Privacy Policy

Who we are

Alchemy Rewire is operated by Alchemy Rewire - F.Z.C., a free-zone company registered in the United Arab Emirates (“we”, “us”), whose registered office is Office C1-1F-SF8278, Ajman Free Zone C1 Building, Ajman, United Arab Emirates. We are the data controller for the personal data described here. For any privacy question or to exercise your rights, contact privacy@alchemyrewire.com.

The data we collect

• Account data, your name, email, and password (stored only as a secure hash).
• Practice data, which courses you own, your progress, and completion records.
• Special-category health data (GDPR Article 9), optional inputs such as mood check-ins, Control Pause / CO₂ measurements, and subjective state ratings. We process these only with your explicit consent, and never for any purpose you have not agreed to.
• Payment data, handled by our payment processor (Stripe). We never see or store your full card details; we keep only a customer reference and your purchase record.
• Technical & usage data, limited, consent-gated analytics about how the site is used. We do not put raw health values into analytics.
• Mobile app data, if you use the Alchemy Rewire app: which lessons you open and finish, so your progress and streak work; the courses you have downloaded, which are stored on your own device and not sent to us; and a short technical log kept only on your device so you can send it to us if something breaks. That log is cleared when you close the app, holds no passwords or payment details, and reaches us only if you choose to copy and send it. The app does not use advertising identifiers, does not track you across other companies’ apps or websites, and contains no third-party analytics or advertising SDKs.

Why we use it (lawful bases)

• To provide the service (account, access to what you own, progress), performance of our contract with you.
• Health data, your explicit consent, recorded and withdrawable at any time. Withdrawing consent stops further processing for that purpose.
• Payments and record-keeping, to fulfil your purchase and meet legal accounting obligations.
• Marketing email, only if you opt in; you can unsubscribe at any time.

Where your data lives (EU residency by design)

Our database and authentication run on Supabase in the EU (Frankfurt, Germany). We choose EU-resident or DPA-covered processors. Our current processors include:

• Supabase (EU), database, authentication, and file storage.
• Stripe, payment processing.
• Klaviyo, transactional and (opt-in) marketing email.
• Vimeo / Cloudflare, video hosting and delivery.
• Apple, for purchases made inside the iPhone app. Apple is the seller for those transactions and processes the payment itself — we never see your card details. Apple tells us only that a purchase or renewal happened, and gives us an anonymous transaction identifier we store to link it to your account.
• Cloudflare Turnstile, the “I am human” check on sign-in and sign-up, which exists to keep automated signups out.
• Hosting & analytics, our site host and a privacy-focused, EU-hosted analytics provider (consent-gated).

Where a processor transfers data outside the EEA, that transfer is covered by appropriate safeguards (e.g. Standard Contractual Clauses).

How long we keep it

• Account, practice, and purchase records, for the life of your account.
• Mood check-ins and similar lightweight health logs, minimised; older entries are deleted on a rolling basis.
• Invoices and payment records, retained for the period required by law (accounting obligations), even after account deletion.

Your rights

Under the GDPR you can access, correct, export, restrict, or erase your personal data, and withdraw consent at any time. We have built these into the product:

• Export, download everything we hold about you, from your profile settings.
• Erasure, delete your account and associated data in one action, from your profile settings on this website or from Settings › Delete account in the app. Legally required financial records are retained as above, with your identity removed from them. If you have an active subscription through Apple you must cancel it with Apple first — we cannot, and deletion will ask you to do that before it proceeds. What deletion covers in full is set out on our account deletion page.
• Consent, grant or withdraw health-data and marketing consent from your profile at any time.

You also have the right to lodge a complaint with your local data protection authority.

Cookies & analytics

We use only the cookies needed to run the site (e.g. keeping you signed in) plus, if you consent, privacy-focused analytics to understand how the site is used. You control non-essential cookies and analytics from the consent banner and your profile, and we never place raw health values into analytics.

Children

The service is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes

We will update this policy as the platform evolves and post the revised date above. Material changes affecting health-data processing will be brought to your attention and, where required, re-consented.