Effective date: July 3, 2026 · Last updated: October 9, 2026
Ghosts ("we," "us") provides an AI writing and content optimization platform at ghosts.app (the "Service"). This Privacy Policy explains what information we handle, why, and what your choices are. It applies to visitors to our site, account holders, and members of workspaces on the Service.
Two roles matter here, and we want them clear in plain words. For your account, billing, and usage data, we decide how and why it is processed: in privacy-law terms, we are the controller. For the content you and your team put into the Service and the drafts it produces ("Customer Content"), you are in charge: we process that content only to provide the Service to you, as your processor. Business customers who need a data processing agreement can request one from us.
Account information. Name, email address, password (stored as a hash), and optional profile details such as company name and website.
Customer Content. The briefs, notes, links, and materials you submit, and the drafts, revisions, and reviews the Service generates in your workspaces. Customer Content is isolated per workspace and, within agency and law-firm workspaces, per client project.
Website contact-form enquiries. If you fill in the contact form on a website one of our customers runs on Ghosts, the customer is the controller of what you send and Ghosts is its processor, acting on the customer's instructions. We store your submission (your name, email address, phone number, message, any other answers on the form, and the page you were on) in the customer's Leads list and email it to the addresses the customer has chosen. Our email provider, Resend, keeps its own copy for a limited time (see the subprocessor list), and each recipient's mailbox keeps a copy for as long as they keep it. Those copies are outside Ghosts, so if an enquiry is deleted from the Leads list, the emails already sent cannot be recalled.
Billing information. Plan, seats, credit balance, and a usage ledger. Payments are processed by Stripe; we receive transaction metadata (amounts, last four digits, card expiry) but never your full card number.
Usage and log data. IP address, browser type, pages viewed, and actions taken, used for security, debugging, and capacity planning.
For readers in the EU and UK, we name the lawful basis alongside each purpose:
When you request a draft, the relevant parts of your brief and workspace context are sent to the AI providers listed in Section 4 to generate the text, and to OpenAI's API to create embeddings that power search and retrieval within your workspace.
Your Customer Content is never used to train AI models, not ours and not our providers'. That is our own policy, and it is backed by our commercial agreements: Anthropic's commercial terms prohibit training on customer content submitted through the API, OpenAI's API terms do not use API data for training by default, Cloudflare's Workers AI terms bar it from using customer content to train models or to improve its own or third-party services, and requests we route through OpenRouter (including to Moonshot AI's Kimi models) run under OpenRouter's default data policy, which sends them only to model providers that do not train on them.
Our AI providers may retain API inputs and outputs for a limited period for trust-and-safety purposes, up to 30 days, after which they are deleted. When you enable research, your topic terms are sent to a web search provider and the Service fetches publicly available pages to ground the draft's citations.
We do not sell your personal information. We share it only with the service providers below, each bound by contract to use data solely to provide its service to us:
The current list, with roles and locations, is maintained at ghosts.app/legal/subprocessors. We give customers notice before adding a new subprocessor. Beyond these providers, information is visible to members of your own workspace according to their roles, may be disclosed if required by law or to protect the rights, safety, or property of Ghosts, our users, or the public, and may transfer in a merger, acquisition, or sale of assets, subject to this Policy.
Account and billing data. Kept while your account is active, then deleted or de-identified within a limited period after closure, except for billing ledger records we must keep for accounting and tax purposes.
Customer Content. You control it. Content you delete is removed from active systems immediately. On the Law Firms plan, your firm sets its own retention schedule per draft status, from 24 hours to 1 year, after which content is hard-deleted, including every revision, on an automated hourly cycle.
Backups. Deleted data leaves our encrypted backups within 30 days as backup cycles expire.
Legal holds. All deletion commitments are subject to one exception: where law or a court order requires us to retain data, we retain it, isolate it from any further processing, and delete it when the obligation ends.
We are based in the United States and our infrastructure is hosted there. If you use the Service from outside the US, your data is transferred to the US. Where required, transfers from the EU, UK, and Switzerland are protected by Standard Contractual Clauses, and we rely on our vendors' Data Privacy Framework certifications where they hold them.
If you are in the EU, UK, or another jurisdiction with similar laws, you have the right to access, correct, export, and delete your personal information, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You also have the right to complain to your local data protection authority. We respond to requests within one month.
If you are in the United States, we honor the same requests voluntarily, whether or not a state privacy law applies to you. You can handle most of this directly in your account settings, or email [email protected]. We never discriminate against you for exercising your rights.
One note on Customer Content: where we act as a processor, requests about content inside a customer's workspace go to that customer (the controller), and we assist them in responding. The same goes for what a visitor sent through a customer's website contact form: ask the business whose website it was.
We do not sell or share personal information as those terms are defined in US state privacy laws, and we run no third-party advertising trackers or behavioral pixels on the Service. The only cookies we use are essential ones for authentication and session security.
Customer Content is encrypted in transit and at rest. Every workspace is isolated at the database layer with per-tenant row-level access controls, and access within a workspace is governed by member roles. No human at Ghosts reviews your prompts or drafts by default: drafting runs through an automated pipeline. If you ask our support team for help that requires looking at your content, we access it only with your permission, and that access is logged. No method of transmission or storage is completely secure; we encourage strong, unique passwords.
If a security incident affects your personal information or Customer Content, we will notify affected customers without undue delay, and in any event within 72 hours of confirming the incident, with what we know, what we are doing, and what you can do.
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
We may update this Policy from time to time. Material changes are announced in advance and apply prospectively: we will post the updated Policy here with a new effective date and email account holders before it takes effect. We will never silently apply a change retroactively to data we already hold.
Privacy questions or requests: [email protected], or contact us.