Privacy Policy
This Privacy Policy explains how Alchemy Data SRL (“we”, “us”, or “our”) collects, uses, stores, and shares your personal data when you use our AI literacy learning platform (the “Platform”), and describes your rights under applicable data protection law, including the EU General Data Protection Regulation (GDPR) and Romanian Law no. 190/2018.
1. Who We Are (Data Controller)
Alchemy Data SRL
Str. Judetului Nr. 1, Bl. 1, Ap. 806, Sector 2, Bucharest, Romania
VAT ID: RO44359600
Email: privacy@alchemygroup.net
2. What Personal Data We Collect
2.1 Data you provide to us
- Account and identity data: Your name, email address, and password (stored in hashed form).
- Profile data: Optional information such as professional background or prior AI knowledge level.
- Communications: Messages you send us via contact forms, email, or support channels.
2.2 Data generated through your use
- Learning activity data: Progress, quiz responses, learning path selections, completion rates.
- AI interaction data: Prompts and queries you submit to AI features and responses generated. Not used to train AI models.
- Technical data: information our hosting provider records when you use the Platform (for example request logs with your IP address), used to keep the service secure and working. Where we use your IP address to limit abuse of the contact form, we store only a one-way hash of it.
- Usage and analytics data: Navigation patterns, session duration, feature usage.
2.3 Data we do not collect
- We do not collect sensitive personal data (GDPR Article 9) unless voluntarily disclosed.
- We do not collect data about children under 18.
- We do not use your data to train or fine-tune any AI model.
3. How We Use Your Personal Data
We process your personal data only where we have a lawful basis under GDPR Article 6. Key purposes include: account management, delivering learning content, personalising your journey, responding to support requests, platform security, and analytics.
4. AI-Specific Data Processing
The Platform uses Anthropic Claude models via AWS Bedrock to generate content and personalise learning. Your data is not used by Amazon or Anthropic to train their models. AI personalisation constitutes an automated recommendation — not a decision with legal effects.
You can turn personalisation off in your profile (“Use generic (non-personalised) content”); see our AI Compliance notice, §8.
5. Cookies and Tracking
We currently do not use cookies beyond those strictly necessary for authentication. See our Cookie Policy for details.
6. How We Share Your Data
We do not sell your personal data. We share data only with our service provider Amazon Web Services (hosting, AI model inference through AWS Bedrock, and email delivery), when required by law, in a business transfer, or with your consent.
7. International Transfers
When transferring data outside the EEA, we ensure safeguards such as EU Standard Contractual Clauses or adequacy decisions.
8. Data Retention
- Account and learning data (your profile, progress, exercise answers and completion records) are kept while your organisation uses the Platform. When your organisation leaves, or when you ask us, we first provide your organisation with an export of its learning records (its evidence of AI-literacy training) and then erase the data, within one month of the request (our target is 14 days).
- AI-generated lesson content is deleted automatically 90 days after it was generated.
- Usage records (counts of AI processing used, for cost accounting) are kept; when your data is erased, the link to you is removed from them.
- Records of administrative actions (for example an administrator inviting or removing a member) are kept for 24 months for accountability, identified only by an internal user number.
- Backups expire within 35 days.
- Messages you send us by email are kept for as long as needed to handle them.
9. Your Rights Under GDPR
You have rights of access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making. Contact privacy@alchemygroup.net to exercise these rights.
We aim to respond within 14 days and in any case within one month (extendable by two further months for complex requests, in which case we will tell you why).
10. Children's Privacy
The Platform is not intended for persons under 18. We do not knowingly collect data from children.
11. Security
We implement appropriate technical and organisational measures including encryption, access controls, and regular security assessments.
12. Changes to This Policy
We will notify you of material changes at least 30 days before they take effect.
13. Contact
Alchemy Data SRL
Str. Judetului Nr. 1, Bl. 1, Ap. 806, Sector 2, Bucharest, Romania
Email: privacy@alchemygroup.net