Privacy Policy

1. Scope of this Policy

This Privacy Policy governs the handling of information collected via the GhostEngine platform, including:

• Our website (ghostengine.ai, app.ghostengine.ai)
• Our services and applications
• Our universal tracking pixel (pixel.ghostengine.ai)
• Integrations with third-party advertising platforms: Meta (Facebook/Instagram), TikTok, Google Ads, and Reddit

This policy does not apply to third-party platforms outside of these specified services or to websites and services that link to or from our platform.

2. Information We Collect

2.1 Information You Provide Directly

Account Registration

• Name, email address, password
• Company name and business information
• Time zone and contact preferences
• Billing information (processed securely through third-party payment processors)

Platform Integrations

• OAuth authorization tokens for Meta, TikTok, Google Ads, and Reddit
• Advertising account IDs and metadata
• Campaign configurations and targeting preferences
• Creative assets (images, videos, ad copy)

Customer Support

• Communications with our support team
• Feedback, suggestions, and feature requests

2.2 Information Collected Automatically

Platform Usage Data

• IP address, browser type, and device information
• Pages visited, features used, and access times
• Referring URLs and navigation patterns
• Session duration and interaction data

Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to:

• Authenticate users and maintain sessions
• Remember preferences and settings
• Analyze platform usage and performance
• Provide personalized experiences
• Prevent fraud and enhance security

You can manage cookie preferences through your browser settings, though restricting cookies may affect platform functionality.

Universal Pixel Data

When you install our tracking pixel on your website, we collect conversion events, user behavior data, and attribution information necessary to measure advertising performance.

Advertising Performance Data

Campaign performance metrics, audience insights, and analytics from connected advertising platforms.

2.3 Information from Third Parties

Advertising Platforms

• Campaign performance data from Meta, TikTok, Google Ads, and Reddit
• Audience insights and demographic information
• Conversion data and attribution information
• Account status and billing information

3. How We Use Your Information

3.1 Service Provision

• Account Management: Authenticate users, manage accounts, and provide customer support
• Campaign Management: Create, optimize, and manage advertising campaigns across platforms
• AI Orchestration: Use artificial intelligence to generate campaign strategies and creative assets
• Performance Analysis: Track, analyze, and report on advertising performance
• Attribution: Measure conversion attribution across devices and platforms
• Incrementality Testing: Conduct scientific experiments to measure true advertising effectiveness

3.2 Platform Improvement

• Product Development: Improve features, develop new capabilities, and enhance user experience
• AI Model Training: Train and improve our AI models using de-identified, aggregated performance data only. We do not use your brand assets, proprietary creative elements, or identifiable customer data to train models used by other customers without your explicit consent
• Performance Optimization: Optimize platform speed, reliability, and efficiency
• Security Enhancement: Detect and prevent fraud, abuse, and security threats

3.3 Communication

• Service Updates: Notify you of platform changes, new features, and important updates
• Marketing: Send promotional emails about GhostEngine services (you may opt out)
• Customer Support: Respond to inquiries and provide technical assistance
• Billing: Send invoices, payment confirmations, and billing-related communications

3.4 Legal and Compliance

• Legal Obligations: Comply with applicable laws, regulations, and legal processes
• Terms Enforcement: Enforce our Terms of Service and other policies
• Rights Protection: Protect our rights, property, and safety, and those of our users
• Dispute Resolution: Resolve disputes and investigate complaints

4. Information Sharing and Disclosure

4.1 We Do Not Sell Your Personal Information

GhostEngine does not sell your personal information to third parties for monetary consideration.

4.2 Service Providers

We share information with trusted third-party service providers who assist us with:

• Infrastructure: Cloud hosting and database services
• Analytics: Performance monitoring and error tracking
• Payment Processing: Subscription billing services
• Authentication: User authentication services
• AI Services: AI-powered features and capabilities
• Email: Transactional and marketing email delivery

These providers are contractually obligated to protect your data. A current list of our subprocessors is available at ghostengine.ai/legal/subprocessors.

4.3 Advertising Platforms

We share necessary data with advertising platforms (Meta, TikTok, Google Ads, Reddit) to:

• Create and manage advertising campaigns on your behalf
• Track conversions and measure performance
• Optimize targeting and bidding strategies
• Generate performance reports

4.4 Legal Requirements

We may disclose personal information if required by law, court order, or governmental authority.

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice and ensure appropriate data protection measures are maintained.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, and maintain operational records.

Retention Periods

You may request earlier deletion by contacting privacy@ghostengine.ai. Deletion requests will be honored within 30 days. Certain data may persist in encrypted backups for up to 90 days after deletion.

