Privacy Policy
Last updated: March 2026
1. Data Controller
Alchema is operated by Alchema UG (haftungsbeschraenkt), registered in Germany. For data protection inquiries, please contact us at privacy@alchema.app.
2. Data Processing
We process the following categories of personal data to provide our AI-powered job application services:
- Account data: Name, email address, authentication credentials
- Resume data: Work history, education, skills, and other CV content you provide
- Job application data: Applications submitted, job descriptions, cover letters
- AI interaction data: Prompts and responses from resume tailoring, interview preparation, and cover letter generation
- Usage data: Feature usage, analytics events (with consent)
3. Sub-Processors
In accordance with GDPR Article 13, we disclose the following sub-processors that process personal data on our behalf:
| Sub-Processor | Purpose | Location | Legal Basis |
|---|---|---|---|
| Mistral AI | AI text generation for resume tailoring, cover letters, and interview preparation (sub-processor) | EU (Paris, France) | Legitimate interest (Art. 6(1)(f) GDPR), Data Processing Agreement |
| Neon | Database hosting | EU (Frankfurt, Germany) | Contract performance |
| Vercel | Application hosting | EU | Contract performance |
| PostHog | Product analytics | EU (Frankfurt, Germany) | Consent (Art. 6(1)(a) GDPR) |
| Brevo (Sendinblue SAS) | Transactional and marketing email | EU (Paris, France) | Contract performance, Consent for marketing |
| Sentry | Error tracking and monitoring | EU | Legitimate interest (Art. 6(1)(f) GDPR) |
| Cloudflare | DNS, CDN, and email routing | Global (edge, no data storage) | Legitimate interest (Art. 6(1)(f) GDPR) |
| Hetzner Online GmbH | Infrastructure hosting (automation and PDF services) | EU (Nuremberg, Germany) | Contract performance |
| Stripe, Inc. | Payment processing and subscription management | EU (Dublin, Ireland) | Contract performance (Art. 6(1)(b) GDPR) |
4. Your Rights
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access (Art. 15) — Obtain a copy of your personal data
- Right to rectification (Art. 16) — Correct inaccurate personal data
- Right to erasure (Art. 17) — Request deletion of your personal data
- Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format
- Right to object (Art. 21) — Object to processing based on legitimate interest
- Right to withdraw consent (Art. 7(3)) — Withdraw consent for analytics at any time
To exercise any of these rights, contact us at privacy@alchema.app. We will respond within 30 days.
5. Data Retention
We retain your personal data for as long as your account is active. Upon account deletion, all personal data (resumes, applications, AI interaction history) is permanently deleted within 30 days. Anonymized analytics data may be retained for product improvement purposes.
6. Contact
For all privacy-related inquiries, please contact:
Alchema UG (haftungsbeschraenkt)Data Protection Officer
privacy@alchema.app