Privacy Policy
Last updated September 28, 2026
DevDash Labs, Inc., a Delaware corporation, operates Alkemy ("Alkemy", "we", "us", or "our"). This Privacy Policy covers alkemyos.com and the Alkemy application (together, the "Service"). It explains our collection and use of personal information, the recipients of that information, and your choices.
You can contact us at privacy@alkemyos.com, including if you do not have an Alkemy account.
Scope and responsibility
Alkemy serves businesses and professionals, primarily in the United States. Some features have regional eligibility requirements. Your applicable privacy rights depend on the processing involved and the law that applies. Nothing in this policy limits rights that applicable law gives you.
A controller decides why and how personal information is processed. A processor handles personal information for a controller and follows its instructions.
- We act as a controller for account administration, billing, security, support, and our product analytics.
- When we process workspace content under a business customer's instructions, we act as that customer's processor or service provider, as applicable.
- If we determine separate purposes for processing personal information, we remain responsible for that processing. Describing information as customer content does not remove that responsibility.
"Customer Content" includes uploaded files, contact records, research instructions, chat messages, and related outputs. Customer agreements govern our processing on the customer's behalf. Those agreements do not waive individual rights or override applicable law.
Information we collect and its sources
The information involved depends on the features you use.
| Category | Examples and sources |
|---|---|
| Account and profile information | Name, work email, authentication information, organization, team, role, and optional profile details that you or your organization provide. AWS Cognito manages passwords. We do not store those passwords in our application database. |
| Sign-in provider information | If you use Google sign-in, we receive the account information needed to authenticate you and create or maintain your Alkemy account. The authorization flow identifies the requested access. |
| Customer Content | Company lists, contact details, documents, prompts, chat messages, notes, and other information that you or authorized workspace users upload or create. |
| Professional and relationship information | Names, employers, positions, work history, education, professional profiles, connection dates, and relationship information. Sources include customer imports, public sources, and search or data-enrichment providers. |
| Generated information | Research summaries, qualification scores, account matches, and suggested relationship or introduction paths generated from information in the Service. |
| Billing information | Stripe handles payment details. We receive customer identifiers, billing email, and transaction information. We do not store full payment card numbers. |
| Usage and technical information | Page views, feature interactions, errors, device and browser information, IP-derived approximate location, and model usage used to calculate credits. PostHog usage events can be linked to your account email. |
| Support information | Messages, diagnostic context, and screenshots you choose to submit. Where session recording is enabled, support context can include a link to a session replay. |
Account credentials can qualify as sensitive personal information under applicable law. We use authentication information to provide and secure account access. The Service is not designed to require health information, government identification numbers, or other sensitive information in research content. Please avoid submitting such information unless it is necessary and you have authority to do so.
How we use information
We use personal information to:
- provide accounts, workspaces, authentication, and access controls.
- import and organize contacts, match people to accounts, and identify possible relationship paths.
- perform requested research, enrichment, scoring, drafting, and AI assistance.
- process payments, manage subscriptions, and calculate usage charges.
- answer support requests and communicate about the Service.
- assess product use, diagnose errors, and improve the Service.
- prevent fraud, abuse, unauthorized access, and security incidents.
- meet legal obligations and enforce our agreements.
We do not sell your personal information. We do not use Customer Content to train our own AI models or our providers' AI models.
Network imports and workspace sharing
You can import a LinkedIn connections export that you obtain from LinkedIn. For a ZIP import, your browser extracts the connections file before it uploads that file to Alkemy. Other files in the ZIP are not included in that import upload.
The imported file can contain names, profile links, employers, positions, connection dates, and email addresses where available. We use the records to organize your network, match people to workspace accounts, and identify possible introduction paths.
Depending on the feature, we may send names, company information, or profile links to search and enrichment providers to obtain additional professional information. Imported records and generated relationship information can also form part of the AI inputs described below.
Network controls support personal access, access for selected teams, and organization-wide access. Controls can apply to the network or individual connections. Team access follows team membership, so changes in membership can change who has access.
Sharing can reveal a contact's details, your relationship with that contact, and related introduction paths. Organization-wide sharing can make this information available to other authorized members of your organization. Workspace administrators manage memberships and roles.
Connection visibility and workspace content permissions serve different purposes. A person's details may also appear in an account research record or information supplied by another member. Changing your connection visibility does not necessarily remove those separate records.
You can remove imported connections through the network controls. That action removes your connection association and updates affected paths. A record supplied or maintained independently may remain. For a broader request to delete personal information, contact privacy@alkemyos.com.
