Privacy & Cookie Policy

Like Alchemy LLC | Last updated: April 4, 2026

1. Who we are

Like Alchemy LLC (“Like Alchemy,” “we,” “us” or “our”) is a talent management and influencer marketing agency registered as a limited liability company in Wyoming, United States. We operate this website (likealchemy.co), our creator management platform and associated tools (together, the “Services”).

We act as the data controller for the personal data we process through the Services.

Contact us: Email: execs@likealchemy.co

If you are in the UK, you also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk.

2. What this policy covers

This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have. It applies to everyone who uses or visits our Services, whether you are a creator on our roster, a brand partner, or a general visitor to our website.

We are based in the US but work with creators and brands in the UK. This policy is written to comply with:

• United States: the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and the comprehensive privacy laws now in force across twenty US states, together with COPPA and CAN-SPAM.
• United Kingdom: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) as amended by the Data (Use and Access) Act 2025 (DUAA).
• Meta Platform Terms: as a registered developer accessing the Instagram Graph API.

3. What personal data we collect

Data you give us directly

• Account and onboarding data: your name, email address, phone number, social media handles, website URL, bio, profile photo, rate card, content categories and collaboration preferences.
• Communications: messages you send us by email, through our contact form or via the platform, including support requests and partnership enquiries.
• Payment data: billing name and address, and payment details processed by our third-party payment processor. We do not store full card numbers on our systems.
• Brand partner data: if you are a brand, we collect your contact name, company, email and campaign brief details.

Data we collect through Instagram and social media integrations

When a creator authorises our platform to connect to their Instagram account (or another supported platform) via the official API, we receive:

• Profile data: username, profile picture, account type, follower count and biography.
• Content performance: impressions, reach, engagement rate, likes, comments, shares, saves and video views at the post, Reel and Story level.
• Audience insights (aggregated only): age range, gender split, location (city and country) and active hours — all provided by Meta in aggregated form that cannot identify individual followers.
• Account trends: follower growth, profile views, website clicks and interaction patterns.

What we do not collect: we never receive individual follower lists, direct messages, private email addresses of followers, or any data that identifies a creator’s individual followers. All audience demographic data from the Instagram Graph API is aggregated at source by Meta.

Data collected automatically when you visit our website

• Device data: device type, operating system, browser type and screen size.
• Usage data: IP address, pages visited, time spent, referring URL and actions taken on the site.
• Approximate location: inferred from your IP address. We do not collect precise geolocation.
• Cookies: see Section 10 below.

Data we receive from third parties

• Social media platforms via authorised API connections (as described above).
• Brand partners who provide information in connection with campaigns.
• Service providers who supply analytics and operational data.

4. Why we use your data and our legal basis

We use your data for the purposes listed below. For UK users, we have identified the lawful basis under UK GDPR Article 6 for each purpose.

Where we rely on consent, you can withdraw it at any time by emailing us or using the relevant control in your account. Withdrawal does not affect anything we did lawfully before you withdrew.

Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You can ask us for details of this assessment at any time.

5. How we share your data

We do not sell your personal data. We do not share your data for behavioural advertising.

We may share your data in the following circumstances:

With your consent. The core of our business is connecting creators with brands. When a creator authorises us to pitch them to a brand, we share relevant information — which may include the creator’s media kit, rate card, audience demographics (aggregated) and content performance data — with that brand. We only share what you have agreed to share, and you can withdraw that authorisation at any time.

Service providers. We use third-party providers for hosting, email delivery, payment processing, analytics and CRM tools. Each provider is bound by a written contract (and, for UK data, a UK GDPR Article 28 data processing agreement) restricting them to processing data only on our instructions.

AI-assisted tools. We use AI services (including tools built on third-party AI platforms) to assist with communication, content analysis and workflow automation. Where personal data passes through these tools, the providers are treated as subprocessors and bound by the same contractual restrictions as our other service providers.

Legal and regulatory. We may disclose data where required by law, regulation, court order or government request in the US or UK, or to protect rights, safety or property.

Business transfers. If Like Alchemy is acquired, merged or sells substantially all its assets, your data may transfer as part of that transaction. We will notify you in advance.

Aggregated data. We may share data that has been aggregated or de-identified so that it cannot identify any individual — for example, industry benchmarks or average engagement rates by content category.

6. Instagram Graph API — specific commitments

Our platform connects to Instagram’s Graph API under Meta’s Platform Terms. We make the following specific commitments:

• We access a creator’s Instagram data only after they complete Meta’s OAuth 2.0 authorisation flow and affirmatively grant each requested permission.
• We request only the minimum permissions needed to provide our services (typically: instagram_basic, instagram_manage_insights and pages_read_engagement).
• We use API data only for the purposes described in this policy: analytics dashboards, media kits, pitch materials, performance reports and talent management.
• We do not sell API data, transfer it to data brokers, use it for surveillance or profiling, attempt to identify individual followers from aggregated data, or use it to build advertising profiles outside our platform.
• Upon revocation of access or account deletion, we delete or anonymise all API data within 30 days, except where retention is required by law.
• Any subprocessor accessing API data is contractually bound to Meta’s Platform Terms.
• We retain all published versions of this policy and will provide them to Meta on request.

A creator can revoke API access at any time through their Like Alchemy account settings or directly through their Instagram app settings.

