Documents
Data Processing Agreement
Version 1.3, effective 6 November 2026. Says how this agreement is accepted, with no separate signature; says that you must not send us health information about any individual; adds to your instructions the access our personnel need to support you and to operate and secure the service; and adds to the measures in Annex 2. Replaces 1.2 of 4 October 2026. This agreement is part of the Terms of Service and of every Order Form by reference, without the need for additional signatures. It is accepted when the Terms of Service are accepted for your organisation or an Order Form is signed, on every plan, and it is not signed separately (Annex 4).
This Data Processing Agreement ("DPA") is between Alchemy EMEA Limited ("Alchemy", "we"), registered in England and Wales, company number 16104791, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF, and the organisation that accepts the Terms of Service or signs an Order Form ("you", "the client"). It applies whenever we process personal data on your behalf in providing Elixir.
1. Definitions
"Data protection law" means the UK GDPR and the Data Protection Act 2018, each as amended (including by the Data (Use and Access) Act 2025), and, where it applies to you, the EU GDPR. "Personal data", "controller", "processor", "data subject", "processing" and "personal data breach" have the meanings given in that law. "Client data" means the material your organisation puts into the service and the results we collect for it, as described in section 3. "Sub-processor" means another processor we engage to process client data. "Terms" means the Terms of Service; "Order Form" means an order signed with us for a managed agreement.
2. Roles and precedence
For client data you are the controller, or, where you are an agency processing on behalf of your own client, a processor, and we are your processor or sub-processor accordingly; this DPA governs either way. Your obligations and rights as controller are those set out in this DPA and in data protection law, and nothing in this DPA relieves either party of its own obligations under that law. For account, billing and usage data about the people who use the service we are the controller, and the Privacy Policy governs instead. Where an agency uses the service on behalf of its own clients, the agency is our client under this DPA, is responsible for having the authority to instruct us on its client's behalf, and its client has no rights against us under this DPA.
If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. An Order Form prevails over this DPA where it expressly states a term that differs from it. On everything else the order in section 16 of the Terms applies.
3. Details of the processing
Subject matter: Tracking how the brands and topics you choose appear in search results and in the answers of AI engines, and reporting on it
Duration: The term of your agreement and the retention period in section 11
Nature and purpose: Storing your inputs; collecting search results and AI-engine answers from third-party providers for the prompts and keywords you set; classifying and scoring the collected text; producing reports; running the assistant on your instruction; sending service email
Categories of data subject: Your authorised users and the people you invite as guests; your clients' staff where you are an agency; individuals who appear in collected search results and AI-engine answers, such as authors, quoted people and people associated with a brand
Categories of personal data: Names, email addresses, roles and sign-in identifiers of users; the content of prompts and keywords, which may name individuals; names and other personal data that appear incidentally in collected results; the text of messages sent to the assistant; and, where a feature lets you connect a third-party account, the metadata of that connection (the account identifier, the scopes granted and the tokens needed to keep the connection alive)
Special category data: None is required by the service. You must not put special category data, including health information about any individual, criminal-offence data or data about children into prompts, keywords or the assistant, and you instruct us that any such data appearing incidentally in collected results is to be treated as client data and nothing more
4. Your instructions
We process client data only on your documented instructions. Your instructions are: the Terms, the Order Form, this DPA, and the use your authorised users make of the service through its features, including turning data access on for the assistant and authorising a connection to a third-party account, the access our personnel need to provide support to you and to operate and secure the service, under the controls in Annex 2, and the transfers to sub-processors described in section 12. Any other instruction must be in writing to legal@elixirai.io and we may charge for work outside the service.
If we believe an instruction breaks data protection law we will tell you promptly and may suspend the processing that instruction requires until it is resolved. We may also process client data where the law we are subject to requires it, in which case we will tell you before we do unless that law forbids it.
You are responsible for the lawfulness of your instructions and of the client data you provide, including having a lawful basis and giving any notices data subjects need, and for the compliance of your authorised users. You will not instruct us to process personal data that the service does not require.
5. Confidentiality
Every person we authorise to process client data is bound by a written duty of confidentiality, and has access only to the data their role requires.
6. Security
We implement the technical and organisational measures in Annex 2 and keep them under review. We may improve them and may replace a measure with one that is at least as protective, but we will not reduce the overall level of protection during your term. We help you meet your own security obligations under Article 32 by providing the information in Annex 2, this DPA and the sub-processor page.
7. Sub-processors
You give us general authorisation to engage sub-processors. The Sub-processors page on the legal index is Annex 3 to this DPA by reference: it lists each sub-processor, its purpose, the data it sees, its region and the transfer mechanism, with a change log. Adding or replacing a sub-processor on that page needs no new signature.
