Privacy Policy

Alembic is operated by James McArthur as a sole proprietorship. This policy explains how we collect, use, and protect your information when you use our service ("the Service").

What We Collect

When you create an account, we collect:

• Account information — your name, email address, and a hashed password (or Google OAuth credentials)
• Documents and files you upload or send in — PDFs, Word files, spreadsheets, images and email attachments
• Extracted data — structured fields, values, and metadata produced by our AI pipeline
• Data from Google accounts you connect — only if you connect Gmail, Google Calendar or Google Sheets, and only as described in Google User Data below
• Data from other services you connect — the records and files Alembic reads from or writes to QuickBooks, DocuSign, Slack or Salesforce for the jobs you set up, as described in Connected Accounts below
• Phone numbers and text messages — when you, or a job, text with Alembic
• Feedback — what you send through Help & feedback, including the recent DISTLR messages it refers to
• Usage data — which features you use, document counts, and processing metrics (for billing and service improvement)
• Push notification subscription data — endpoint URLs and encryption keys, stored solely for delivering web push notifications to your device

How Your Documents Are Processed

When you upload a document, send one by email, or ask DISTLR to work on a job, the content is sent over HTTPS to the AI providers listed under Third-Party Services (Anthropic, Google through OpenRouter, xAI, and TypeSafe), depending on the task. Under the terms we use them on, none of them trains its AI models on your content. Each keeps what it receives only as its own terms allow: for example, Anthropic and xAI keep API requests for up to 30 days for abuse monitoring, some Google endpoints reached through OpenRouter keep them for up to 55 days, and TypeSafe keeps nothing. Our website chat runs on an open-weight model reached through OpenRouter, with data collection turned off. We never use your documents to train our own models.

Where Your Data Is Stored

• Database — Neon Postgres, hosted in the US, encrypted at rest
• File storage — Vercel Blob, hosted in the US, encrypted at rest
• All data transmitted over HTTPS (TLS encryption in transit)

How Long We Keep Your Data

Your documents and extracted data stay in your workspace until you delete them. You can delete individual documents, cards or whole jobs at any time from the app; this removes the documents, their files and the data extracted from them, and the mail filed with them, including its saved messages, attachments and replies.

Disconnecting a mailbox stops us from reading it and sending from it. To also remove mail already filed from that account, choose “Also remove the mail Alembic filed from this account” when disconnecting. The cards themselves stay.

You can delete a conversation from its conversation menu. This removes the conversation and its saved output; your jobs and cards stay as they are.

A workspace owner can delete the whole workspace from Settings. After a seven-day window in which the deletion can be cancelled, we remove the workspace's documents and files, its jobs and their extracted data, its conversations with DISTLR, and every connection to another service, including the tokens for it. Its members are anonymised.

Some records outlive a deletion, because we need them to show what happened:

• Billing and usage records — what was charged and used, kept for tax and accounting.
• The activity record — who did what in the workspace, and when. After a workspace is deleted, the IP addresses and browser details in it are removed. This record can include notes and messages from a job's cards; when mail is removed, the record keeps who acted and when, without the message content. Ask us and we will delete the rest within 30 days.
• Our security audit logs — what our own staff did, and when.

Deleting something in Alembic never touches the copies in your own mailbox or in other services you connect. Our database provider keeps a rolling recovery copy for a few hours, after which deleted data cannot be restored.

Third-Party Services

We use the following services to operate Alembic:

• Anthropic — AI document processing and conversation (US)
• OpenRouter — routes requests to Google's Gemini models, OpenAI models through zero-retention endpoints, and our website chat to an open-weight model (US)
• OpenAI — AI document processing and assistance, reached through OpenRouter with zero-retention routing (US)
• Google — the Gemini models, reached through OpenRouter (US)
• xAI — AI assistance for job briefings and running job work (US)
• TypeSafe — fast AI judgments inside a job, for example which card a document or email belongs to, and which passages of a document or email an AI step needs to see; it keeps nothing it receives (US)
• Tavily — web search and web page reading when DISTLR or a job looks something up; it receives the search words and the addresses of pages to read (US)
• Sendblue — text messages (iMessage and SMS) between you and DISTLR, and to the people your jobs message: phone numbers and message text (US)
• Resend — sending email, and receiving mail sent to a job's address (US)
• Vercel — application hosting and file storage (US)
• Neon — managed Postgres database (US)
• Stripe — payment processing and billing (US)
• GitHub — tracking the feedback you send us (US)
• Fastmail — our own support mailbox, if you email us (AU)

We do not sell your data to advertisers, data brokers, or any other third parties.

