Documents
Privacy Policy
Version 2.5, effective 7 November 2026. Names Google as the provider our sales staff use for address lookup and for booking and holding sales demonstrations, and says which providers the sub-processor page lists. Replaces 2.4 of 4 October 2026.
This policy is issued by Alchemy EMEA Limited, registered in England and Wales, company number 16104791, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF. It covers the Elixir service and the elixirai.io website. Write to legal@elixirai.io about anything in it.
1. Two roles
For your account, billing and how you use the service we are the controller: we decide what is collected and why, and this policy applies. For the material your organisation puts into its projects, and the personal data that may appear in what we collect for it, we are your organisation's processor: we act on its instructions under the Data Processing Agreement, and your organisation's own privacy notice applies to that data. The sub-processor page lists everyone who processes client data or our billing data on our behalf, and the tools that measure our own website and app. Section 4 names the other providers we use as controller. We have not appointed a data protection officer; questions about this policy go to legal@elixirai.io. We do not make decisions about you that have legal or similarly significant effects by automated means alone.
2. What we collect, and why
Account data: your name, email address, organisation, role, sign-in identifiers and the preferences you set. To run your account and secure it. We need your name and email address to create an account; without them we cannot provide the service to you. Legal basis: performance of the User Terms between you and us, and our legitimate interest in providing the service your organisation has bought.
Usage and device data: the pages and features you use, timestamps, IP address, browser and device, and the record the service keeps of key actions in your organisation. To keep the service secure, to let your organisation see who did what, and to improve the service. Legal basis: our legitimate interest in running a secure, working service.
Billing data: purchases made through our payment reseller, Paddle.com Market Limited, are made on Paddle's own checkout. Paddle is the seller of record and collects your name, email address, billing address, payment details and tax details as an independent controller under its own privacy policy at paddle.com/legal; we never receive card details. Paddle sends us a record of each subscription and payment (its status, the plan, amounts, dates and Paddle's reference numbers), which we keep as the record of what your organisation bought and when. For agreements invoiced directly, we hold the billing contact, VAT number, invoice amounts and payment status in our accounting system. Legal basis: performance of our contract with your organisation and our legal obligation to keep accounting records; for a named billing contact, our legitimate interest in invoicing the organisation that named you.
Your organisation's inputs: prompts, keywords, competitor sets, brand terms, and the connections you authorise. Processed on your organisation's instructions as processor.
Collected observations: search results, AI-engine answers and citations gathered for your projects. These describe public systems and may incidentally contain personal data (an author's name in a cited page, for example). Processed as processor during the term; retained afterwards as our dataset, de-linked from your organisation, your users, your inputs and your settings, as section 3 describes.
Assistant conversations: what you type to Distil and, when you turn data access on, the project rows it reads. Sent to our AI providers to produce the reply. Distil is an automated system; you are told so where you use it. Legal basis: performance of the User Terms between you and us, and our legitimate interest in providing the service your organisation has bought.
Support and correspondence: what you send us by email or through the service. Legal basis: our legitimate interest in answering you.
Requests from the service: when you send a question, feedback or a request for an add-on or a plan change from the service, we record the message, your name and email address, your organisation, workspace and project, your plan and role, the page you were on, your browser, and the replies and changes of owner that follow. Our sales, customer success and support staff read it to answer and act on it, and it is emailed to the team that handles it. Legal basis: our legitimate interest in answering you and, for a request to change what your organisation buys, performance of our contract with it.
Marketing: we send marketing email only with your consent, and every message has an unsubscribe link. We do not sell personal data.
3. People who appear in collected results
The search results, AI-engine answers and cited pages we collect are public sources. They can name people: an author, a quoted person, a person associated with a brand. During a client's term we hold this data as that client's processor. After the term ends we keep the results as our own dataset, de-linked from the client, its users, its inputs and its settings, and from that point we are the controller of any personal data that remains in them. We use the dataset to improve the service, build benchmarks and research how search and AI engines behave. Legal basis: our legitimate interest in those purposes, which we have assessed and recorded, and, for research into how engines behave, the provisions of UK data protection law for research purposes, with the safeguards those require. We do not use the dataset to make decisions about, profile or contact the people named in it, and we do not attempt to re-identify it with any client. Because the data comes from public sources and the people in it are not known to us, we cannot tell each of them individually; this policy is our notice to them. If you appear in collected results you may object to our holding them or ask us to remove your name by writing to legal@elixirai.io.
4. Who else sees it
The organisations that process data on our behalf, what each sees and where, are on the sub-processor page, which is part of this policy. We give at least 30 days' notice of a new sub-processor by email to organisation owners and in the page's change log.