We will give at least 30 days' notice of a new or replaced sub-processor by email to your organisation's owners, and to the notices contact on an Order Form, and in the change log before it first processes client data. You may object in writing within 15 days of the notice on reasonable data-protection grounds; if you do not object within that time the change is accepted. If we cannot resolve the objection we will tell you, and either party may end the affected part of the service; we refund fees paid in advance for it, pro rata.
We put each sub-processor under written terms that impose data-protection obligations at least as protective as this DPA, and we remain liable to you for its performance.
8. Connections you authorise
This section applies to any future feature that lets an authorised user connect the service to a third-party account they hold, such as an account with a web-analytics or search provider; no such feature is available at the date of this version. When one is released: the connection will be made by that user through the provider's own consent screen, where the scopes are shown and granted; the provider will be listed on the sub-processor page before the feature is available; and the user, or an administrator, will be able to revoke the connection at any time from the service's settings or from the provider's own account. Your user's grant will be your instruction to us under section 4 to read what the scopes allow, and revoking it withdraws that instruction. A provider you connect in this way is a source of data you choose, not our sub-processor, unless we send client data to it; where we do, its listing on the sub-processor page at least 30 days before the feature is available is the notice under section 7. No amendment of this DPA is needed when such a feature is released.
9. Assistance with data subjects, impact assessments and the regulator
If a data subject writes to us about client data we will forward the request to your organisation's owners within 5 business days and will not respond ourselves except to say we have passed it on, unless you instruct otherwise. The service lets an authorised user access, correct, export and delete user records; where a request needs more than that we will assist you within a reasonable time, and we may charge for work that is not caused by our own act or omission.
We will give you the information you reasonably need for a data-protection impact assessment of your use of the service and for any prior consultation with a supervisory authority.
10. Personal data breaches
If we become aware of a personal data breach affecting client data we will tell your organisation's owners without undue delay and in any event within 72 hours of becoming aware, and if later, with the reasons for the delay. We may give the notice in stages as we learn more. The notice states what happened, which categories of data and data subjects are affected as far as we know, the likely consequences, what we have done and what we recommend you do. We will keep you informed as we learn more and will cooperate with your own notification to a supervisory authority or to data subjects. A notice under this section is not an admission of fault. This section covers breaches of our systems and of our sub-processors' systems; an incident caused solely by your users, your credentials, your connections or your other systems is yours to assess and notify; we will tell you what we observe on our systems and assist you with it.
11. Deletion and return
For 90 days after the end of your term your organisation's data remains available for retrieval through the service, so that you may export it if you choose; deletion after that period is your instruction to us. We then delete it within 10 business days, and backup copies within 30 days after that. If an Owner deletes the organisation, its data is deleted 30 days after the deletion instead. On written request we will confirm deletion in writing. We keep only what the law requires us to keep, such as accounting records, and process it only for that purpose. We also keep our records of our personnel's access to your organisation, and of changes they make to it, for 24 months from the event, including after deletion, with your organisation's name removed when its data is purged.
Deletion covers your inputs, your settings, your reports, your users and the link between your organisation and the results collected for it. The search results, AI-engine answers and citations themselves are observations of public systems: we retain them as our dataset after your term, de-linked from your organisation, your users, your inputs and your settings, as described in section 8 of the Terms; you agree to that retention and it is your instruction to us. From that point we hold them as controller in our own right, as observations of public sources, under our Privacy Policy, and this DPA no longer applies to them. We will not attempt to re-identify them with your organisation.
12. International transfers
We are established in the United Kingdom and our database is hosted in London. We transfer client data outside the United Kingdom only to a sub-processor listed on the sub-processor page, and only under one of these safeguards: adequacy regulations made under UK data protection law, including for the European Economic Area; the UK Addendum to the EU Standard Contractual Clauses (processor-to-processor module) or the ICO's International Data Transfer Agreement; or the UK extension to the EU-US Data Privacy Framework where the recipient is certified under it. The page names the safeguard for each sub-processor. If a safeguard ceases to be valid we will put an alternative in place or, if we cannot, tell you and let you end the affected part of the service.
