Short, because there is little to say: no analytics, no advertising, no tracking. What follows is the whole of it.
Alchemist IT is the data controller. Registered in England and Wales, company number 14337790, VAT 423916987, registered with the Information Commissioner's Office under number ZC242743. Registered office: 1 Castercliff Bank, Colne, Lancashire, BB8 8DJ. Questions about this notice or your data: support@alchemist-it.uk.
A theme preference, only if you click the light/dark switch. It is a cookie called ac_theme that holds the word "light" or "dark" for a year, set at your request so the site remembers your choice. Nobody who never clicks the switch gets it.
Nothing else. There are no analytics, no advertising cookies, no social widgets and no embedded video. The fonts are served from this site, so no request goes to a font provider. Some client logos on the home page may load from our storage provider, Supabase, which then sees your address the way any web server does. Because nothing non-essential is set, the site shows no cookie banner; if that ever changes, a consent step will be added first.
When you send a message through the contact form we receive your name, email address, organisation if you give it, what the message is about and the message itself. The legal basis is our legitimate interest in answering an enquiry you chose to send. It is sent to us by email and kept in that mailbox for 12 months, then deleted, unless it becomes a client relationship, in which case it is kept under the contract. It is never used for marketing and never shared for anyone else's purposes. To stop the form being used to flood that mailbox, a one-way hash of your network address is kept for up to a day; the address itself is not stored.
Connect is the console our clients and their colleagues sign in to, at /connect. If you have an account we hold your name, email address, the role and access you were given, and your two-step sign-in device, which every account has. We record what you do in Connect - sign-ins, changes, and anything written to a client's systems - in an activity log kept for two years unless the engagement sets otherwise, and which pages are opened, without who opened them, for six months. Failed sign-ins are counted against a one-way hash of the email address and of your network address for up to a day, so repeated guessing can be refused. If you turn on notifications, your browser's push service (Apple, Google or Mozilla, depending on the browser) delivers them. The legal basis is our contract with your organisation and our legitimate interest in keeping Connect secure and accountable.
Signing in sets cookies that are strictly necessary to keep you signed in: the session itself, and, if you tick "trust this device", one that skips the two-step code for 30 days. Connect also remembers the instance and the project you last chose, for 30 days, and some display choices in your browser's own storage, all set when you make the choice. None of them tracks you, and none is used outside Connect.
Some Connect features draft text with an AI model from Anthropic, using information from a client's systems. Each client decides whether that is allowed and on what terms, and the terms of use say more. Anthropic does not use it to train its models.
Alchemist IT's own staff can link their own Microsoft 365 accounts to Connect, including an account a client has given them, so their mail, calendar and Teams chats show in one place. Connect reads those from Microsoft when the page is opened and stores none of the content: only the account's name, its organisation's Microsoft ID, the permissions granted, and an encrypted sign-in token that only Connect's server can use, plus which conversations they set aside on their Today page (Microsoft's reference for the conversation and a time, never its subject, sender or words), kept for 30 days. Only the person who linked an account can see it.
Four suppliers, each under a written data-processing agreement: Vercel hosts the site and Connect and keeps standard server logs (network address, request, time) for a short period for security and operations; Supabase holds the database behind Connect and stores uploaded files; Resend delivers email, including contact-form messages; and Anthropic runs the AI features in Connect, only for clients who allow them. None of them may use the data for their own purposes.
Some of them process data outside the UK, including in the United States. Where they do, the transfer is covered by the safeguards UK law requires: UK adequacy regulations, including the UK extension to the EU-US Data Privacy Framework where the supplier is certified, or the Information Commissioner's international data transfer agreement or addendum.
Under the UK GDPR you can ask for a copy of what we hold about you, ask for it to be corrected or deleted, ask us to restrict or stop processing it, object to processing based on legitimate interest, and ask for it in a portable form. Email support@alchemist-it.uk and we will answer within a month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.
This notice was last revised on 14 October 2026. A change to what the site or Connect collects will be reflected here before it takes effect.