Privacy Policy

1. Scope of this Policy

This Privacy Policy governs information collected through:

• Our websites (ghostengine.ai, app.ghostengine.ai) and API (api.ghostengine.ai)
• Our services and applications (the "Platform")
• Our tracking pixel (pixel.ghostengine.ai), when installed on our customers' websites
• The GhostEngine Shopify app and web pixel
• Integrations with advertising platforms: Meta (Facebook/Instagram), TikTok, Google Ads, and Reddit

1.1 Customers and Website Visitors

This policy covers two groups of people:

• Customers: businesses and their team members who create a GhostEngine account. For customer account information, GhostEngine is the controller.
• Website Visitors: people who visit a customer's website or store where the GhostEngine pixel or Shopify app is installed. For this information, the customer is the controller (or "business" under the CCPA) and GhostEngine processes it on the customer's behalf as a processor (or "service provider"). The customer's own privacy policy governs how they use it. Website Visitors should direct privacy requests to the business whose website they visited; we will assist that business in responding.

This policy does not apply to third-party platforms or to websites and services that link to or from our Platform.

2. Information We Collect

2.1 Information Customers Provide Directly

Account Registration

• First and last name, email address, and phone number
• Company name, website URL, business type, conversion goals, and time zone
• Sign-in credentials. Passwords and sign-in are handled by our authentication provider, Clerk; GhostEngine does not store your password
• Email addresses of team members you invite

Billing and Payments

• Subscription, payment method, and Wallet deposit details are collected and processed by Stripe. GhostEngine does not store full card or bank account numbers. We receive limited details such as card brand, last four digits, and payment status
• Wallet transactions, refund requests, and invoices

Platform Integrations

• OAuth authorization tokens for your Meta, TikTok, and Reddit advertising accounts
• Advertising account IDs and account metadata
• For Google Ads, we create and operate an account for you under GhostEngine's manager account; you do not provide Google credentials
• Shopify store details and access tokens, if you install our Shopify app
• Campaign configurations, budgets, flight dates, and targeting preferences
• Creative assets you upload (images, videos, logos) and ad copy

Customer Support

• Messages you send to our AI support assistant and support tickets
• Feedback, suggestions, and feature requests

2.2 Information Collected Automatically from Customers

Platform Usage Data

• IP address, browser type, and device information
• Pages visited, features used, and access times
• Referring URLs and navigation patterns

Session Replay and Error Monitoring

We use Sentry to diagnose errors. Sentry records a sample of Platform sessions (currently about 10%) and every session in which an error occurs. Recordings capture pages viewed, clicks, and on-screen interactions. All on-screen text and form inputs are masked and images and media are blocked in recordings, and payment fields hosted by Stripe are not recorded. Error reports may include your IP address and user identifier.

Analytics

We use Vercel Analytics and Speed Insights to measure Platform usage and performance.

Cookies and Local Storage

See Section 9.

2.3 Information Collected from Website Visitors (Pixel and Shopify)

When a customer installs the GhostEngine pixel, the pixel may collect from visitors to that customer's website:

• Page views and site events (for example, product views, add-to-cart, sign-ups, and purchases)
• Page URL and referring URL, including advertising click identifiers (such as gclid, fbclid, ttclid, and Reddit click IDs) and UTM parameters
• Browser user agent and language, and IP address
• Session, device, and attribution identifiers stored in cookies and local storage, and a hashed device fingerprint
• Engagement signals such as scroll depth and time on page
• Email address or phone number where the customer or its e-commerce platform provides it (for example, at checkout). These are hashed with SHA-256 in the visitor's browser before they are sent to us
• Order details such as order value, currency, and products purchased

When a customer installs the GhostEngine Shopify app, we also receive the store's order, product, and customer event data, which we use to match and enrich the conversions recorded by the pixel.

2.4 Information from Third Parties

Advertising Platforms

• Campaign, ad set, ad, and creative performance data from Meta, TikTok, Google Ads, and Reddit
• Aggregated audience and demographic breakdowns (for example, by age, gender, or region)
• Platform-reported conversions
• Account status and billing status

Public Websites

• Publicly available content from your website, which we scan to understand your business, products, and audience

3. How We Use Information

3.1 Service Provision

• Account Management: authenticate users, manage accounts and team access, and provide customer support
• Campaign Management: plan, create, launch, and manage advertising campaigns on your behalf
• Automated Optimization: reallocate budgets within your configured budget, pause underperforming creatives, and adjust certain Google Ads bid settings
• AI Features: generate campaign plans, targeting and audience suggestions, ad copy, and support responses
• Performance Analysis: track, analyze, and report on advertising performance
• Attribution: match pixel-observed conversions with platform-reported conversions
• Incrementality Testing: run holdout experiments that withhold ads in selected regions to measure true advertising effectiveness
• Conversion Forwarding: send conversion data to the advertising platforms you use, at your direction (see Section 4.3)
• Billing: process subscriptions, the Data and Usage Fee, Wallet deposits, spend, and refunds

