we engage our AI providers on terms intended to prevent them from training their models on your inputs.
• The Service supports your decisions; it does not make automated decisions that produce legal or similarly significant effects about individuals.

How we share information

We share personal information with service providers that help us run the Service ("sub-processors"), and only as needed to provide it. The main categories, and key providers, are:

• Cloud infrastructure and hosting: Amazon Web Services (AWS) and Google Cloud, which host our application, databases, file storage, and some AI models (for example, AWS Bedrock and Google Cloud AI).
• AI model providers: providers such as Anthropic, OpenAI, and Google, accessed directly or through AWS Bedrock and Google Cloud, which process inputs to generate outputs as described above.
• Payments: Stripe, for checkout, billing, and payment processing.
• Analytics and monitoring: PostHog (product analytics) and LangSmith (AI request monitoring and debugging).
• Search and data-enrichment providers: third-party services we query to research companies and people and to enrich contact and profile information. The current list of these providers is available on request at privacy@alkemyos.com.

We may also disclose information to comply with law, respond to lawful requests, protect our rights and the safety of others, and in connection with a merger, acquisition, financing, or sale of assets (in which case we will require the recipient to honor this policy).

We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law.

A Data Processing Agreement (DPA) is available to business customers on request.

Cookies and tracking

We use cookies and similar technologies for a few specific purposes:

• Essential cookies set by our login system (for example, session and security tokens) that are required to sign in and keep you signed in.
• A preference cookie that remembers whether your sidebar is open or closed.
• Analytics cookies and local storage set by PostHog to recognize your browser and link product-usage events to your account.

We do not use advertising pixels and we do not sell advertising. To limit analytics, you can use your browser's cookie controls, or email privacy@alkemyos.com to opt out of analytics tracking and we will honor your request. We do not currently guarantee a response to every browser "Do Not Track" or Global Privacy Control signal; California-specific choices are described below.

Data retention

We keep personal information for as long as we need it for the purposes above:

• Account and profile data: for as long as your account is active.
• Customer Content: for as long as your account is active. After you close your account or your subscription ends, we delete or de-identify it within 90 days, unless you ask us to delete it sooner or the law requires us to keep it longer.
• Billing records: up to seven years, to meet tax and accounting obligations.
• Analytics and log data: generally up to 24 months.
• Backups: cycled out on a rolling schedule.

You can ask us to delete your data at any time, subject to the limits above.

Security

We protect personal information with measures including encryption in transit (HTTPS/TLS), encryption at rest with our cloud providers, access controls and least-privilege practices, and logical separation of each organization's data. No method of storage or transmission is perfectly secure. If we learn of a security breach that affects your personal information, we will notify you and the relevant authorities as required by law.

Your US privacy choices and rights

Wherever you are in the United States, you can ask us to access, correct, or delete the personal information in your account — email privacy@alkemyos.com or use your account settings. We will not discriminate against you for exercising these rights.

California residents (CCPA/CPRA). In the past 12 months we have collected these categories of personal information: identifiers (such as name and email); commercial information (such as purchases and credits); internet or network activity (such as usage and analytics); approximate geolocation (from IP address); professional or employment information (such as title and employer); and inferences (such as qualification scores). We collect this from you, automatically as you use the Service, from your organization, and from third-party data providers and public sources. We use and disclose it for the business purposes described above. We do not sell or share your personal information.

You have the right to know and access the personal information we hold, to request its deletion, to request correction, to opt out of any "sale" or "sharing" (we do neither), to limit the use of sensitive personal information (we use account login information only to provide the Service), and to be free from discrimination. You may appeal a decision by replying to our response, and you may use an authorized agent to make a request.

Other US states. If you live in a state with a comprehensive privacy law (for example, Virginia, Colorado, Connecticut, or Texas), you have similar rights to access, correct, delete, and obtain a copy of your personal information, and to appeal. Contact us at privacy@alkemyos.com.

How to exercise your rights. Email privacy@alkemyos.com. We will verify your request against the information in your account and respond within the time the applicable law requires — generally within 45 days for California requests, with an extension where permitted. If you are outside the United States, including in the EU or UK, you may still contact us and we will consider your request, but as noted above the Service is not designed for or directed to you.

Information about researched individuals

If your professional information appears in the Service because one of our customers is researching your company, the customer that loaded or requested that information is generally responsible for it. You can email privacy@alkemyos.com and we will route your request to the relevant customer or, where we are able, help address it directly. Customers are responsible for having a lawful basis to process the information they ask us to gather.

Children

The Service is intended for working professionals and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a minor has given us personal information, email privacy@alkemyos.com and we will delete it.

Third-party links and services

Our website and the Service may link to third-party sites and services — for example calendar booking, LinkedIn, and X. Those are governed by their own privacy policies, not this one.

Changes to this policy

We may update this policy as the Service evolves or the law requires. We will change the "Last updated" date above and, for material changes, notify account holders.

Contact

Privacy questions, requests, or complaints: privacy@alkemyos.com. Postal address available on request. We are DevDash Labs, Inc., a Delaware corporation.