# Privacy Notice Document ID: privacy-notice Version: 0.7-testing Effective: 24 October 2026 Controller for account and website data: AlkhemYst-Ai AS, Asker, Norway Privacy contact: privacy@alkhemyst-ai.cloud AlkhemYst-Ai AS is a Norwegian limited company with its registered address in Asker, Norway. Its registration in the Register of Business Enterprises is in progress, and its organisation number will be added here once assigned. This notice describes the testing service as it operates now. ## 1. Our role AlkhemYst-Ai AS is the controller for account administration, service security, billing administration, contact requests, and the public website. For research and institutional content placed in a workspace, the customer normally decides why and how personal data is used. In that case the customer is the controller and AlkhemYst-Ai AS is its processor. The Data Processing Agreement describes that relationship and is approved by an authorised administrator for each department workspace. ## 2. Data we use ### Accounts and access We use your name, email address, institution, role, password hash, verification status, sign-in records, two-factor settings, and any institutional sign-in identifier. We need this to create and secure the account, perform the service agreement, and manage access. While you use the signed-in service, your browser reports the time zone your device is set to, for example Europe/Oslo. We keep the latest one on your account, with the day it was last seen, and use it to show the platform's operators how many members work from each country and part of the world. Those figures are counts; no individual's location is shown. We do not look up or store your IP address for this. The basis is our legitimate interest in understanding where the service is used. ### Workspace content We store datasets, files, pipeline definitions, run inputs and results, reports, publication records, collaboration records, model cards, AI Act declarations, and audit events created through the service. We process this content on the customer's documented instructions to provide the service. ### Billing We store plan, seat, invoice, payment status, and customer reference information. Mollie handles payment details. We use billing information to perform a paid contract when paid plans open and to meet accounting duties. Raw card numbers do not enter our systems. ### Support and contact We use the name, contact details, institution, and message you choose to send. We do this to answer the request and keep a useful support record. The basis is steps requested before a contract or our legitimate interest in handling service communications. ### Security and audit records We record account, administrative, data, approval, and security events. A record can include the user, institution, action, time, result, and network information needed to investigate misuse. We use these records for security, accountability, legal claims, and compliance. The basis is our legitimate interest and, where applicable, a legal or contractual duty. ### Visit statistics The website and the platform count their own visits. For each page shown, the browser sends one short message to our servers with the page's address (identifiers in it are removed), whether it began the visit, how long it was in view, how many clicks it received, the device's time zone, and, for the first page of a visit, the site that linked to it, the campaign tags the link carried (utm_source and utm_campaign), and whether the window is a phone's, a tablet's or a computer's, judged from its width. From these the service counts how visits arrive: typed, from a link, from another website, or from a campaign. We add these to daily totals by page and country. We keep no visitor or user identifier, no cookie, and no IP address; the address is used only for the moment it takes to limit excessive requests. A browser that sends a Global Privacy Control or Do Not Track signal is not counted. The basis is our legitimate interest in knowing which parts of the service are used, and the totals are kept for 400 days. ### Campaign sources and institutional follow-up If you arrive through one of our campaign links and submit a contact request or register during the same browser visit, we may keep the campaign code with that submission. It identifies the shared link, not a visitor. We count registrations after email verification. The browser keeps this optional code only in memory for the current visit, without cookies or local storage. We respect Global Privacy Control and Do Not Track. Anonymous visit statistics are not joined to account identities or browsing histories. This does not subscribe you to advertising or optional messages. Founders can record an institution, department, research group, business contact source, responsible colleague, next action and factual demo, pilot or customer outcomes. Recorded outcomes are distinguished from measured form submissions and registrations. We use this information to handle institutional conversations and understand which outreach is useful, on the basis of our legitimate interest in business development and responding to research organisations. A contact can object to outreach. We do not use research datasets for marketing, scrape personal profiles, or send automated LinkedIn messages through this workflow. Campaign source information follows the retention of the associated account or enquiry; business follow-up records are reviewed for continued relevance and removed or anonymised when no longer needed, subject to necessary contract and legal records. ### Optional launch or product messages Where a person asks for optional messages, we use the email address for that purpose on the basis of consent. Consent can be withdrawn at any time without affecting earlier processing. ## 3. Information received from others An institution may