Privacy Policy

Last updated: 7 September 2026

Who we are

This policy covers the Web Alchemy client portal at portal.webalchemyhq.com and explains how we collect, use and protect personal data when you use it as a client, a prospective client, or a member of our team.

The data controller is Web Alchemy HQ Limited (company number 07653975), registered address 210, 12 Manestys Lane, Liverpool, Merseyside, L1 3DT. For anything in this policy, contact us at nick@webalchemyhq.com.

What data we collect

Depending on how you use the portal, we hold:

• Account details: your name, work email, role, and profile photo if you add one.
• Business contact data: your company’s name, billing/contact email and phone number, and the package you’re subscribed to.
• Enquiry/lead data: if you’ve enquired about our services but aren’t yet a client, we hold the contact details and notes from that enquiry.
• Project data: tasks, comments, approvals, checklists and any files or attachments you or we upload while working together.
• Financial data: invoices, expenses, billing schedules, contracts and proposals relating to our engagement with you.
• Meeting data: scheduled meeting times, video call links, and recording links where a meeting is recorded.
• Marketing performance data: reporting on your own campaigns (e.g. Google Analytics, Meta Ads, email/WhatsApp campaign statistics) that we display back to you in the portal.
• Technical data: login timestamps and the strictly-necessary session cookie that keeps you signed in. We don’t use advertising or tracking cookies on the portal.

Where it comes from

Most of this comes directly from you - through forms in the portal, or work carried out under our engagement with you. If you choose to sign in with Google or Microsoft 365 instead of a magic-link email, we receive only your name, email address and profile photo from that provider to identify you - we never request or access your Gmail, Google Drive, Outlook mail, or OneDrive contents through this sign-in.

Why we use it, and our legal basis

• Performance of a contract: to deliver the marketing services you’ve engaged us for, and to give you access to your own reporting, invoices and project status.
• Legitimate interests: to run, secure and improve the portal, and to follow up on enquiries from prospective clients.
• Legal obligation: to keep financial records for accounting and tax purposes.

Who we share it with

We use the following processors to run the portal. None of them are permitted to use your data for their own purposes, and we never sell personal data to anyone.

• Supabase - hosts our database and handles sign-in.
• Vercel - hosts the portal application itself.
• Resend - sends transactional emails (invoices, updates, sign-in links) on our behalf.
• Google / Microsoft - only if you choose to sign in with one of these, solely to verify your identity.
• Calendly - if you book a call with us through the portal.

Some of these providers may process data on servers outside the UK. Where that happens, they do so under standard contractual clauses or an equivalent legally-recognised safeguard.

How long we keep it

We keep your data for as long as we’re working together, and afterwards for as long as needed to meet our legal and accounting obligations (typically up to 6 years for financial records), after which it’s deleted or anonymised.

Your rights

Under UK GDPR, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that’s inaccurate or incomplete;
• delete your data, or restrict how we use it, in certain circumstances;
• provide your data in a portable format; or
• stop processing data we hold on the basis of legitimate interests.

To exercise any of these, email nick@webalchemyhq.com. If you’re unhappy with how we’ve handled your data, you can also complain to the UK’s Information Commissioner’s Office at ico.org.uk.

Security

Data in the portal is encrypted in transit, access is restricted by role (client accounts can only see their own company’s data), and we use industry-standard hosting providers to store and process it.

Children

The portal is a business tool for our clients and isn’t directed at, or intended for use by, children.

Changes to this policy

We may update this policy from time to time; the date at the top shows when it was last revised.