Removing a member from a workspace disables that membership. It does not, by itself, erase all information associated with that member.
Proposed LinkedIn Member Data Portability integration
We are applying for LinkedIn Member Data Portability API access. This integration is not currently available. The following describes the proposed feature, subject to LinkedIn approval and implementation of its privacy controls.
The proposed feature will serve eligible LinkedIn members in the EU, EEA, or Switzerland. It will import first-degree connections for relationship management and member-directed sharing. Before authorization, we will state the requested data, purposes, recipients, collection frequency, and withdrawal and deletion methods. LinkedIn will handle authorization without Alkemy collecting your LinkedIn password.
We will retain Member Portability Data only while we have the necessary rights and a continuing legal basis. We will immediately delete it upon the member's deletion request or closure of their Alkemy account, except where law or a governmental obligation requires retention. This specific rule will override the general retention periods and exceptions below.
You will be able to email privacy@alkemyos.com to withdraw authorization or request deletion of previously collected data and associated authorization tokens. Our team will handle these requests. Withdrawing authorization will stop further collection. LinkedIn approval will not constitute endorsement of Alkemy or verification of imported information.
AI processing
Our AI features send relevant prompts, files, company information, and contact information to model providers to generate outputs. We use providers such as Anthropic, OpenAI, and Google, either directly or through services such as AWS Bedrock and Google Cloud.
AI request monitoring and diagnostic tools, including LangSmith, can process information associated with those requests. We use these tools to investigate errors and assess service behavior. Generating an output and training a model are different activities. Our no-training commitment above applies to Customer Content.
Generated information can be inaccurate, incomplete, or outdated. You should review it before using it, including before contacting a person. The Service assists professional decisions. It does not make solely automated decisions that produce legal or similarly significant effects about individuals.
Recipients of personal information
We disclose information as needed for the purposes in this policy to:
| Recipient | Purpose |
|---|---|
| Authorized workspace users | Collaboration and access under the applicable workspace and network settings. |
| Cloud and infrastructure providers, including AWS and Google Cloud | Hosting, storage, authentication, and associated services. |
| AI model providers, including Anthropic, OpenAI, and Google | Processing relevant inputs and producing requested outputs. |
| Stripe | Payment processing and billing. |
| PostHog and LangSmith | Product analytics, diagnostics, and AI request monitoring. |
| Search and data-enrichment providers | Researching companies and people, matching records, and supplementing professional information. |
| Personnel and professional advisers | Operating the Service, providing support, and meeting legal or professional obligations. |
Providers' roles depend on their services and our agreements. A provider that processes information on our behalf may be a processor or subprocessor. Some recipients have their own legal responsibilities for particular processing.
You can request information about relevant providers and data processing terms at privacy@alkemyos.com.
We may disclose information when legally required, to protect rights and safety, or as part of a corporate transaction. We will require a successor that receives personal information in a transaction to honor this policy, subject to applicable law.
We do not sell personal information, including imported network information, or share it for cross-context behavioral advertising as defined under California law. Sharing that you direct within your workspace is described separately above.
Cookies, analytics, and privacy signals
We use essential cookies for sessions and security, a sidebar preference cookie, and analytics cookies or local storage associated with PostHog. Analytics can record page views, feature use, and errors, and link those events to an account.
We do not use advertising pixels or sell advertising. You can use browser controls to restrict cookies, although this can affect features that require them. You can also contact privacy@alkemyos.com to request an analytics opt-out, and we will honor your request.
The Service does not currently apply a general tracking opt-out in response to the older Do Not Track browser signal. Global Privacy Control is a separate signal used to communicate privacy choices, including choices about sale or advertising-related sharing. We do not undertake those sale or advertising-related sharing activities. Nothing in this policy excludes any obligation to honor a privacy signal under applicable law.
Retention and deletion
We retain personal information for the stated purposes, subject to applicable law, customer instructions, and any shorter commitment that applies.
| Information | General retention approach |
|---|---|
| Account and profile information | While the account is active, subject to deletion requests and any applicable legal retention requirements. |
| Customer Content | While the account is active. Following account closure or the end of a subscription, we delete or de-identify it within 90 days. Earlier deletion requests and legally required retention are addressed separately. |
| Imported connection records | As Customer Content, subject to network removal controls, broader deletion requests, and any specific integration rule. |
| Billing records | Up to seven years for tax and accounting obligations. |
| Analytics and logs | Generally up to 24 months. |
| Backups | Removed through the applicable backup rotation. Contact us for information about the schedule relevant to your request. |
The import process is designed to remove temporary connections files after successful processing. This does not remove the resulting contact and relationship records.
