Privacy notice

Who to contact

Alchemy Creative operates Alchemify at alchemify.io and is responsible for the account and service information described here. Alchemify is operated by ACREATIVE AI LTD, registered in England and Wales, company number 16324185. Registered office: Level One Basecamp, 49 Jamaica Street, Liverpool, L1 0AH. Contact hello@alchemify.io about privacy, access or deletion. If you put someone else’s information in a draft, you are responsible for having permission or another valid basis to use it.

Information used by the current beta

Accounts are created by invitation only, and signing in does not create an account for an address we have not invited. We use your invitation and email address to create your account and send sign-in links. We store your workspace and brand details, drafts, revisions and uploaded media so you can use the studio across devices. Account identifiers, session records and technical request information help us authenticate users, protect private workspaces and investigate faults. Support messages contain the information you choose to send.

Providing an email address is necessary to sign in. Brand and draft information is provided by you. Please avoid including sensitive personal information about yourself or others unless it is necessary and appropriate for your content.

The waitlist

If you join the waitlist, we store your email address, when you agreed to hear from us, whether you have confirmed, and the campaign name in the link you followed, if any. Resend sends our confirmation email and, after you confirm, emails about Alchemify's launch and product updates. Cloudflare Turnstile checks that the form is being used by a person; Cloudflare processes technical signals for that check. Unconfirmed sign-ups are deleted after 30 days. You can unsubscribe with the link in our waitlist email or by contacting us, and you can ask us to delete your waitlist record at any time.

Why we use it

We process account details and saved content to provide the service you request. We use limited technical and support information for our legitimate interests in keeping the service secure, reliable and supportable. Where a legal obligation requires records, we keep the relevant records for that obligation. We do not use the beta to make automated decisions with legal or similarly significant effects about people, with the following exceptions, which are the ones we have identified (we will update this notice if another applies). If a card has already been used for a free trial, we automatically decline a second free trial on that card. [Danny to confirm: automated decline of a repeat free trial.] If a payment on your plan is disputed with your bank and Stripe gives the reason as fraudulent or unrecognised, or gives no reason, we automatically freeze the account until a person has reviewed the dispute and lifted the freeze. [Danny to confirm: automatic freeze on a fraudulent or unrecognised dispute.] If a payment dispute is lost, we automatically cancel your subscription at once. [Danny to confirm: automatic cancellation after a lost dispute.] If any of these happens to you, you can ask for a person to review the decision by emailing hello@alchemify.io.

Service providers and location

Cloudflare hosts the application and handles web requests. Supabase provides authentication, the database and private file storage; the project’s primary region is London. Resend delivers authentication email and team invitations. Cloudflare Turnstile checks the waitlist form, and Resend (waitlist email) sends waitlist messages. OpenAI (writing and images) and Kie (video) receive the data described under AI writing, images and video below when you confirm an AI request. Stripe (payments) would receive the data described under Payments and plans only once paid plans start; they are not enabled yet, and Stripe is used in test mode only. Apart from Kie (see AI writing, images and video below), each provider processes your information for us under written data-processing terms. Some of them process it outside the UK, and we protect those transfers as follows. Cloudflare, Inc., Resend (Plus Five Five, Inc.) and Stripe, LLC are in the United States and are certified to the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which UK law recognises as giving adequate protection. Their terms also include the standard contractual clauses approved for UK transfers (the EU standard contractual clauses with the Information Commissioner’s UK Addendum) if that certification ever lapses. Supabase stores our database, sign-in records and files in London. Its staff in Singapore and other countries can access them for support and operations under those standard contractual clauses. OpenAI OpCo, LLC processes AI requests in the United States under those standard contractual clauses, which are part of OpenAI’s data processing addendum. Stripe also uses some payment information for its own purposes, such as fraud prevention and legal compliance, as an independent controller under its own privacy policy. You can ask for a copy of the relevant safeguards at hello@alchemify.io. Email you send to our contact address is also handled by our business email provider. When you connect a social account, we send the content you approve, and the requests needed to publish it and fetch its results, to that platform: Meta (Facebook, Instagram and Threads), Google (YouTube), Pinterest, Bluesky or LinkedIn. Each platform is responsible for its own processing.