6. Data Security

6.1 Security Measures

We implement commercially reasonable technical and organizational security measures to protect your data, including:

• Encryption: Database-level encryption at rest, TLS 1.3 for data in transit
• Privacy Protection: No PII stored for advertising tracking — all identifiers use irreversible SHA-256 hashing
• Access Controls: Role-based access control (RBAC) and multi-factor authentication (MFA)
• Network Security: Firewalls and DDoS protection
• Monitoring: Security monitoring and incident response procedures

6.2 PII Protection

Personally identifiable information (PII) related to advertising is protected through:

• SHA-256 Hashing: All advertising identifiers are hashed using SHA-256 before storage
• One-Way Hashing: Hashed data cannot be reversed to obtain original values
• Platform Compliance: Hashing follows Meta, Google, TikTok, and Reddit requirements for Enhanced Conversions
• Tokenization: Secure token storage for OAuth credentials
• Access Logging: Audit trails for PII access

6.3 Security Limitations

While we employ commercially reasonable security measures, no system is completely secure. We cannot guarantee absolute security of your data against all possible threats.

7. International Data Transfers

GhostEngine operates globally, and your personal information may be transferred to and processed in countries outside your country of residence, including the United States, where data protection laws may differ.

We rely on appropriate transfer mechanisms under applicable law for international transfers.

8. Your Privacy Rights

8.1 General Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request access to your personal information and obtain a copy
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal information
• Restriction: Request restriction of processing under certain circumstances
• Portability: Request transfer of your data to another service provider
• Objection: Object to processing based on legitimate interests
• Withdrawal: Withdraw previously given consent at any time
• Complaint: File complaints with data protection authorities

To exercise these rights, contact us at privacy@ghostengine.ai.

8.2 GDPR Rights (EU/EEA Residents)

If you are located in the European Union or European Economic Area, you have additional rights under the GDPR:

Legal Basis for Processing

• Consent: You have provided explicit consent for specific processing activities
• Contract: Processing is necessary to perform our contract with you
• Legal Obligation: Processing is required to comply with legal requirements
• Legitimate Interests: Processing is necessary for our legitimate business interests

For GDPR-related inquiries, contact us at privacy@ghostengine.ai.

8.3 CCPA Rights (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

Right to Know

Request disclosure of categories and specific pieces of personal information collected about you.

Right to Delete

Request deletion of personal information we have collected, subject to certain exceptions.

Right to Opt-Out

Direct us not to sell your personal information. Note: GhostEngine does not sell personal information.

Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

How to Exercise CCPA Rights

Email privacy@ghostengine.ai with “CCPA Request” in the subject line. We will respond within 45 days as required by law.

8.4 Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, and Utah have similar rights under their respective state privacy laws. Contact privacy@ghostengine.ai to exercise these rights.

9. Cookies and Tracking Technologies

9.1 Types of Cookies

Essential Cookies

Required for platform functionality (authentication, security, session management). Cannot be disabled.

Analytics Cookies

Help us understand how users interact with the platform to improve performance and user experience.

Preference Cookies

Remember your settings and preferences for a personalized experience.

9.2 Cookie Management

You can manage cookie preferences through:

• Browser Settings: Configure your browser to block or delete cookies
• Cookie Consent Banner: Manage preferences through our cookie consent interface
• Opt-Out Tools: Use industry opt-out tools (NAI, DAA, Your Online Choices)

Note: Disabling certain cookies may affect platform functionality. For detailed information, visit our Cookie Policy.

9.3 Do Not Track

Some browsers support “Do Not Track” (DNT) signals. We do not currently respond to DNT signals, as there is no industry standard for how to interpret them.

10. Your Opt-Out Choices

10.1 Marketing Communications Opt-Out

You may opt out of marketing emails by:

• Clicking the “Unsubscribe” link at the bottom of any marketing email
• Updating your email preferences in Account Settings
• Emailing privacy@ghostengine.ai with “Unsubscribe” in the subject line

10.2 Pixel Tracking Opt-Out

If you are a GhostEngine client:

• Remove the GhostEngine pixel code from your website
• Disable pixel tracking in your Dashboard Settings
• Contact support@ghostengine.ai for assistance

If you are a visitor to a website using our pixel:

• Use your browser’s “Do Not Track” settings
• Install browser extensions that block tracking pixels
• Clear your cookies and disable third-party cookies

10.3 Third-Party Advertising Opt-Outs

• United States: Network Advertising Initiative (NAI), Digital Advertising Alliance (DAA)
• Europe: Your Online Choices (EDAA)
• Canada: Digital Advertising Alliance of Canada (DAAC)
• iOS: Settings > Privacy > Advertising > Limit Ad Tracking
• Android: Settings > Google > Ads > Opt out of Ads Personalization

10.4 Consent Withdrawal

You can withdraw your consent at any time by emailing privacy@ghostengine.ai with “Withdraw Consent” in the subject line. We will process your request within 30 days.

10.5 Data Sale Opt-Out (CCPA)

We do not sell your personal information. However, California residents may email privacy@ghostengine.ai with “Do Not Sell” in the subject line.

11. Third-Party Links and Services

The GhostEngine platform may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of third-party sites.

12. Children’s Privacy

GhostEngine is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Material changes will be communicated through email notification, prominent notice on our website, and in-platform notifications.

The “Last Updated” date at the top of this policy indicates when it was last revised. Your continued use of GhostEngine after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices:

By using GhostEngine, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your information as described in this Privacy Policy.