Privacy Policy

This Privacy Policy describes how GhostAssist ("we", "us") collects, uses, and protects information when you visit our website (aighostassistant.pro) and use the GhostAssist Windows application.

When you purchase: We collect your email address, name, and payment information. Payment processing is handled by a licensed third-party payment processor — we do not store card numbers or mobile money credentials.

When you use the website: Standard server logs (IP address, browser type, pages visited) for security and uptime monitoring. We also use PostHog to measure page views and a small number of explicitly defined events. We do not send form contents, payment references, account tokens, or GhostAssist app session content to PostHog. Analytics data can include page paths without query strings, browser and device details, a broad acquisition category, a session identifier, and approximate location derived from the IP address.

When you use the GhostAssist app: We do not receive your session data, meeting transcripts, or AI conversation history. This data is stored entirely on your local machine.

• To deliver your license file and send transactional emails (purchase confirmation, re-download, activation reset).
• To provide customer support when you contact us.
• To maintain the security of our systems and prevent fraud.
• To understand which website pages are useful and whether the purchase flow succeeds, using limited website analytics.
• We do not sell, rent, or share your personal data with third parties for marketing purposes.

When you request an AI answer or transcription, the context needed to perform that request is sent from your machine to the selected AI or speech provider. Depending on your configuration, this can include Anthropic, OpenRouter, Deepgram, or a provider used by the default managed service. Bring-your-own-key requests use the credentials you configure in the app.

Those requests are subject to the selected provider's privacy, retention, and training terms. GhostAssist does not store the content of desktop AI queries or transcripts on its website or license infrastructure, and does not use that content to train a GhostAssist model.

We rely on a small number of vetted third-party providers to operate the website and license system. These include providers for hosting, payment processing, transactional email, website analytics (PostHog), and support intake. PostHog receives page paths and limited device and referral information, but not URL query strings or transaction references. Each provider processes data under its own privacy terms.

We retain your account and purchase records for as long as your account is active, and for a reasonable period afterward for legal and support purposes. You may request deletion through our support form (see Section 7).

You have the right to access, correct, or delete the personal data we hold about you. To exercise these rights, please submit a request through our support form.

License files are cryptographically signed. Website authentication requires email verification, and sign-in forms are protected against automated abuse. Administrative areas are gated by additional access controls. We apply HTTPS, HSTS, and a strict Content Security Policy across all website properties. We do not publish the specifics of our security stack.

The GhostAssist website uses session cookies required for authentication. Website analytics uses browser session storage, not a persistent analytics cookie, to keep an anonymous identifier for the current tab; it is cleared when that tab is closed. We do not use advertising cookies, and automatic click or form-field capture is disabled.

This section applies if you are resident in Kenya or your personal data is processed in connection with our services. It supplements the rest of this Policy.

Data Controller. GhostAssist (operated from Kenya) is the Data Controller. Contact us at [email protected] for data-protection matters; a postal address is available on request.

Lawful basis (DPA s. 30). We process personal data on the bases of contract performance (issuing your license and supporting your account), legitimate interest (fraud prevention, security, and audit), legal obligation (tax and statutory records), and consent where explicitly requested.

Sub-processors. Personal data is processed on our behalf by a small number of vetted third-party providers, including: a cloud database, authentication, and storage provider (US); a website hosting provider (US); an edge network and security provider for CAPTCHA, DDoS protection, and installer delivery (global); a licensed payment processor for M-Pesa and card payments (Kenya); and a transactional email provider (US/EU); and a website analytics provider (US). Each is contractually bound to process personal data only on our instructions and in accordance with applicable data-protection law. A current list of named sub-processors is available on request via Section 11.

Cross-border transfers (DPA s. 48). Where personal data is transferred outside Kenya to the sub-processors described above, we rely on safeguards equivalent to the DPA, including the recipient's data-protection commitments and standard contractual terms. By creating an account or completing a purchase, you consent to this transfer.

Your rights (DPA s. 26). You have the right to be informed of how your data is used, to access it, to have inaccurate data corrected or deleted, to object to processing, and to withdraw consent where consent is the basis. To exercise any of these, contact us via Section 11; we respond within the period prescribed by the DPA.

ODPC. If you believe your DPA rights have been violated, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya at www.odpc.go.ke.

Privacy questions: please reach out through our support form.