Connected social accounts

You can connect Facebook Pages, Instagram, Threads, YouTube, Pinterest, Bluesky and LinkedIn member accounts to a brand. You sign in on each platform’s own permission screen, and we never see or store your social passwords. When you connect, we receive and store an encrypted access credential from the platform, the account’s identifier and name and, except for YouTube and LinkedIn, its profile image, and the permissions you granted.

We use these only to publish the posts you approve, to the account and at the time you chose, to check whether each post was published, and to show the results the platform provides for those posts, such as views and engagement. We don’t request access to your private messages or comment inboxes.

For LinkedIn, we request only sign-in, profile and member-posting permissions (openid, profile and w_member_social). We send the member text or link post you approved, without uploaded thumbnails. We store the post identifier returned when LinkedIn confirms creation and construct a link from it; we do not read the post back or collect LinkedIn post metrics. LinkedIn Pages, images and video are not available.

You can disconnect an account in Settings at any time; we then delete the stored credential. You can also remove Alchemify’s access in the platform’s own app settings. Once a post is published, the platform holds it under its own terms and privacy policy, and deleting your Alchemify data does not delete posts already on the platform.

YouTube API Services

Alchemify uses YouTube API Services. If you connect a YouTube channel, you also agree to be bound by the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy.

What we access and why. You grant access on Google’s own permission screen and we never see your Google password. We ask Google for permission to view your YouTube account (youtube.readonly) and to upload videos (youtube.upload), and, only if you separately choose it, to manage caption tracks (youtube.force-ssl). We use that access only to list the channels your authorization returns, so you can choose the one that belongs to a brand, and to check later that the channel is still yours; to upload to that channel the video you approved, with the title, description, visibility, audience and disclosure choices you approved, plus any cover image or caption track you approved, and to read back that upload’s status; and, where YouTube results are enabled, to read the view, like and comment counts of videos Alchemify uploaded for you, by exact video ID. Alchemify acts only on videos it uploaded for you. It does not use YouTube Analytics or Reporting data and does not delete videos.

What we store and for how long. We store the access and refresh credentials Google issues, encrypted before they are saved. Your brand’s connection record holds the channel’s ID and title, the permissions Google granted, and when the credential expires and was last checked. While you choose a channel, the channel IDs and titles your authorization returned (at most 50) are kept for up to 10 minutes. For each video we upload we keep its YouTube video ID and link with the publication record and, where results are enabled, its latest view, like and comment counts. We do not store other YouTube account data, such as profile images, subscriptions, playlists or watch history.

Credentials are kept only while the connection is active. While connected, Alchemify renews them automatically, and each renewal re-checks that the stored channel ID and title still match Google’s. When you disconnect, we ask Google to revoke the grant and delete our stored credentials and saved video counts straight away. Saved video counts are also deleted 30 days after they were last refreshed. The channel and video identifiers remain with your brand’s connection and publication records, as saved content under Retention and deletion, until you ask us to delete them.

Revoking access. You can disconnect YouTube for a brand in Settings at any time. If Google cannot be reached, we still delete our stored copy and tell you that Google’s revocation was not confirmed. You can also revoke Alchemify’s access directly in your Google security settings. If you revoke through Google, we find out the next time Alchemify renews or checks the credential; we then delete it and stop using the connection. To have us remove the remaining channel and video information, contact hello@alchemify.io.

Deleting YouTube data on request. Email hello@alchemify.io and we will delete the YouTube API data we hold for you as soon as possible and within 7 calendar days. This does not delete videos or other data held by YouTube or Google; manage those in YouTube and your Google Account.

Sharing. We use YouTube API data only for the purposes above. We do not sell it, use it for advertising or serve third-party ads, or share it with anyone other than the providers described under Service providers and location, which store and process it for us. Contact hello@alchemify.io with privacy questions or complaints.

AI writing, images and video

AI writing, images and video are available in the invite-only beta. Nothing is sent to an AI provider until you review a credit quote and confirm the request. We process AI requests to provide the service you asked for.