We assess deletion requests across the relevant records and processing purposes. Independently supplied records may require a separate assessment. Where the law requires retention, we explain the applicable reason to the extent permitted.
The proposed LinkedIn portability rule above takes priority for Member Portability Data. The general 90-day period, de-identification option, and backup schedule do not extend that specific deletion obligation.
International processing
We operate in the United States. Personal information may be processed in the United States and in other countries where relevant providers operate. Those countries may have different privacy laws from your country.
Where applicable law requires safeguards for a transfer, the transfer must have a valid mechanism and appropriate protections. For questions about processing locations, transfer safeguards, or related privacy requests, contact privacy@alkemyos.com. Our team will respond with information relevant to your request.
Legal bases where required
Where applicable law requires a legal basis, our processing depends on the purpose and our role:
- providing services to an individual under a contract can require processing necessary to perform that contract.
- operating, securing, supporting, and improving the Service can involve legitimate interests, subject to the person's rights and interests.
- consent applies where required, including relevant optional integrations and tracking technologies.
- legal obligations can require processing for accounting, compliance, or lawful requests.
A business customer's contract does not automatically provide a legal basis for processing every contact's information. Where we act as a processor, the customer determines its purposes and legal basis. Where we act as a controller, we remain responsible for our own assessment.
Privacy requests and rights
You can request access, correction, deletion, or help with privacy choices at privacy@alkemyos.com. Our team reviews requests by email and coordinates the response, including any required action with relevant providers or your organization. You do not need an Alkemy account to contact us. Applicable law may also provide rights to a portable copy, restriction, objection, withdrawal of consent, and an appeal or regulatory complaint.
We may request information needed to locate your records and verify your identity or an authorized agent's authority. We use that information to address the request and protect against unauthorized disclosure. We will not require identity verification where applicable law prohibits it.
We respond within applicable legal deadlines. GDPR requests generally require a response within one month, with extensions permitted in specified circumstances. California access, correction, and deletion requests generally have a 45-day response period. We will explain an extension where required. These response periods do not delay a shorter deletion obligation, including the proposed LinkedIn portability obligation.
If we deny a request, we will explain our decision and applicable review or complaint options. You can ask us to review a decision by replying to our response. We will not discriminate against you for exercising privacy rights.
EU, EEA, UK, and Swiss rights. Where the relevant law applies, rights can include access, correction, deletion, restriction, objection, and portability. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. You may complain to your relevant data protection authority, including the UK ICO or the Swiss FDPIC where applicable.
US state rights. Depending on applicable law, you may have rights to know, access, correct, delete, or obtain a copy of your information. Other rights can address sale, targeted advertising, certain profiling, sensitive information, authorized agents, and appeals. Our no-sale and no-advertising-sharing commitments appear above.
For California disclosures, the categories described in this policy include identifiers, customer records, commercial information, network activity, approximate location, professional information, and inferences. Uploaded documents and support materials may include additional categories, such as education information or images. Authentication credentials can constitute sensitive information. Sources, purposes, recipients, and retention are described in the corresponding sections above.
Information about people who do not use Alkemy
Your professional information may appear because a customer imports a network, requests research, or creates a contact record. You can contact privacy@alkemyos.com about that information, including to correct an inaccurate profile or request deletion.
Where we process information solely on a customer's behalf, we assist or refer the request to that customer as appropriate. Where we control the processing, we address our own responsibilities. A customer's import does not establish your consent to every use of your information.
Security
We use measures including transport encryption, cloud storage encryption, access controls, and logical separation of organizations' data. No storage or transmission method is completely secure. We provide notices of personal information breaches where applicable law requires them.
Children
The Service is intended for adult professionals and is not directed to anyone under 18. We do not knowingly collect personal information from children. Contact privacy@alkemyos.com if you believe a child supplied personal information through the Service so we can investigate and delete it as appropriate.
External services
External websites and services have their own privacy practices. This includes LinkedIn, sign-in providers, and sites reached through links from Alkemy. Review their notices when using those services.
Changes to this policy
We update this policy when our practices or relevant requirements change. We update the date above and notify account holders of material changes. Where required, we obtain consent before a material change in processing.
Contact
DevDash Labs, Inc. operates Alkemy. Send privacy questions, requests, or complaints to privacy@alkemyos.com. Postal contact details are available on request.