3.2 Platform Improvement

• Product Development: improve features, develop new capabilities, and enhance user experience
• AI Model Training: improve our models using de-identified, aggregated performance data only. We do not use your brand assets, proprietary creative elements, or identifiable customer data to train models used by other customers without your explicit consent
• Reliability: diagnose errors and optimize Platform speed and reliability
• Security: detect and prevent fraud, abuse, and security threats

3.3 Communication

• Service Notices: trial reminders, billing notices, budget alerts (for example, when a flight reaches 90% of its budget), summaries of automated actions, and important Platform updates
• Customer Support: respond to inquiries and provide technical assistance
• Marketing: if we send promotional emails about GhostEngine, you may opt out at any time (see Section 10.1)

3.4 Measuring Our Own Advertising

GhostEngine advertises its own services. When you register for an account after clicking one of our ads, we may report the registration as a conversion to the advertising platform that showed the ad, together with the ad click identifier, IP address, and user agent. We do not send your email address or phone number. We do not report the registration if your browser sends a Global Privacy Control signal, or if you appear to be located in a region that requires prior consent.

3.5 Legal and Compliance

• Comply with applicable laws, regulations, and legal processes, including tax and financial record-keeping
• Enforce our Terms of Service and other policies
• Protect our rights, property, and safety, and those of our users
• Resolve disputes and investigate complaints

4. Information Sharing and Disclosure

4.1 We Do Not Sell Personal Information

GhostEngine does not sell personal information to third parties for monetary consideration.

4.2 Service Providers (Subprocessors)

We share information with the following service providers, who process it on our behalf under contractual obligations to protect it:

4.3 Advertising Platforms

At our customers' direction, we share data with Meta, TikTok, Google Ads, and Reddit to:

• Create and manage advertising campaigns on the customer's behalf
• Upload creative assets and ad copy
• Forward conversions through the Meta Conversions API, TikTok Events API, Reddit Conversions API, and Google Ads conversion uploads. Forwarded conversions may include hashed email or phone, IP address, user agent, click identifiers, and order value. Conversions are forwarded only when a marketing consent signal is present for the visitor

Each advertising platform uses this data under its own privacy policy.

4.4 Shopify

If a customer installs the GhostEngine Shopify app, we exchange data with Shopify to provide the integration, and we act on customer data request and redaction requests that Shopify sends us.

4.5 Legal Requirements

We may disclose personal information if required by law, court order, or governmental authority.

4.6 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, information may be transferred to the acquiring entity. We will provide notice and ensure appropriate data protection measures are maintained.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, and maintain operational records.

You may request earlier deletion by contacting privacy@ghostengine.ai. Deletion requests will be honored within 30 days, except where we must retain records by law (for example, billing and Wallet records). Certain data may persist in encrypted backups for up to 90 days after deletion.

6. Data Security

6.1 Security Measures

We implement commercially reasonable technical and organizational security measures, including:

• Encryption: encryption at rest for our database and file storage, and TLS for data in transit
• Access Controls: role-based access to organization data, organization-scoped data access, and multi-factor authentication support
• Credential Protection: OAuth tokens and platform credentials are stored in restricted storage and secrets management
• Monitoring: error and security monitoring, audit logging, and incident response procedures

6.2 Website Visitor Identifiers

• Email addresses and phone numbers collected by the pixel are hashed with SHA-256 in the visitor's browser before transmission, following the requirements of Meta, Google, TikTok, and Reddit for conversion matching
• IP addresses and user agents are collected without hashing, because advertising platforms require them in unhashed form for conversion matching
• Hashing is one-way, but hashed identifiers can be matched by parties that already hold the original value, which is how advertising platforms use them

6.3 Security Limitations

No system is completely secure. We cannot guarantee absolute security of your data against all possible threats.

7. International Data Transfers

GhostEngine and our service providers primarily process data in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. We rely on appropriate transfer mechanisms under applicable law for such transfers.

8. Your Privacy Rights

8.1 General Rights

Depending on your jurisdiction, you may have the right to:

• Access: request access to your personal information and obtain a copy
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal information
• Restriction: request restriction of processing under certain circumstances
• Portability: request a copy of your data in a machine-readable format
• Objection: object to processing based on legitimate interests
• Withdrawal: withdraw previously given consent at any time
• Complaint: file a complaint with a data protection authority

Customers can exercise these rights by contacting privacy@ghostengine.ai. Website Visitors should contact the business whose website they visited (see Section 1.1); you may also contact us and we will forward your request.

8.2 GDPR (EU/EEA and UK Residents)

We process personal information on the following legal bases:

• Contract: processing necessary to provide the Platform to our customers
• Legitimate Interests: security, fraud prevention, Platform improvement, and error diagnosis
• Consent: where required, for example for pixel tracking and conversion forwarding
• Legal Obligation: processing required by law, such as tax and financial record-keeping

For GDPR-related inquiries, contact privacy@ghostengine.ai.

