This Privacy Policy explains how Alchemy Insights, Inc. ("Alchemy", "we", "us", or "our") collects, uses, discloses, and protects personal data in connection with Alchemy Inference: the website at inference.alchemy.com, the dashboard, the waitlist, account administration, billing, support, and the hosted AI inference services (the "Services"). Other Alchemy products are covered by their own privacy policies.
It is written for business customers, authorized users, prospects, and other business contacts, and should be read alongside the Alchemy Inference Terms of Service. Privacy questions and requests may be sent to [email protected].
1. Overview
Alchemy Inference is a business-to-business service. It is not intended for consumers, children, or personal household use.
Inference endpoints are operated under Zero Data Retention ("ZDR") unless a separate signed agreement expressly states otherwise. Alchemy does not intentionally store prompt text, completion text, or persistent result caches from inference requests after the request completes, and does not use prompt or completion text to train, fine-tune, evaluate, benchmark, or improve models or services without the customer's opt-in or a signed agreement.
2. Scope and roles
Alchemy is the controller of personal data processed for account, website, waitlist, billing, support, security, legal, and business administration purposes.
When Alchemy processes personal data contained in a customer's Inputs or Outputs, it acts as processor or subprocessor on that customer's behalf under the Data Processing Addendum in the Terms of Service. The customer is responsible for providing any required notices to, and obtaining any required rights, consents, and legal bases from, its own end users.
This Policy does not apply to customer websites, applications, or services built on Alchemy Inference; those are covered by the customer's own privacy notices.
3. Personal data we collect
- Account and business contact data: name, work email, company name, role, sign-in method and authentication information (including details from Google if you sign in with Google), organization membership, and account settings.
- Waitlist data: the name, email, and company you submit, and your answers about your current inference setup, models, spend, deployment needs, and priorities.
- Billing and tax data: billing contact and address, tax identifiers, invoice history, payment status, credit balance, and transaction metadata. Payment card details are collected and stored by our payment processor, not by us.
- Usage Metadata: timestamp, account and API key identifiers, endpoint, model identifier, token counts, latency, status code, error category, request size, and charge amount. Usage Metadata does not include prompt or completion text.
- Support and communications data: messages, requests, attachments, diagnostics you choose to provide, call notes, and related correspondence.
- Security and technical data: IP address, user agent, device and browser information, access logs, authentication events, rate-limit events, abuse signals, and incident records.
- Website data: information submitted through forms, and on some public pages, the visitor identification data described in section 7.
- Customer Content: Inputs and Outputs sent to inference endpoints are processed transiently to generate responses and are not retained after the request completes.
4. Customer Content and Zero Data Retention
Inference endpoints process Inputs and Outputs only for the time needed to provide the response, including transient processing for streaming, queueing, batching, retries, in-request KV-cache reuse, and network transmission.
Alchemy does not intentionally write prompt text, completion text, or persistent result caches from inference requests to persistent logs, databases, monitoring or analytics systems, backups, or training datasets, and does not use them for model training, fine-tuning, evaluation, benchmarking, product improvement, or marketing without the customer's opt-in or a signed agreement.
Because of ZDR, Alchemy generally cannot retrieve, correct, export, or delete prompt or completion text after a request completes.
5. How we use personal data
We use personal data to provide, secure, administer, bill, support, and improve the Services; to review waitlist submissions and decide who receives access and credits; to communicate with customers and prospects; to prevent abuse and fraud; to comply with law; to enforce our agreements; and to protect rights and safety.
We use Usage Metadata for billing, rate limiting, security, fraud prevention, debugging, reliability, and capacity planning. Usage Metadata is not used to reconstruct prompt or completion text.
