Privacy
Privacy policy
Last updated October 11, 2026
Alchemy Collective LLC (“we”, “us”) collects as little as the work needs, says exactly what that is, and does not sell it. This page covers this website and the services we provide to clients.
What we collect on this site
When you request an audit
The form on /start asks for your name, email, website, approximate traffic, the analytics you use and your goal. We store what you submit, with your browser’s user agent, and send ourselves a notification email. We use it to reply to you and to prepare for a conversation — nothing else.
To keep automated spam out, the form uses Cloudflare Turnstile, which checks signals from your browser and connection (including your IP address) to tell people from bots. Cloudflare processes that check; we receive only a pass or fail.
Analytics
We measure how the site is used with Google Analytics 4 and PostHog: pages visited, how you arrived, device and browser type, and approximate location derived from your IP address by those services. PostHog creates a profile of a visitor only when they submit the audit form; reading the site never creates one.
Google Analytics runs with Google signals and ad personalization switched off, so what it measures here is not used for advertising. If your browser sends Do Not Track, none of this loads — no analytics, no testing.
Your choice
If you are in the EEA, the UK or Switzerland, none of the analytics or testing above runs until you accept it in the banner, and declining is as easy as accepting. Elsewhere it runs unless you decline. Either way you can change your mind at any time with Privacy choices at the foot of every page. We work out which applies from the country your connection comes from, and remember the answer and your choice in your browser.
Testing changes to this site
We test improvements to this site with the same testing system we run for clients. When a test is running, it shows you either the current page or the version being tested, and records which you saw and whether you submitted the form. It uses a random identifier stored in a cookie on this site — never your IP address, device fingerprint, or anything you type. Visitors in the EEA, the UK and Switzerland are not included without consent.
Cookies
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Counting visits and sessions | Up to 2 years |
ph_* | PostHog | Counting visits; a profile only after a form submission | Up to 1 year |
_acv | Us | A random id, so a running test shows you the same version each time | Up to 1 year |
ac_consent, ac_consent_region | Us (browser storage) | Your cookie choice, and whether we need to ask | Until you clear it; the region for 30 days |
You can clear or block cookies in your browser; the site works without them.
When you are a client
To audit and test a client’s website we need read access to their analytics (Google Analytics or PostHog), which the client grants and can remove at any time. We use that data only for their engagement. Audits are analyzed with the help of an AI model provider (Anthropic) working on summaries of that data — funnels, rates and session patterns — prepared without names, email addresses or other identifiers.
When a client runs tests on their own site with our testing system, we process their visitors’ data on the client’s behalf, under a data processing agreement, and record only a random visitor id, the version shown and when they converted. Those records are deleted 12 months after the test ends. Questions from a client’s visitors are best sent to that client, who decides how their site is tested; we will help them answer.
Who processes it for us
- Cloudflare — hosting, the audit form’s storage and bot check, and our testing system.
- Google — Google Analytics, and Google Workspace for our email.
- PostHog — product analytics, hosted in the United States.
- Anthropic — AI analysis of client analytics summaries, for client audits only.
Each processes data on our behalf under its own data protection terms. We also disclose information when the law requires it, and it would transfer to a successor if the business were sold or merged.
We do not sell your personal information, and we do not use it for advertising.
How long we keep it
- Audit requests: deleted automatically from our database 12 months after you submit them, and the notification email we received is deleted on the same schedule. If you become a client, what the engagement needs is kept with it instead.
- Analytics: under each provider’s retention settings — for Google Analytics, event-level data for at most 14 months.
- Test records: deleted 12 months after the test ends; results are kept only as totals, with no visitor ids.
Where it is processed
We are based in the United States, and our providers process data in the United States and elsewhere. Where data from the EEA, the UK or Switzerland is transferred, it relies on the safeguards in each provider’s data protection terms.
Your rights
Depending on where you live — including under the GDPR, the UK GDPR and US state laws such as the CCPA — you can ask us to access, correct, delete, restrict or transfer your personal information, or object to how we use it. We will not treat you differently for asking. Emailhello@alchemycollective.com and we will answer within 30 days. You may also complain to your local data protection authority.
Security
We take reasonable measures to protect what we hold — encryption in transit and at rest, access limited to the people who need it, and secrets stored only as hashes where possible. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Children
This site and our services are for businesses, and are not directed at anyone under 16.
Changes
When this policy changes, the date at the top changes with it. Significant changes affecting clients are also sent to them directly.
Contact
Alchemy Collective LLC, New York. Questions about privacy or this policy:hello@alchemycollective.com.