Privacy policy
This policy explains what personal data we handle, in which role, and what your rights are. It covers this website, customer accounts and the GhostAudit service.
Last updated
1. Who we are
GhostAudit is operated by the business that operates GhostAudit at ghostaudit.ai ("GhostAudit", "we", "us"). Our registered company details are stated on order forms and invoices, and are available on request from [email protected]. You can reach us about privacy at [email protected].
We have not appointed an EU or UK representative or a data protection officer. Data protection contact: [email protected].
2. Two roles: controller and processor
We handle personal data in two different roles, and your rights are exercised differently in each.
As controller. We decide how and why personal data is processed when you visit this website, contact us, or create and administer a GhostAudit account. Sections 3 to 9 of this policy describe that processing.
As processor. Our customers are organizations that use GhostAudit to govern their use of AI. A customer may deploy our browser extension and desktop agent to its employees' devices, and may record information about its staff in the service, for example as the owner of an AI system. For that data the customer is the controller and we process it only on the customer's instructions, under our data processing addendum. Section 10 describes it.
If your employer uses GhostAudit and you have a question about data collected about you at work, your employer is the right contact. Our privacy by design page explains what the sensors can and cannot collect.
3. Data we collect as controller
| Category | What | Source |
|---|---|---|
| Account data | Name, work email, organization name, role, password (stored only as a salted hash) | You, or the administrator who invited you |
| Contact enquiries | Name, work email, company, company size, your message, and the plan you asked about | You, through the contact form or email |
| Free tools | If you download a policy from the AI policy generator: your work email, the company name and size you entered, and a one-line summary of your choices, kept as an enquiry. Answers you only preview, and questions pasted into the questionnaire tool, are processed to produce the result and are not stored | You, through the free tools on the website |
| Document requests | If you ask a customer of ours for documents through its AI trust center page: your name, work email, company and the reason you gave. We hold this on behalf of that customer, which decides on the request | You, through a customer's trust center page |
| Billing data | Billing contact, seat count, plan, invoices and payment status. Card details are handled by our payment processor and do not reach our servers | You and our payment processor |
| Service logs | IP address, timestamps, requests and errors, for security and troubleshooting | Your use of the website and service |
| Audit log | Actions taken in a workspace, with the acting user and time | Your use of the service |
4. Cookies and analytics
The public website does not set advertising or cross-site tracking cookies. The application stores your sign-in token in your browser's local storage so that you stay signed in. Web fonts are served from our own domain; the website does not load fonts, scripts or images from Google or any other font service.
We measure visits with Cloudflare Web Analytics, which counts page views and load times in aggregate. It does not set cookies, does not use local storage and does not track you across sites. If we introduce other analytics or non-essential cookies, we will update this policy and ask for consent where the law requires it.
5. Why we process it, and on what legal basis
- To provide the service and administer your account: performance of our contract with your organization.
- To answer enquiries and provide support: our legitimate interest in responding to people who contact us, or steps taken at your request before entering a contract.
- To bill for the service: performance of contract and legal obligations.
- To keep the service secure, including logging, rate limiting and abuse prevention: our legitimate interest in security.
- To send service announcements about changes, incidents and security: performance of contract. We send marketing email only with consent or where otherwise permitted, and every message has an unsubscribe link.
- To comply with law: legal obligation.
6. Who we share it with
We do not sell personal data. We share it only with:
- Subprocessors and service providers that host and operate the service for us, listed on our subprocessors page;
- Professional advisers such as lawyers and auditors, under confidentiality;
- Authorities, where we are legally required to, and only to the extent required;
- A successor, if the business is reorganized or sold, subject to this policy.
7. International transfers
The hosted service stores customer data in: DigitalOcean, New York, United States. Where personal data is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.
8. How long we keep it
- Account data: for the life of the account and a short period afterwards to allow recovery, then deleted or anonymized.
- Customer workspace data: until the customer deletes it or the contract ends; see the data processing addendum.
- Trial record after deletion: when a workspace is deleted we keep, for 12 months, a keyed hash of each owner's email address and of the company's email domain together with the trial dates, so that a new sign-up continues the earlier trial instead of starting a new one. The hashes cannot be read back as an address and are used for nothing else. You can ask us to erase them at [email protected].
- Contact enquiries: for as long as needed to handle the enquiry and maintain a record of our dealings, typically no longer than 24 months after last contact.
- Billing records: for the period tax and accounting law requires.
- Service logs: for a limited period appropriate to security and troubleshooting.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. To exercise a right over data for which we are the controller, write to [email protected]. We will answer within the period the law requires. You may also complain to your data protection authority.
For data that your employer collects with GhostAudit, please contact your employer. If you write to us, we will pass your request to the customer concerned.
10. Data we process for customers
When a customer uses the service, we process on its behalf:
- Sensor telemetry, if the customer deploys the sensors: which AI tool was used (by hostname or application name), time in five-minute windows, device details such as operating system and, for the desktop agent, the computer name, and a user identity according to the mode the customer selects: a work email or username, a salted hash, or none. The sensors do not collect prompts, responses, page content, keystrokes, screenshots, file contents or full URLs, and do not report activity outside the customer's list of AI tools.
- Workspace content: the customer's AI inventory, assessments, documents, integration settings and audit log, which may include names and work emails of its staff.
- Employee hub records, if the customer uses the employee AI hub: that an employee acknowledged a version of the AI policy and when, which course modules they completed, and the AI tool requests they made. In pseudonymous or anonymous identity mode these are held against a salted hash, not a work email. The hub keeps an employee signed in with a cookie that is used only for that purpose.
- Integration data from systems the customer connects, such as application names from an identity provider or dependency names from a code host.
A customer that hosts GhostAudit on its own infrastructure holds this data itself; we do not receive it.
11. Security
We describe our security measures on the security page. No system is perfectly secure; if we become aware of a personal data breach we will notify affected customers and authorities as the law requires.
12. Children
The service is for organizations. It is not directed at children and we do not knowingly collect their data.
13. Changes
We will post changes to this policy here and update the date above. If a change is material we will tell account administrators by email or in the service.
Questions about this document: [email protected]