Connected Accounts

Besides Google, you can connect QuickBooks, DocuSign, Slack and Salesforce. Each connection is optional and approved by you on that service's own consent screen. Alembic reads and writes only what your jobs need, and only through the access you granted: for example, a QuickBooks connection reads customers, invoices, payments and financial reports, and can add a customer. The tokens are encrypted (AES-256-GCM) before they are stored. Disconnecting stops Alembic's access, and you can also revoke it from the other service's own settings. Each service's own privacy policy covers what it holds.

Google User Data

You can choose to connect a Google account to Alembic. Each connection is optional, asks Google only for what that feature needs, and is approved by you on Google's own consent screen. This section explains what Alembic does with the information it receives from Google.

Alembic's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

What we access, and why.

• Sign in with Google — your name, email address and profile picture, to create your Alembic account and sign you in.
• Your email address — whenever you connect Gmail, Google Calendar or Google Sheets, we read the address of the Google account you connected, so you can see which account is connected.
• Gmail: sending — Alembic sends an email from your Gmail address only when you press Send on a message Alembic prepared on a job card, or, if you turn on "Send follow-ups without asking me each time", a follow-up in a conversation that already went out from your address. A first message to someone new always waits for your press. Sending alone does not let Alembic read your mail.
• Gmail: reading replies — only if you also turn on reading. From the moment you connect (never your older mail), Alembic checks each new message in your inbox to see whether it is a reply to a conversation Alembic started from your account. If you turn on "Look for mail about my jobs", it also checks new messages against your open cards. When you ask Alembic about your email, or a job that sends from your address needs to find a card's conversation, Alembic searches your mailbox for that and reads the messages it finds. Alembic may add a label to, archive, or mark as read a message it has filed on a card. It never deletes your email.
• Google Calendar — Alembic reads when your primary calendar is busy or free, and your calendar's time zone, to offer meeting times. It creates an event, with invitations, on your primary calendar when you press Book, and reads back the events it created to confirm them. It does not read the details of your other events.
• Google Sheets — Alembic creates a spreadsheet for a job, or writes to a spreadsheet you choose, adding a row for each finished card with the fields you chose. It does not read the contents of your spreadsheets or of any other file in your Google Drive.

How we use it. We use Google user data only to provide and improve the features you can see and choose in Alembic, as described above. We do not use it to serve advertising, including retargeting, personalised or interest-based advertising. We do not sell it. We do not use it to develop, improve or train generalised artificial intelligence or machine-learning models, and we do not use it to determine credit-worthiness or for lending.

Who else sees it. To carry out a feature you asked for, message text Alembic reads (for example a reply to one of your job emails) is processed over HTTPS by the AI providers listed under Third-Party Services. They process it on our behalf and do not train their AI models on it. If you talk to DISTLR by text message, an answer that quotes your email reaches you through our text-message provider. A message filed on a card becomes part of that job's history, so the people in your workspace who can see that job can read it. We transfer Google user data to no one else, except where the law requires it, to protect the security of Alembic and its users, or as part of a merger or acquisition with your data remaining under these same terms.

People at Alembic. No one at Alembic reads your Google user data unless you ask us to (for example, to help with a support request), it is needed for security purposes such as investigating abuse, or the law requires it.

How it is stored and protected. The tokens Google gives us for your connection are encrypted (AES-256-GCM) before they are stored. Everything else is stored with the rest of your Alembic data, as described in Where Your Data Is Stored.

How long we keep it.

• Connection tokens and settings — until you disconnect the account or delete your Alembic account.
• Mail that does not match a card — not kept. Alembic keeps only Gmail's reference number for the message and whether it matched, so it does not check the same message twice, and deletes that record when you disconnect.
• Mail filed on a card — the sender, subject and text become part of the card's history, and attachments become documents in the job. Deleting the card, the job or the workspace removes them; a record of who acted and when stays, without the message content (see How Long We Keep Your Data).
• Mail Alembic reads to answer you or to work on a card — the passages it used can remain in that conversation's history and in the job's internal work records until the workspace is deleted, or sooner if you ask us.
• Calendar — free and busy times are used to offer times and are not stored. The times offered, and the details of each event Alembic created (its title, time, invitees and link), are kept on the card.
• Sheets — the spreadsheet's name and link, kept until you remove the connection.

