Legal

Privacy Policy

How Ghost Team LLC collects, uses, shares, and retains information across agentdiscoverability.com and the Agent Discoverability platform.

Last updated:

1. Who we are

Ghost Team LLC ("Ghost Team", "we", "us") is a limited liability company organized under the laws of the State of Delaware, United States. We operate agentdiscoverability.com and the Agent Discoverability platform, which measures how AI agents find, select, and invoke our customers' products.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to our public website, our product documentation, and the authenticated dashboard. Questions go to vincent@ghostteam.ai.

2. Information we collect

We collect the following categories of information:

  • Information you give us. Your name, work email address, company name, job title, and anything else you type into a demo request, sign-up, waitlist, newsletter, or support message.
  • Account information. Credentials and profile details associated with your account and your organization's membership, handled through our authentication provider.
  • Billing information. Subscription plan, billing contact, and transaction history. Card numbers are collected and stored by our payment processor, not by us.
  • Product usage data. The pages, reports, prompts, and brands you view in the dashboard, along with the actions you take, so we can operate and improve the service.
  • Technical data. IP address, browser and device type, referring page, and timestamps, collected in server logs when you request a page.
  • Marketing attribution. First-touch campaign parameters (utm_source and similar) that we store in your browser's session storage and attach to a form you choose to submit.

We do not intentionally collect special categories of personal data, and we ask that you not send them to us.

3. Public measurement data

Most of the data in the Agent Discoverability platform is not personal information. It consists of publicly observable facts about products, integrations, and agent behaviour: listings in public app and connector directories, the prompts we run against AI platforms, and the responses those platforms return. We treat that measurement data as business data about products, not as data about individuals.

4. How we use information

We use personal information to:

  • Provide, operate, secure, and support the service.
  • Create and administer accounts, organizations, and role-based access.
  • Process subscriptions, invoices, and payments.
  • Send transactional messages such as sign-in, billing, and alert emails.
  • Respond to demo requests, sales enquiries, and support questions.
  • Send product and marketing email where you have opted in or where permitted by law; every marketing message includes an unsubscribe link.
  • Diagnose faults, monitor reliability, prevent abuse, and investigate security incidents.
  • Produce aggregated, de-identified statistics about how the service is used.
  • Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

6. Cookies and analytics

Our public marketing pages are cookieless: they set no advertising or cross-site tracking cookies, and they run no third-party advertising pixels. Marketing attribution parameters are held in your browser's session storage and are cleared when you close the tab. The public integration tracker is different — it runs analytics that set cookies, and where consent is required we ask for it before those cookies are set.

The authenticated dashboard sets a strictly necessary session cookie so that you stay signed in. Without it, the dashboard cannot function, so it is not subject to an opt-in banner.

Everything beyond that is analytics. We name each tool, say what it receives, and set out your choices in the next section.

7. Analytics and product usage data

We would rather name our tools than describe them vaguely. These are the ones that run in your browser or on our servers, and what each one gets:

  • Google Analytics. Runs on our websites and in the signed-in dashboard. It receives the pages you view, an approximate location derived from your IP address, your device and browser type, and, when you are signed in, your user ID. It sets its own cookies and processes that data under Google's own terms. We have not enabled advertising features or Google Signals, and none of it is linked to a Google advertising product.
  • PostHog. Runs in the signed-in dashboard only. It receives the pages you view and the actions you take, along with your user ID, your role, and your organization's ID, slug, and plan. It sets a cookie. It does not run on our marketing pages, and it is not the product analytics on the public integration tracker, so it never sees anonymous browsing.
  • Vercel Web Analytics. Measures aggregate traffic on both sites. It sets no cookies; it derives a short-lived hash from the request, which is discarded within 24 hours.
  • Chatwoot. Powers the support chat inside the dashboard. When you open a conversation it receives your name, email address, role, and organization, because we cannot answer you without knowing who is asking. It sets a cookie to keep the conversation attached to you.
  • Server logs. Our own servers record your IP address, the time, and the page requested. These stay internal and are not handed to an analytics vendor.

