Legal

Privacy Policy

How AlchemOS collects, uses, and protects your information.

On this page
  1. Scope & Controller
  2. Data We Collect
  3. Sources of Data
  4. How We Use Data
  5. Legal Bases
  6. Sharing & Disclosure
  7. Cookies & Tracking
  8. Data Retention
  9. Security
  10. Your Rights
  11. International Transfers
  12. Children
  13. Changes to this Policy
  14. Contact Us
Effective date: 01 Nov 2025

Privacy Policy

This Privacy Policy explains how AlchemOS (“we”, “us”) handles personal information when you use our websites, products, and services (“Services”).

1) Scope & Controller

This Policy applies to the Services offered by AlchemOS. If you use the Services on behalf of an organization, that organization may be the data controller for end-user data it inputs into the Services.

2) Data We Collect

  • Account & Contact Data: name, email, phone, organization, role.
  • Billing Data: billing contact, address, payment method tokens (processed by our payment providers).
  • Service Data: configuration, logs, metadata, content you upload or integrate (e.g., PMS/POS events).
  • Usage & Device Data: IP address, device/browser type, pages viewed, product interactions, diagnostics.
  • Support Content: messages, attachments, feedback submitted to us.

3) Sources of Data

We collect data directly from you, from your organization admins, automatically via the Services, and from third-party systems you connect (e.g., Opera PMS, POS, payments, messaging providers).

4) How We Use Data

  • Provide, maintain, and improve the Services (including setup, integrations, orchestration, analytics).
  • Authenticate and secure accounts; detect, prevent, and respond to abuse or incidents.
  • Process transactions, subscriptions, and invoicing.
  • Provide support and respond to inquiries.
  • Send service communications and, with your consent or as permitted by law, product updates or marketing.
  • Comply with legal obligations and enforce terms.

Where applicable (e.g., EEA/UK), we rely on: performance of a contract, legitimate interests (e.g., securing and improving Services), consent (where required), and legal obligations.

6) Sharing & Disclosure

  • Processors: trusted vendors who process data under our instructions (e.g., cloud hosting, payments, email).
  • Integrations: third-party systems you choose to connect (e.g., Oracle/Opera PMS, Stripe/Adyen, channel managers, messaging, BI). Their terms apply.
  • Legal/Compliance: to comply with law, protect rights, safety, or prevent fraud/abuse.
  • Corporate Events: in a merger, acquisition, or asset sale, subject to appropriate safeguards.

7) Cookies & Tracking

We use cookies and similar technologies to operate the site, remember preferences, analyze usage, and measure performance. You can manage cookies in your browser and via our Cookie Policy.

8) Data Retention

We retain personal data for as long as necessary to provide the Services and meet the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type.

9) Security

We implement industry-standard technical and organizational measures to protect personal data. Target uptime for production Services is 99.9%; integrations are supported via REST and Webhooks. For details, see our Security page.

10) Your Rights

Depending on your location, you may have rights to:

  • Access, correct, or delete your personal data.
  • Object to or restrict certain processing.
  • Port your data to another provider.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with your supervisory authority.

Requests involving data controlled by your organization (customer content inside the Services) should be directed to your administrator; we will support the controller in fulfilling requests.

11) International Transfers

We may transfer data to countries with different data protection laws. Where required, we use appropriate safeguards (e.g., SCCs, IDTA, or other valid transfer mechanisms).

12) Children

The Services are not directed to children under the age of 16 (or as defined by local law). We do not knowingly collect data from children. If you believe a child provided data, contact us and we will take appropriate steps.

13) Changes to this Policy

We may update this Policy to reflect changes to our practices or legal requirements. Material updates will be notified via the Service or email and become effective upon posting unless otherwise noted.

14) Contact Us

Questions or requests about this Policy: hello@alchemos.co (Information) or support@alchemos.co (Support).