Privacy Policy

The Alchemy of Change is operated by People and Transformational HR Ltd ("PTHR Ltd", "we", "us", "our"). PTHR Ltd is the data controller for personal information processed through the service. Contact us at tools@pthr.co.uk.

Registered company number: 8748033
Registered office: 45 Oxford Street, Wellingborough, Northamptonshire, NN8 4JH

Account details: your first name, last name and email address, a unique user ID, and the date you joined.

Sign-in: your password is handled by our authentication provider (see "Who we share information with"). It is stored only in hashed form and we can never see it. When you sign in, a session token is kept in your browser so you stay logged in.

Basic activity: when you last signed in and were last active, plus a short log of two events: each sign-in, and each time you save a reading (recording which spread and which cards were drawn, but not anything you wrote).

Security and access logs: like most online services, our hosting and sign-in providers keep basic technical logs, which may include your IP address and browser or device details. These are used to keep the service secure and working.

Marketing preference: whether you have opted in to emails from us, and when you opted in or out.

What we do not collect: we do not use analytics or advertising cookies, and we do not track you across other websites.

Your journal entries, readings, intentions, reflections, insights and commitments are stored only in your own browser. They are not saved on our servers and we cannot view them. If you clear your browser data or change device they cannot be recovered, unless you have exported them as a PDF.

The one exception is when you choose to use the Polymorphic Lens, described below.

When you ask the Polymorphic Lens for a reflection, the content of that journal entry is sent to generate the response: the spread, the cards drawn, and the intention, reflections, insights, commitments and experiments you wrote. Your name and email are not included in what is sent to the AI model.

The Polymorphic Lens uses Google's Gemini model through Lovable AI. Only the information needed to generate the reflection you asked for is sent. Under the provider's current terms for the way we use it, Google does not retain your prompts or responses and does not use them to train models. Lovable, which passes the request on, may keep technical records of each request (such as time and usage) to run and bill its service.

The response is shown to you and kept only in your browser; we do not store your submitted text or the response in our database.

Please do not enter confidential information, or personal information about other people, unless you are comfortable with it being processed in this way.

To create and run your account, sign you in and provide the service (including AI reflections you request) — contract: we need this to provide the service you signed up for.

To keep the service secure, detect misuse and fix technical problems — legitimate interests: keeping accounts and the platform safe and working.

To help with support requests (for example, if you cannot sign in) — legitimate interests: being able to answer your questions using your account and activity records.

To understand, at a basic level, how the service is used (sign-ins and saved readings) — legitimate interests: improving the Alchemy of Change.

To send marketing emails — consent, only if you have opted in. We do not sell your data.

Creating an account does not sign you up to marketing. We will only send occasional emails about the Alchemy of Change, related consultancy, events and offers if you have ticked the optional box when signing up or turned it on in your Account page. You can switch it off at any time on your Account page or by emailing us.

Lovable (hosting, and the sign-in and account database through Lovable Cloud, which is built on Supabase; pages are delivered via Cloudflare): hosts the app and stores your account details, activity log and marketing preference, handles your password and sends account emails such as password resets. It acts as our processor.

Lovable AI Gateway and Google (Gemini): process the journal content you send to the Polymorphic Lens, only when you use it, to generate a response.

Our typefaces are served from our own site, so visiting Alchemy of Change does not send your IP address to Google or other font services.

Some of our service providers may process personal information outside the UK. Where this happens, appropriate safeguards are used in accordance with UK data protection law, as set out in those providers' data processing terms.

We keep your account details, activity log and marketing preference while your account is open. When an account is deleted, your profile, activity log and sign-in record are removed from our database straight away. Residual copies may remain for a limited time in our providers' backups or technical logs, and are removed on those providers' normal deletion cycles. We may keep limited information where the law requires it, or where it is needed for legal, security or dispute-resolution purposes. Journal content in your browser is never held by us; you control it.

We only use storage that the app needs to work: a sign-in session token, your journal (stored in your browser's local storage), and a small timer used to update your "last active" time. We do not use analytics, advertising or tracking cookies.

Under UK data protection law you have the right to:

• be told how your information is used (this policy);
• get a copy of your information;
• have inaccurate information corrected;
• have your information deleted — you can delete your account yourself on your Account page;
• restrict or object to how we use your information, including at any time for marketing;
• receive your information in a portable format;
• not be subject to decisions made solely by automated means that significantly affect you — we do not make any such decisions.

Some rights depend on the circumstances and the legal basis we rely on. To make a request, email us. We will respond within one month, subject to the UK GDPR rules, which allow this to be extended in some circumstances.

Please contact us first if you have a concern. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

For any privacy question or request, contact PTHR Ltd at tools@pthr.co.uk.