6. Legal bases for processing
For people in the European Economic Area, United Kingdom, or Switzerland, Alchemy relies on the following legal bases where applicable.
| Purpose | Personal data | Legal basis |
|---|---|---|
| Provide and administer the Services | Account data, Usage Metadata, Customer Content during inference, support data | Contract performance and legitimate interests |
| Waitlist and early access | Waitlist data, business contact data | Legitimate interests |
| Billing, invoices, taxes, accounting | Billing and tax data, payment status, invoices, transaction metadata | Contract performance and legal obligation |
| Security, abuse and fraud prevention | Security logs, IP address, authentication events, Usage Metadata, abuse signals | Legitimate interests and legal obligation |
| Support and communications | Contact data, support tickets, diagnostics you provide | Contract performance and legitimate interests |
| Visitor identification on public pages | Visitor identification data (section 7) | Legitimate interests, or consent where required |
| Legal compliance and disputes | Relevant account, billing, security, and communication data | Legal obligation and legitimate interests |
| Marketing communications | Business contact data, preferences, communication history | Consent or legitimate interests, with opt-out |
8. How we disclose personal data
We share personal data with service providers that process it on our behalf, under contracts that limit their use of it, including:
- cloud hosting and infrastructure providers, such as Vercel, Amazon Web Services, and Cloudflare, and compute and model hosting providers that run inference;
- WorkOS, for authentication and single sign-on;
- Stripe, for payments, credits, and invoicing;
- RB2B, for visitor identification on public pages (section 7);
- Slack and similar internal communication tools, which our team uses to receive waitlist and support notifications;
- professional advisers, auditors, and insurers.
We may also disclose personal data to our affiliates; to a buyer or successor in a merger, acquisition, or asset sale; and to regulators, courts, law enforcement, or other parties where required by law or necessary to protect rights, safety, and the security of the Services.
Alchemy does not sell Customer Content, share it for cross-context behavioral advertising, or use it for advertising. We may disclose aggregated or de-identified information that does not identify a customer or individual.
9. International transfers
Alchemy is based in the United States, and personal data may be processed in the United States and in other countries where we or our service providers operate. Dedicated deployments run in the regions agreed with the customer.
Where personal data from the European Economic Area, United Kingdom, or Switzerland is transferred to a country without an adequacy decision, we use a lawful transfer mechanism such as Standard Contractual Clauses.
10. Retention
We keep personal data only as long as needed for the purposes in this Policy, including service delivery, billing, security, legal compliance, dispute resolution, and enforcement. Where the law sets a retention period, such as for tax and accounting records, we keep records for that period.
| Data category | Retention |
|---|---|
| Prompt text, completion text, and result caches from inference | Not retained: processed transiently under ZDR and discarded when the request completes |
| Usage Metadata | As long as needed for billing, reconciliation, security, and reliability; aggregated or de-identified metrics may be kept longer |
| Account and organization data | For the life of the account, then as long as needed for legal, tax, security, or dispute purposes |
| Waitlist submissions | Until access is granted or the waitlist closes, or sooner on request |
| Billing, invoice, tax, and accounting records | For the period required by applicable tax and accounting law |
| Security logs and abuse records | As long as needed for security, incident response, fraud prevention, and legal claims |
| Support tickets and communications | As long as needed to resolve the request and keep account history |
| Marketing preferences | Until you opt out; suppression records are kept so we honor the opt-out |
11. Data security
We use administrative, technical, and organizational safeguards designed to protect personal data, including access controls, encryption in transit, encryption at rest where supported, multi-factor authentication for administrative access, one-way hashing of API keys, logging controls, incident response, and vendor review.
No system is perfectly secure. Customers are responsible for securing their own systems, users, API keys, and applications.
12. Sensitive and regulated data
Customers must not submit special-category personal data, protected health information, payment card data, biometric identifiers, government identification data, or other highly sensitive data to the Services unless Alchemy has expressly agreed to that use in a signed agreement. Customers who submit personal data are responsible for having the lawful basis, notices, and consents that submission requires.
13. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, to withdraw consent, to opt out of targeted advertising or certain disclosures, and to not be discriminated against for exercising these rights.
To exercise these rights for personal data Alchemy controls, email [email protected]. We may need to verify your identity, or an authorized agent's authority, before responding.
For personal data in Customer Content processed on a customer's behalf, please contact that customer. Alchemy will assist customers as required by the Data Processing Addendum and applicable law.
You may also have the right to lodge a complaint with a data protection authority where you live or work.
14. Children
Alchemy Inference is not intended for children. We do not knowingly collect personal data from anyone under 18, and customers must not allow minors to use the Services directly.
15. Changes to this Policy
We may update this Policy from time to time. The updated version takes effect when posted at inference.alchemy.com/privacy, unless a later effective date is stated. We will communicate material changes where required by law.
16. Contact
Alchemy Insights, Inc.. Privacy questions, requests, and notices may be sent to [email protected].