OpenAI writes text and creates images. For writing we send the draft you chose, any research notes saved with that draft, your brand details (name, voice, offerings, audience and any style rules you wrote), the instructions you typed, the name of the channel when you adapt a draft for one and, for a weekly plan, its start date, time zone and channels; for an image we send the description you typed and the image shape. OpenAI says it does not use data sent through its API to train its models by default. For writing, we ask OpenAI to store the response so that we can retrieve it if your connection drops. Once we have received the response, we ask OpenAI to delete its stored copy (OpenAI would otherwise keep it for 30 days by default). For images, OpenAI says it keeps no stored response. OpenAI says it may also keep abuse-monitoring logs of requests for up to 30 days, and we do not have OpenAI’s optional zero-data-retention arrangement, so that period applies. We use OpenAI under its business terms and data processing addendum, as our processor. Kie (Kie.ai) creates video. We send the description you typed (up to 1,000 characters), the clip length and the shape; we do not send your draft, brand context or any image to Kie. Kie.ai is operated by NexusAI Services LLC together with InnoLeap AI LLC, in Colorado, United States, and Kie says data may be stored in the United States. Kie states that it deletes generated media after 14 days and its logs of requests, which can include the text you sent, after two months. We have not verified a way to have Kie delete them sooner, so Kie’s copies follow Kie’s own deletion periods even after we delete your Alchemify data. Kie’s published terms let it use content sent to it to operate and improve its services, and they do not say whether that includes training AI models. [Danny to confirm: Kie processing agreement. We currently have no data-processing agreement or UK transfer safeguard with Kie.] Please do not include personal information about anyone in a video description.

Alchemify downloads each generated image and video into its own private storage and saves it to your private workspace and library, so a provider deleting its copy does not delete yours. Generated images and videos are recorded in your library as AI-generated. We also keep a record of each request with your workspace data: what was sent (your instructions or description, and for writing the draft and notes), the result, the quote, the credits charged, the model used, the provider’s request reference and the provider’s cost. If you rate a writing result, we keep your rating, the reasons you choose and any note you write, with that request. Only you can see them; other members of your workspace, including its owner, cannot. We use them only to improve Alchemify’s writing prompts, we never send them to OpenAI, we include them in your account export, and they are deleted with the request when your account is deleted. When you approve a post that came from a saved AI writing answer, we also keep, with that writing request, an edit-size measurement: how much the approved text differs from that answer, with its supporting word counts and related request and approval details (identifiers, channel, writing-instructions version and times), but no additional copy of your text. Because those identifiers tie the edit-size measurement to the post, the measurement can be linked to who wrote and approved the post, and every member of your workspace can see the measurement. We use the measurement only to understand and improve the quality of Alchemify’s writing prompts, never send it to OpenAI, include it in your account export, and delete it with the request when your account is deleted.

When your account is deleted, we delete the content of your AI requests and their results with the rest of your workspace. We keep a short usage record of each request, with no prompt or result text, for 90 days after deletion (rounded up to a whole day). It holds when the request was made, the kind of request, the credits and cost, its outcome and the provider’s reference for it. We keep it so that we can investigate misuse, answer provider enquiries and resolve billing or credit disputes. If a dispute or investigation is still open at that point, we keep that account's usage records until it is resolved. This relies on our legitimate interests. Copies held by AI providers follow the provider periods described above.

Payments and plans

Paid plans are not enabled yet, and Stripe is used in test mode only. When paid plans start, you pay on a page hosted by Stripe. You enter your card details there and they do not pass through Alchemify's servers; Stripe also collects your billing address. From Stripe we receive and store the identifiers of your customer record, subscription, invoices and payments, the plan, amount, currency and billing period, your billing country and your card's issuing country. We compare those two countries with the currency of the plan (pounds for the United Kingdom, US dollars elsewhere), and a payment that does not match is held for review. For the 7-day free trial we also receive a card fingerprint from Stripe, an identifier for the card number that does not reveal it, and use it so that one card can start only one trial. We keep the card fingerprint while your account exists. If your account is deleted, we keep only a scrambled copy of the fingerprint (a keyed hash), separated from your account, for 12 months (we round the end date, so it can run up to a week longer), so that deleting and re-creating an account cannot be used to start another free trial with the same card. This relies on our legitimate interest in preventing misuse of free trials, and you can object to it by contacting us. If we end a free trial because the card has already been used for one, we also keep a record of that (your Stripe customer ID, the subscription ID and the reason) for 12 months after the trial ended, to answer a claim or a card dispute and to stop repeat trials. This relies on our legitimate interests too, and you can object to it in the same way. Stripe processes payment data under its own terms and privacy policy and sends its own trial reminder email.