Google. Our sales staff use Google Places to look up a company's postal address when preparing an Order Form, and Google Calendar and Google Meet to book and hold sales demonstrations. Google sees the address text typed, and the names and email addresses of the people invited to a demonstration, with any recording or transcript of it. It does not see your organisation's data in the service. Legal basis: our legitimate interest in selling to and contracting with your organisation.
Otherwise we disclose personal data only to your organisation's authorised users as the service is designed to (your name, email address and role are shown to the other members of your organisation, your actions in tag history to those who can see the project, and your email address to anyone you invite), to professional advisers under confidentiality, to a successor if we sell or transfer the business (who takes it on the same terms), or where the law requires. If you were invited to an organisation, we received your name and email address from the person who invited you.
We do not train or fine-tune general-purpose models on your data, and we use our AI providers through their business APIs, whose terms do not permit them to train on what we send.
5. Where it goes
We are established in the United Kingdom and our database is hosted in London. Some sub-processors are in the European Union and the United States; the sub-processor page names the safeguard for each (the UK adequacy regulations for the EU, and for the United States the UK Addendum to the EU Standard Contractual Clauses or the ICO's International Data Transfer Agreement, or the UK extension to the EU-US Data Privacy Framework where the provider is certified). You may ask us for a copy of the safeguard that applies to a transfer. Clients in the European Union rely on the European Commission's adequacy decision for the United Kingdom.
6. How long we keep it
Your organisation's data (inputs, settings, reports): For the term, then 90 days for retrieval, then deleted within 10 business days; backup copies within 30 days after that. If an Owner deletes the organisation, 30 days after the deletion instead
Account data: While the account exists, then 60 days after you delete it (the grace period in which it can be restored), then deleted. If the organisation you created is deleted, your account is deleted with it
Assistant conversations: Held on your organisation's account while it exists; private to the user who had them; deleted with the organisation's data
Collected observations: Retained as our dataset for as long as we use it for the purposes in section 3, reviewed at least yearly, de-linked from your organisation, your users, your inputs and your settings; not re-identified with any client
Raw responses from data providers: 12 months, then deleted
Server and access logs: 30 days
Records of key actions in an organisation (lifecycle, spend-cap and tag changes): For the life of the organisation, then deleted with its data
Records of Elixir staff access to your organisation and of changes Elixir staff make to it: 24 months from the event, including after your organisation is deleted. The organisation's name is removed when its data is purged. Staff are shown by role and reference
Records of legal acceptances and ownership transfers: For the life of the organisation; kept as evidence of what was agreed for 6 years after the agreement ends once that retention is in place, and the version recorded on the Legal Documents page until then
Billing and accounting records, including the subscription and payment records Paddle sends us: 6 years from the end of the financial year they relate to, as UK company and tax law requires
Support correspondence, and requests sent from the service with their history: 3 years after the ticket or request closes
Marketing consent and preference records: Until withdrawn, and for 24 months after your last interaction with us
7. Your rights
You can access, correct, delete or export your personal data, restrict or object to how we use it, and withdraw consent where consent is the basis. Much of this you can do from your account settings; for the rest write to legal@elixirai.io and we will answer within one month. Where we act as processor we will pass your request to your organisation, which decides. You may complain to us first at legal@elixirai.io; we acknowledge complaints within 30 days and tell you the outcome. You may also complain to the Information Commissioner's Office (ico.org.uk) or to your local supervisory authority. We have not appointed a representative in the European Union; if we become required to, we will name it on the legal index.
8. Security
Client data is separated by organisation in the database and that separation is enforced at the database level; data is encrypted in transit and at rest; access follows least privilege; key actions in an organisation are recorded; and the data-collection pipeline runs under service credentials that no user role holds. No system is perfectly secure. If a breach affects your personal data we will tell you and the regulator as the law requires, and tell your organisation within 72 hours of becoming aware of a breach that affects data we process for it.
9. Cookies
The service sets the cookies needed to keep you signed in and to remember your preferences. The website's cookies and any analytics it uses will be described in the Cookie Policy, which takes precedence for the website once published.
10. Children
The service is for businesses and is not intended for anyone under 18.
11. Changes
We may change this policy. A material change is announced to organisation owners and administrators by email and in the service before it takes effect; each version, with its date, is published on the legal index.
12. Contact
Legal and privacy: legal@elixirai.io. Support: hello@elixirai.io. Telephone: +1 914 523 9040. Post: Alchemy EMEA Limited, 167-169 Great Portland Street, 5th Floor, London W1W 5PF.