Disconnecting and deleting. You can disconnect a Google account at any time: Gmail from Settings › Connections › Gmail, Google Calendar from Settings › Connections (when Gmail and Calendar are both on, they share one connection, and disconnecting either removes both), and Google Sheets from the job's connection settings. Disconnecting deletes the tokens and stops all access immediately; for Gmail it also deletes Alembic's record of which messages it checked. What was already filed on a card stays with the job unless you choose “Also remove the mail Alembic filed from this account” when you disconnect. You can also remove Alembic's access from your Google account at myaccount.google.com/permissions. To have Google user data deleted that you cannot delete in the app, email james@alembictransform.com and we will delete it within 30 days.

Cookies & Analytics

We use session cookies (via BetterAuth) to keep you signed in. We do not use third-party tracking cookies or advertising cookies, and website analytics data is stored in our own database — it is never shared with a third-party analytics service.

Website analytics work in two tiers, and which tier you are in depends on your choice in the consent banner.

If you accept. We set a first-party analytics cookie holding a random identifier, which lets us recognise your browser across visits. Alongside the pages you view we record the referring site, any campaign tags in the link you arrived by, your device type, browser, operating system, and an approximate location — country and region only, never your city, your coordinates, or your IP address. If you later create an account, this browsing history is linked to your account.

If you decline, or have not yet chosen. We still count your visit. This is what the consent banner means by "we count visits either way". Nothing is stored on your device and no cookie is set. Instead, our server derives a short identifier by hashing your IP address and browser user-agent string together with a random key that changes every day. The IP address and user-agent are used to compute that hash and are then discarded — neither is written to our analytics records. We keep each day's random key for two days and then delete it, after which the identifiers made with it cannot be recomputed or traced back by anyone, including us.

In that tier we record the same page, referrer, campaign, device, browser, operating system, country and region information described above. The identifier is pseudonymous, not anonymous: within a single day, visits made by one browser are linked to each other. Across days they are not, and they are never linked to an account.

Global Privacy Control. We respect the GPC signal. If your browser sends GPC we do not track you at all — no cookie is set and no visit is counted, in either tier.

The cookies involved:

• alembic_consent (365 days) — records whether you accepted or declined, so you are not asked again.
• alembic_vid (365 days) — the analytics identifier described above. Set only if you accept.
• alembic_ft (180 days) — remembers how you first arrived, meaning the referring site and any campaign tags, so we can tell which channel led to a signup. Set only if you accept.
• alembic_internal — read by this website, but never set by it. Our own staff set it by hand on their own machines so that their visits can be excluded from our figures.

Declining, or turning analytics off later in your account settings under Preferences, deletes the alembic_vid and alembic_ft cookies from your device and moves you to the cookieless tier described above. It stops an identifier being stored on your device. It does not stop your visits being counted, and it does not delete records already collected.

How long analytics data is kept. Individual visit records — the page-by-page log and the sessions built from it — are retained for 400 days and then permanently deleted. Some analytics records are kept indefinitely and are not covered by that deletion:

• Daily totals — visit counts aggregated by day, page, channel, campaign, country and device type. These carry no visitor identifier.
• First-touch attribution — for accounts, a record of the referring site and campaign tags associated with the first visit that led to the signup.
• Consent records — the identifier the choice was made for, the choice itself, the IP address it was made from, and when. We keep these as the record that a consent decision was actually made.
• Internal summaries — periodic written summaries of the aggregate figures above.

To request deletion of analytics records associated with you, email us at james@alembictransform.com.

Your Rights

• Delete cards, jobs and workspaces from the app, including the mail filed with them
• Disconnect a mailbox and choose whether to remove the mail already filed from it
• Revoke Alembic's access to a connected service from that service's own settings, at any time
• Delete a conversation from its conversation menu
• Delete your entire account from Settings
• Export your extracted data
• Request information about what data we hold — email us at james@alembictransform.com

Contact

For questions about this policy or your data, contact james@alembictransform.com.