8.3 CCPA/CPRA (California Residents)

Right to Know: request disclosure of the categories and specific pieces of personal information we collect about you. Right to Delete: request deletion of personal information we have collected, subject to certain exceptions. Right to Correct: request correction of inaccurate personal information. Right to Opt Out of Sale or Sharing: GhostEngine does not sell personal information. Reporting a registration to an advertising platform as described in Section 3.4 may be considered "sharing" for cross-context behavioral advertising. You can opt out by enabling Global Privacy Control in your browser, which we honor, or by emailing privacy@ghostengine.ai with "Do Not Share" in the subject line. Conversion data we forward on behalf of customers is sent at the customer's direction as their service provider. Right to Non-Discrimination: we will not discriminate against you for exercising your rights.

To exercise these rights, email privacy@ghostengine.ai with "CCPA Request" in the subject line. We will respond within 45 days as required by law.

8.4 Other State Privacy Laws

Residents of other U.S. states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) may have similar rights. Contact privacy@ghostengine.ai to exercise them.

9. Cookies and Similar Technologies

9.1 On the GhostEngine Platform

• Essential: authentication and session cookies set by Clerk, and browser storage the Platform uses to keep your session and settings. These are required for the Platform to work
• Error Monitoring: Sentry session replay and error reporting (see Section 2.2)
• Analytics: Vercel Analytics and Speed Insights

9.2 On GhostEngine's Marketing Website

Our marketing website uses the GhostEngine pixel to measure visits and the effectiveness of our own advertising, including first-party cookies that store ad click identifiers and UTM parameters. These are used as described in Section 3.4.

9.3 GhostEngine Pixel on Customer Websites

The pixel sets first-party cookies and local storage on the customer's website domain, including:

• A session identifier (expires after 30 minutes of inactivity)
• Ad click identifiers and UTM parameters (up to 90 days)
• A visitor identifier (up to 365 days)
• A record of the visitor's consent choice (up to 365 days)

The pixel reads consent signals from supported consent management platforms (including OneTrust, Cookiebot, and Google Consent Mode). Where no signal is present, the pixel shows its own consent prompt and waits for opt-in from visitors it identifies as likely located in the European Union, and otherwise treats visitors as having consented. Analytics and marketing features are disabled when the corresponding consent is declined.

9.4 Managing Cookies

You can block or delete cookies through your browser settings, and manage pixel tracking through the consent banner on the website you are visiting. Disabling essential cookies will prevent you from signing in to the Platform.

9.5 Do Not Track and Global Privacy Control

We do not respond to browser "Do Not Track" signals, as there is no industry standard for interpreting them. We honor Global Privacy Control for the registration reporting described in Section 3.4.

10. Your Opt-Out Choices

10.1 Marketing Communications

You may opt out of marketing emails by clicking the "Unsubscribe" link in any marketing email or by emailing privacy@ghostengine.ai with "Unsubscribe" in the subject line. Service notices (such as billing, budget, and security notices) are part of the Platform and cannot be opted out of while your account is active.

10.2 Pixel Tracking

If you are a GhostEngine customer:

• Remove the GhostEngine pixel from your website, or uninstall the GhostEngine Shopify app
• Contact support@ghostengine.ai for assistance

If you are a visitor to a website using our pixel:

• Decline tracking in that website's consent banner or cookie settings
• Block or clear cookies and local storage in your browser
• Contact the website operator, or privacy@ghostengine.ai, to request access to or deletion of your data

10.3 Advertising Platform Opt-Outs

• United States: Network Advertising Initiative (NAI), Digital Advertising Alliance (DAA)
• Europe: Your Online Choices (EDAA)
• Canada: Digital Advertising Alliance of Canada (DAAC)
• iOS: Settings > Privacy & Security > Tracking
• Android: Settings > Google > Ads > Delete advertising ID
• Each advertising platform also provides ad preference settings in your account with that platform

10.4 Consent Withdrawal

You can withdraw consent at any time by emailing privacy@ghostengine.ai with "Withdraw Consent" in the subject line. We will process your request within 30 days.

11. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of third-party sites.

12. Children's Privacy

The GhostEngine Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children through the Platform. If we become aware that we have collected information from a child under 18, we will take steps to delete it promptly. Customers must not use the pixel on websites directed to children under 13 without complying with applicable children's privacy laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email, by notice on our website, or in the Platform.

The "Last Updated" date at the top of this policy indicates when it was last revised. Your continued use of GhostEngine after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices:

GhostEngine LLC

• Privacy: privacy@ghostengine.ai
• Support: support@ghostengine.ai
• Website: ghostengine.ai

Mailing Address

GhostEngine LLC
390 NE 191st St STE 17348
Miami, FL 33179
United States

For CCPA Requests: include "CCPA Request" in the email subject line. For GDPR Requests: include "GDPR Request" in the email subject line.

By using GhostEngine, you acknowledge that you have read and understood how your information is collected, used, and disclosed as described in this Privacy Policy.