We keep payment, invoice, refund and tax records for at least six years from the end of the financial year they relate to, because UK tax and company law requires it. We may also need them to establish or defend legal claims. These records are not erased when you delete your account, but when it is deleted we keep only what those obligations need: the amounts, currencies, dates and billing country, and Stripe's references for the invoice, the payment and your customer record.

When free trials and paid plans are switched on, we send these emails through Resend, our email provider, to the address on your account. When a free trial is about to end, we email you a reminder about 48 hours before the first payment. When you start a plan, we email you a confirmation of your request to start at once and of the cancellation and refund terms. We keep a record that each was sent, together with the time and wording version of your request to start immediately, as part of our payment and contract records.

Team invitations

Team workspaces and invitations are not enabled yet. When they are, an owner or admin can invite a person by email address and role. We store the invited address, the role, who sent the invitation, when it expires and a hashed single-use token, not the link itself. Resend delivers an email from team@mail.alchemify.io that names the workspace and the role and contains the link. The invited address is visible to the workspace's owner and admins on the invitation list and, once accepted, in the member list, so please tell people before you invite them. Invitations are deleted 7 days after they expire, are revoked or are accepted, and an accepted invitation is also removed if the member's account is deleted. An invitation does not create an account: the invited person needs an account of their own.

Features still being prepared

LinkedIn Page connections, TikTok and X connections and Google website reporting are not enabled yet, and nor are paid plans and team invitations. Each will use the platform’s own consent screen and explain what is shared. We will update this notice before turning on any new data flow. Creating an Alchemify account alone does not connect your social accounts or send your drafts to an AI provider.

Storage on your device

Alchemify stores sign-in state, app files, preferences and offline drafts in browser storage. This allows the app to reopen and lets you edit drafts without a connection. Unsynced changes stay on that device until you reconnect and sync. Do not rely on signing out to erase all local draft copies on a shared device. Export any unsynced work you need before clearing this site’s browser data. The current beta does not install advertising pixels or website analytics tags.

Retention and deletion

Saved content is retained to provide your workspace while your account is active. You can request account or content deletion using the deletion instructions. We check account ownership and outstanding operations before removing data. Limited records may need to remain to resolve a security incident, dispute or legal obligation. Backup copies follow the hosting service’s backup lifecycle; deleting active records does not immediately erase every backup. Ask us for the handling of your particular request. Account deletion is handled by email during the beta (see the deletion instructions). Copies held by AI providers follow the provider periods described under AI writing, images and video. A few records are kept for a set period after deletion, as described under AI writing, images and video, Payments and plans, and in the next paragraph. You can object to the card record, the record of an ended trial and the AI usage record: tell us in your deletion request, before the deletion is completed, and we will not keep them. Once your account is deleted we keep those records under an internal reference and without your name, so we may be unable to find them if you ask us later.

Hosted blogs are not enabled yet. When they are, and your account is deleted after it had a published blog, we keep each blog's web address (for example alchemify.io/b/your-brand-name) for 24 months, with only the date it was retired. During that time the address shows that the blog has been removed and cannot be taken by anyone else, so old links cannot be used to impersonate you. We do not keep any other information with it. This relies on our legitimate interest in protecting former customers and readers from impersonation. If you want the address released sooner, contact us from the email address you used for the account.

Your choices and rights

Depending on the law that applies, you can request access, correction, deletion, restriction or a portable copy of your data. You can object to processing based on legitimate interests. Contact hello@alchemify.io; we may need to verify your identity without collecting more information than necessary. You may complain to your local data protection authority. In the UK, contact the Information Commissioner’s Office.

Updates

This notice covers the current private beta. Material changes will be explained before the affected new features are made available.