Our analytics events carry identifiers, not content. An event records ids, slugs, and fixed values — a user ID, an organization ID and slug, a plan name, a page name, a brand identifier — and never the free text you type, the prompts or reports you look at, or your email address as an event property. The support chat is the deliberate exception: it needs your name and email to be a conversation at all.

We run no advertising pixels, build no advertising audiences, and pass nothing to an ad network. We do not sell personal information and we do not share it for cross-context behavioural advertising.

In the EEA and the UK, analytics runs only after you accept the consent banner, and you can change your mind at any time. Everywhere else, we tell you up front and leave you a switch: Settings → Privacy turns analytics off. In every region, a Global Privacy Control or Do Not Track signal from your browser is a hard off — we do not load analytics at all, whatever the banner or the setting says. Your choice is stored in the browser you made it in, so it applies to that browser. Opting out changes nothing about what you can do in the product.

We keep product analytics events for 12 months and then delete them.

8. Third-party subprocessors

We use a small number of vendors to run the service. Each is bound by a contract that limits their use of personal information to providing their service to us. The current categories are:

  • Cloud hosting and application delivery.
  • Managed database hosting for application data.
  • Object storage for run artifacts and screenshots.
  • Authentication and identity management.
  • Payment processing and subscription billing.
  • Transactional and marketing email delivery.
  • Error monitoring, logging, and product analytics.
  • Managed browser infrastructure used to run measurement sessions.
  • AI model providers used for classification and summarisation of public measurement data.
  • Customer relationship management and support tooling.

We update this list as our vendors change. For the current named list of subprocessors, or to be notified when it changes, email vincent@ghostteam.ai.

9. How we share information

Beyond our subprocessors, we disclose personal information only: to other members of your organization, where the service is shared by design; to professional advisers under a duty of confidentiality; where required by law, legal process, or a valid government request; to protect the rights, safety, and property of Ghost Team, our customers, or the public; and to an acquirer as part of a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different policy.

10. Data retention

We keep personal information only as long as we need it for the purposes described above:

  • Account and organization records: for the life of the account, and up to 12 months after closure so the account can be restored.
  • Billing and tax records: for as long as applicable financial and tax law requires, typically seven years.
  • Support and sales correspondence: up to 24 months after the last message.
  • Server and security logs: typically 90 days, longer where an investigation requires it.
  • Product analytics events: 12 months, then deleted.
  • Measurement runs and their artifacts: retained as the historical record behind your scores, because reinterpreting a past run must never rewrite it.

When a retention period ends, we delete the information or irreversibly de-identify it.

11. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, to receive a portable copy, to correct it, to delete it, to restrict or object to certain processing, to withdraw consent, and to not be discriminated against for exercising these rights.

To make a request, email vincent@ghostteam.ai from the address associated with your account, or tell us enough for us to locate your records. We will verify your identity, respond within the period required by applicable law (generally 30 to 45 days), and tell you if we need more time. You may use an authorised agent where the law allows it.

If we act as a processor on behalf of a customer, we will refer your request to that customer and support them in responding.

If you are in the EEA or UK, you also have the right to complain to your local supervisory authority.

12. Security

We use encryption in transit, encryption at rest for stored artifacts, least-privilege database roles, tenant isolation enforced in the data layer, access logging, and dependency and secret scanning. No system is perfectly secure, but we work to protect your information and will notify you and any regulator as required if a breach affects your personal data.

13. International transfers

We are based in the United States and our infrastructure is operated primarily in the United States. If you access the service from outside the United States, your information will be transferred to and processed there. Where required, we use the European Commission's Standard Contractual Clauses or another approved transfer mechanism.

14. Children's privacy

The service is a business tool that is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy as the service and the law change. When we do, we revise the "last updated" date at the top of this page. For material changes we will give additional notice, by email or in the product, before the change takes effect.

16. Contact us

Ghost Team LLC is the controller of the personal information described in this policy. For privacy questions, data requests, or anything else in this document, email vincent@ghostteam.ai.

This document is provided for transparency about how Ghost Team LLC operates agentdiscoverability.com. It is not legal advice. Questions about it go to vincent@ghostteam.ai.