Privacy Policy

Alembic is operated by James McArthur as a sole proprietorship. This policy explains how we collect, use, and protect your information when you use Alembic ("the Service").

What We Collect

When you create an account, we collect:

• Account information — your name, email address, and a hashed password (or Google OAuth credentials)
• Documents you upload — PDFs, DOCX files, and images submitted for extraction
• Extracted data — structured fields, values, and metadata produced by our AI pipeline
• Usage data — which features you use, document counts, and processing metrics (for billing and service improvement)
• Push notification subscription data — endpoint URLs and encryption keys, stored solely for delivering web push notifications to your device

How Your Documents Are Processed

When you upload a document — or submit one via email — it is sent to a third-party AI provider (Anthropic or OpenAI, depending on your space's model configuration) over HTTPS for AI-powered extraction. Neither provider uses API data for model training. Your document content is not retained by the provider beyond the processing window. We never use your documents to train our own models.

Where Your Data Is Stored

• Database — Neon Postgres, hosted in the US, encrypted at rest
• File storage — Vercel Blob, hosted in the US, encrypted at rest
• All data transmitted over HTTPS (TLS encryption in transit)

How Long We Keep Your Data

Your documents and extracted data remain in the system for as long as your account is active. You can delete individual documents or entire spaces at any time from the app — deleted data is permanently removed from our systems. If you delete your account, all associated data is permanently removed.

Third-Party Services

We use the following services to operate Alembic:

• Anthropic or OpenAI — AI document processing, depending on your space's model configuration (US)
• Vercel — application hosting and file storage
• Neon — managed Postgres database
• Stripe — payment processing and billing
• Resend — transactional email delivery
• Fastmail — email inbox management for inbound document emails (AU)

We do not sell your data to advertisers, data brokers, or any other third parties.

Cookies & Analytics

We use session cookies (via BetterAuth) to keep you signed in. We do not use third-party tracking cookies or advertising cookies.

With your consent, we use a first-party analytics cookie to understand how visitors use our website. This data is stored in our own database — it is never shared with third-party analytics services. You can opt out at any time through the consent banner or in your account settings under Preferences.

The analytics visitor cookie persists for up to 365 days.

We respect the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we will not set analytics cookies.

Analytics data is retained for 90 days and then permanently deleted.

Your Rights

• Delete any document or space from the app at any time
• Delete your entire account from Settings
• Export your extracted data
• Request information about what data we hold — email us at james@alembictransform.com

Contact

For questions about this policy or your data, contact james@alembictransform.com.