invite you, create an account through directory provisioning, assign a role, or provide an institutional identity through single sign-on. A collaboration partner may identify you in a shared project. Payment and email providers return delivery, subscription, or payment status. We use this information only for the connected service purpose. ## 4. Required and optional information The registration form marks information needed to create an account. Without it, we cannot provide an account. Optional profile, contact, and integration fields can be left empty. A customer decides which research content to place in its workspace. ## 5. Recipients and locations Access is limited to authorised workspace members and authorised staff who need it for service operation or support. Customer administrators control membership and can review workspace audit records. Current service providers are listed in the public subprocessor register. Primary hosting and database storage are in Frankfurt, Germany. Encrypted backup copies are kept in Gravelines, France. Payment processing is provided by Mollie in the Netherlands when billing is used. Operational email is sent through an EU-hosted service configured by AlkhemYst-Ai AS. The core service is designed to keep customer content in the EEA. A customer can still direct data to a connected external service, such as a repository, identity provider, or code host. The interface must identify that transfer before the customer enables it. The customer is responsible for its chosen destination and permissions. If a transfer outside the EEA becomes necessary for our own providers, we will document the transfer mechanism and safeguards before it begins. ## 6. Retention - Unverified registration records: 30 days after the verification link expires. - Active account and workspace data: while the account or service agreement remains active. - Deleted workspace objects: removed from active systems promptly and from rotating object backups within 30 days. - Database backups: 30-day rolling retention. - Security and audit records: normally 12 months, with longer retention only for an active incident, legal claim, or legal duty. - Device time zone on an account: while the account remains active. - Visit statistics: daily totals for 400 days. - Support requests: 24 months after closure, unless a shorter period is requested and no duty requires retention. - Billing and accounting records: for the period required by Norwegian accounting law. The detailed schedule and deletion owners are kept in the compliance records. An anonymised record may remain where it no longer identifies a person. ## 7. Automated processing and AI The platform uses AI-assisted features to prepare code, text, and analysis. It does not use private workspace content to train general-purpose or third-party models. The service does not make a solely automated legal or similarly significant decision about account users. A human approval is required for listed consequential actions. Customers decide how they use outputs inside their own research or operations. They must not use the service as the sole basis for a significant decision about a person. ## 8. Your rights Depending on the situation, you can ask for access, correction, deletion, restriction, portability, or an objection to processing based on legitimate interests. You can withdraw consent at any time. You can also complain to the Norwegian Data Protection Authority, Datatilsynet, or another competent EEA supervisory authority. Send a request to privacy@alkhemyst-ai.cloud. We may need to confirm your identity. If the request concerns research content controlled by your institution, we will refer the request to that institution and assist it as processor. ## 9. Security We use encrypted transport, role-based access, tenant isolation, restricted execution, backups, monitoring, and audit records. Security measures are reviewed against risk. A security incident is handled under the breach response procedure. ## 10. Cookies and browser storage The service does not use advertising cookies or third-party analytics. Its visit statistics are counted by the service itself without cookies or browser storage (section 2). It uses browser storage for the signed-in session and interface preferences. The current session design uses a bearer token in local storage. Moving the session to a secure, HttpOnly cookie is a release gate for paid service because it reduces the effect of a browser script compromise. Friendly Captcha is loaded and contacted only where bot protection is configured. Its EU verification endpoint is used and the server does not send the visitor's IP address to the verification request. The browser may contact the published SDK host to load the widget. Self-hosting that SDK is a paid-release gate. ## 11. Contact and complaints Privacy requests: privacy@alkhemyst-ai.cloud Security reports: security@alkhemyst-ai.cloud General contact: contact@alkhemyst-ai.cloud No data protection officer has been appointed. The documented DPO assessment must be reviewed before paid service opens and whenever processing changes materially. ## 12. Changes We publish a version and date for this notice. Material changes are announced before they take effect where required. The notice version and content hash shown at registration are recorded as evidence that the notice was provided. A privacy notice is information, not a request for consent to processing that does not rely on consent. Version 0.5-testing (21 October 2026) adds to the visit statistics the campaign tags of the link a visit arrived from and the kind of device, by window width (section 2). Version 0.4-testing (21 October 2026) added the device time zone kept on an account and the service's own visit statistics (section 2, section 6, section 10). Versions 0.3-testing and 0.4-testing remain published for reference.