7. International data transfers

Like Alchemy is based in the United States and serves users in the United Kingdom. Your data may be transferred between these countries.

UK to US transfers. Where we transfer personal data from the UK to the US, we put appropriate safeguards in place as required by the UK GDPR. These may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where applicable.

Subprocessors. Some of our service providers operate outside the US and UK. A list of subprocessors and their locations is available on request by emailing execs@likealchemy.co.

8. How long we keep your data

When the retention period expires, we securely delete or irreversibly anonymise the data.

9. Your rights

Everyone

Regardless of where you are, you can:

• Access a copy of the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data (subject to legal exceptions).
• Opt out of marketing emails at any time.
• Disconnect your Instagram account at any time.

If you are in the UK

Under the UK GDPR, you also have the right to:

• Restrict processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Object to processing based on legitimate interests. If you object to direct marketing, we stop immediately.
• Not be subject to solely automated decisions that produce legal or significant effects, and to obtain human review where such decisions occur.
• Complain to the ICO at ico.org.uk.
• Complain directly to us (from 19 June 2026 under the DUAA) — we will acknowledge your complaint within 30 days.

If you are in the US

• California (CCPA/CPRA): you have the right to know, delete, correct, and opt out of sales/sharing. We honour Global Privacy Control (GPC) signals as valid opt-out requests.
• All other states with comprehensive privacy laws: you have substantially similar rights. Where your state requires recognition of universal opt-out mechanisms, we honour GPC. You may appeal a denial of your request by emailing execs@likealchemy.co with the subject line “Privacy Appeal.”

How to make a request

Email execs@likealchemy.co with the subject line “Privacy Rights Request” or use the settings in your Like Alchemy account. We will verify your identity and respond within one month (UK) or 45 days (US), with extensions as permitted by law. You may appoint an authorised agent to act on your behalf.

Opt-out options

• GPC / Do Not Track: we detect and honour these browser signals.
• “Do Not Sell or Share My Personal Information”: link available in the website footer.
• Email marketing: one-click unsubscribe in every email.
• Instagram access: revoke via your account settings or the Instagram app.
• Cookies: manage via our cookie banner or your browser settings.

10. Cookies

What cookies are

Cookies are small text files stored on your device by websites you visit. “Similar technologies” includes pixels, local storage, web beacons and SDKs.

Cookies we use

Strictly necessary cookies Required for the website to function — session management, authentication, security and load balancing. These cannot be switched off.

Analytics cookies Help us understand how people use the site so we can improve it. We use privacy-focused analytics that minimise personal data collection.

• UK users: Since 5 February 2026, analytics cookies used solely for aggregate service-improvement statistics are exempt from prior consent under the DUAA amendments to PECR, provided we clearly explain their use and offer an easy opt-out. We do both.
• US users: We obtain consent where required by state law and honour GPC/DNT signals.

Functional cookies Remember your preferences (language, layout, display settings). Under the DUAA, these are also exempt from prior consent in the UK, subject to the same disclosure and opt-out conditions.

We do not use advertising or third-party tracking cookies. We do not serve ads on our website.

Cookie duration

• Session cookies expire when you close your browser.
• Persistent cookies last between 30 days and 12 months, or until you delete them.

Managing cookies

You can control cookies through our cookie banner (which provides category-level controls) or your browser settings. You can withdraw consent at any time, and we make withdrawal as easy as the original consent. Blocking strictly necessary cookies may stop parts of the site from working.

11. Data security

We protect your data with appropriate technical and organisational measures, including:

• Encryption in transit (TLS 1.2+) and at rest.
• OAuth 2.0 for Instagram API authentication.
• Regular security testing.
• Role-based access controls.
• Secure credential storage (never in version control).
• Documented incident-response procedures.

UK breach notification: if a breach is likely to risk your rights, we will notify the ICO within 72 hours and, where the risk is high, notify you without undue delay.

No system is 100% secure. If you believe your account has been compromised, contact us immediately at execs@likealchemy.co.

12. Children

Our services are not directed at anyone under 13. We do not knowingly collect data from children under 13 (the minimum age under both US COPPA and UK DPA 2018).

For users aged 13–17, we apply enhanced protections consistent with COPPA, the California Age-Appropriate Design Code, applicable US state youth-protection laws and the UK Children’s Code. We do not target advertising at, profile, or sell data relating to known minors.

13. Third-party links

Our website may link to third-party sites including Instagram and other Meta products. We are not responsible for their privacy practices. Please review their policies separately.

14. Changes to this policy

We may update this policy from time to time. If changes are material, we will notify you by email or by a notice on the website. Continued use of the Services after the updated policy takes effect constitutes acceptance. We keep all prior versions and will provide them on request.

15. CCPA disclosure summary

This section is for California residents (and residents of other US states with similar disclosure requirements).

Categories of personal information collected in the past 12 months:

Sources: directly from you; automatically through your use of our services; from social media platforms via authorised APIs; from brand partners.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not collect sensitive personal information as defined by the CCPA. We do not offer financial incentives related to personal information.

16. UK GDPR lawful basis summary

This section is for UK data subjects.

© 2026 Like Alchemy LLC. All rights reserved.

If you have any questions about this privacy policy, please contact us as execs@likealchemy.co