Documents

Sub-processors

Version 1.6 · effective 7 November 2026

Alchemy EMEA Limited (company number 16104791, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF) processes client data as a processor on the client's instructions, and account, billing and usage data as a controller. The organisations below process data on our behalf.

Processing client data today
Sub-processor	Purpose	Data it sees	Region	Transfer mechanism
Supabase, Inc.Postgres database, authentication and file storage for the platform	Hosting the database, sign-in and file storage	All platform data: accounts, organisations, projects, prompts, keywords, collected results, reports, audit events	London, United Kingdom (AWS eu-west-2)	Data stored in the UK. Support access from the United States under Supabase's data processing terms
Google Cloud (Google Ireland Limited, Google LLC)Cloud Run hosting, Vertex AI and BigQuery through Elixir's AI service	Running the application; the assistant, prompt translation and onboarding briefs; extraction, embeddings, clustering and classification over collected search and AI-answer text	Collected SERP and AI-answer text, brand and competitor names, prompts, keywords; project names, the user's messages to the assistant and, only after the user grants access in the conversation, the project's AI-visibility rows the assistant reads; no account passwords	United Kingdom (London) for hosting and embeddings; the European Union for model calls (Vertex AI's EU multi-region) and background work (Belgium). Service logs are currently stored in Google's global location while they move to London (europe-west2).	UK to EU under the UK adequacy regulations, under Google Cloud's data processing terms; any support access from the United States under Google's certification under the UK extension to the EU-US Data Privacy Framework
DataForSEO OÜRegistered in Estonia (company number 14502291)	Collecting search results, keyword volumes and AI-engine answers	Prompts, keywords, target markets, languages and devices; the brand and competitor names in them	European Union (Estonia); infrastructure in Germany and the United States	UK to EU under the UK adequacy regulations; onward transfers under DataForSEO's own Standard Contractual Clauses, as its privacy policy states
Resend, Inc.Transactional email	Sending sign-in, security, invitation, ownership-transfer and weekly summary emails	Recipient names and email addresses, the organisation and project names in the message, weekly summary figures	United States	Provider terms
Paddle.com Market LimitedPayment reseller and seller of record for clients billed through Paddle	Checkout, invoicing, tax and refunds for clients who buy through Paddle	Billing name, address, email, VAT number, payment details entered on Paddle's own form; subscription and invoice records	United Kingdom	None required
Intuit Limited (QuickBooks Online, UK edition)Alchemy's accounting system, for clients invoiced directly by Alchemy EMEA Limited	Raising, sending and recording invoices for directly billed agreements	Client company name, billing contact name and email, VAT number, invoice amounts and payment status	United Kingdom edition, hosted on Intuit, Inc. infrastructure in the United States	Provider terms
Logo.devBrand logos, colours and descriptions, looked up from a website address	Filling in a brand's logo, colour and description when a brand or competitor is added, and showing brand logos during onboarding	The website addresses of the brands and competitors you add; during onboarding, the request from the user's browser, which carries its IP address and browser details as any web request does	Treated as the United States until the provider confirms where it hosts the service	Provider terms

Provider terms: the provider's own data processing terms, which rely on the UK Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU-US Data Privacy Framework where the provider is certified under it.

Added when the feature that uses them ships; each will be notified as below
Sub-processor	Purpose	Data it sees	Region	Transfer mechanism
Google LLC (Google Analytics and Search Console APIs)Added when the analytics connections ship; each connection is authorised by the client's own user through Google's consent screen and can be revoked there	Reading a client's Google Analytics 4 and Search Console data into its projects	OAuth tokens, the properties chosen, and the traffic, query and page data the client connects	United States and European Union	Google's data processing terms and its certification under the UK extension to the EU-US Data Privacy Framework; use limited by the Google API Services User Data Policy

Measuring our own website and app
Organisation	Purpose	Data it sees	Region	Transfer mechanism
Google Ireland Limited (Google Analytics and Tag Manager)Loads our measurement tools and records use of our website and app; runs only after a visitor agrees to analytics	Measuring how our own website and app are used, so we can see which pages are useful	Pages viewed and their titles, with any customer or project name removed from the address before it is sent; a random account reference where the visitor is signed in; the visitor's device, browser and approximate location as Google derives them	European Union and the United States	Google's data processing terms and its certification under the UK extension to the EU-US Data Privacy Framework
InnoCraft Ltd (Matomo Cloud)Measurement alongside Google Analytics; runs only after a visitor agrees to analytics	Measuring how our own website and app are used	Pages viewed and their titles, with any customer or project name removed from the address before it is sent; the visitor's device, browser and approximate location as Matomo derives them	European Union (Matomo Cloud hosts European customers in Germany); where InnoCraft Ltd in New Zealand accesses the data, New Zealand is covered by a United Kingdom adequacy decision	Matomo's data processing terms, and the United Kingdom adequacy decision for New Zealand where InnoCraft accesses the data

These organisations are not sub-processors and do not process client data. They measure how our own website and app are used, which is data Alchemy holds as controller, and they run only for a visitor who has agreed to analytics. They are listed here so that the picture is complete. This section is not part of Annex 3 to the Data Processing Agreement: the notice, objection, termination and refund terms in section 7 of that agreement apply only to the organisations in the tables headed "Processing client data today" and "Added when the feature that uses them ships", and do not apply to this section.

Notice of changes

We give notice of a new or replaced sub-processor by email to every organisation owner, at least 30 days before it first processes client data, and we record the change in the log at the foot of this page.

A client may object in writing within 15 days of the notice on reasonable data-protection grounds; if no objection is made within that time the change is accepted. If we cannot resolve the objection, either party may terminate the affected part of the service and we refund any fees paid in advance for it, pro rata.

These notice and objection terms are those in section 7 of the Data Processing Agreement, of which this page is Annex 3.

To receive notices at an address other than the organisation owner's, write to legal@elixirai.io.

Change log

7 November 2026: v1.6, the Google Cloud row reads the United Kingdom and the European Union only: every model call now runs in the European Union, and any support access from the United States relies on the Data Privacy Framework. Service logs are currently stored in Google's global location while they move to London (europe-west2).
6 November 2026: v1.5, Anthropic, SerpApi and Groq are removed: none of them processes client data. Logo.dev is added: it looks up brand logos and colours from the website addresses of the brands and competitors you add. The Google Cloud row now covers the assistant, prompt translation and onboarding briefs, and its region reads the United Kingdom and the European Union, with Google's global endpoint where a model is served from it
25 September 2026: v1.4, Stripe is removed: self-serve purchases are made through Paddle, already listed, and Stripe no longer processes client data
13 September 2026: v1.3, the analytics tools that measure our own website and app are listed, in their own section, as data we hold as controller rather than client data
11 September 2026: v1.2, deemed acceptance after the 15-day objection window, matching DPA 1.1 section 7
11 September 2026: v1.1, the Data Processing Agreement is published; this page is its Annex 3 and the notice terms now cite section 7 of it
11 September 2026: v1.0, First published list.