Clients established in the European Economic Area rely on the European Commission's adequacy decision for the United Kingdom for their transfer to us. If that decision ceases to apply, the EU Standard Contractual Clauses (controller-to-processor module, or processor-to-processor where you are an agency) are deemed entered into between you as exporter and us as importer, with their annexes completed from sections 3 and 7 and Annex 2 of this DPA and governed by the law of the member state in which you are established, and replacement clauses issued by the European Commission apply automatically in place of any that are superseded. For a client established in the European Economic Area, our onward transfers to sub-processors outside the United Kingdom and the European Economic Area are then also covered by the EU Standard Contractual Clauses (processor-to-processor module). We have not appointed a representative in the European Union. If we become required to appoint one we will name it on the legal index.
13. Audit
We will make available the information needed to demonstrate our compliance with this DPA. In the first instance that is Annex 2, the sub-processor page, and a written response to your reasonable questions. Once in any 12-month period, on 30 days' written notice, where the written response does not reasonably answer your questions, you or an independent auditor bound by confidentiality and not a competitor of ours may audit our processing of client data, during business hours, with the least disruption to our operations and without access to other clients' data. You bear the costs of an audit unless it finds a material breach of this DPA. Audit findings are confidential information of both parties and you will give us a copy. The information we make available includes our record of processing for your organisation. We will also cooperate with an audit required by a supervisory authority.
14. Liability
Each party's liability under this DPA is subject to the limits and exclusions in section 12 of the Terms, or in an Order Form that expressly names section 12 of the Terms and states different ones, and those limits apply once across the Terms, the Order Form and this DPA together. For the purpose of section 12 of the Terms, a breach of this DPA, including a personal data breach, is a breach of this DPA and not a breach of confidentiality, and the cap applies to it. Where both parties are responsible for damage, each is liable only for its share of the responsibility.
15. Term and changes
This DPA lasts as long as we process client data for you. Changes to it take effect as section 15 of the Terms describes and are recorded with a new version number; a change required by data protection law may take effect sooner on notice. The version in force is the one currently published on the legal index.
16. Law
This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except that a data protection authority or a data subject may act where data protection law allows, and Standard Contractual Clauses in force under section 12 are governed by the law they state.
Annex 1: Processing details
The subject matter, duration, nature and purpose, data subjects and personal data are set out in section 3. The processing operations are storage, collection from third-party providers, classification and scoring, reporting, transmission to the sub-processors on the sub-processor page, and deletion at the end of the retention period.
Annex 2: Technical and organisational measures
Tenancy separation: Every table that holds client data carries the project it belongs to, and the database resolves the project to its workspace and organisation under row-level security, so that a user's queries can reach only the organisations they belong to. An agency's clients are separated from one another the same way.
Access control: Access to an organisation is by invitation, with owner, administrator, editor and viewer roles and two kinds of guest; ownership can be transferred only by the owner. Staff access to client data is limited to named platform operators recorded in a register that no user role can edit. In the database, read access across organisations is limited to staff holding the operator or administrator role; other staff roles see only the account, membership, agreement, usage and request records their job needs, including workspace, project and brand names, and never prompts, keywords, collected results or assistant conversations.
Encryption: Data is encrypted in transit (TLS) and at rest by our database and storage provider.
Credentials: Data collection and analysis run under service credentials that no user role holds. A user's session reaches the database through a key bound by row-level security; where the application server uses service credentials, the same role rules are enforced in its code.
Audit: Certain actions in an organisation are recorded with the actor and the time: organisation and workspace deletion, restoration and purge; spend-cap changes; workspace creation and allowance allocation; credit top-ups; API key creation and revocation; changes to general and security settings; project, detection-rule and tag changes; and legal acceptances. Membership changes and ownership transfers are not yet recorded, and apart from tag history the record is not yet readable in the product.
Deletion: Organisations and workspaces deleted by an Owner are soft-deleted with a 30-day grace period, then purged by a scheduled job.
Backups: Our database provider takes daily backups; backup copies of deleted data roll off within 30 days.
Testing and release: Changes to the application are checked by automated tests before they are merged, and are deployed to a separate staging environment before they are released to the live service.
Assistant: The assistant reads project data only when an authorised user turns data access on for a conversation, and generates nothing except in response to that user's message.
Sub-processors: Listed with purpose, data, region and transfer mechanism on the sub-processor page; changes need 30 days' notice.
Personnel: Staff are bound by confidentiality and have access only to what their role requires.
Annex 3: Sub-processors
The Sub-processors page on the legal index, as amended under section 7.
Annex 4: Acceptance
This DPA is part of the agreement by reference, on every plan. It is accepted with the Terms of Service when they are accepted for your organisation, or with an Order Form when it is signed, and it is not signed separately: there is no signature page. The version in force is the one published on the legal index, which can be printed or saved at any time; your organisation's Owners and Administrators can also open it from the Legal tab of the service's settings.