Privacy Policy

Last updated: June 2026

1. Introduction

Welcome to GhostAgent ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and shield your information when you use our automated Instagram and WhatsApp messaging services.

2. Integration with Meta Platform Technologies

Our service integrates directly with Meta Platform Technologies (specifically Instagram Graph API and WhatsApp Business API) to read and reply to customer messages on your behalf. By using GhostAgent, you acknowledge that your data is processed in accordance with Meta's Platform Terms and Developer Policies. We only access the data necessary to perform the automated response function.

3. Data Storage and Processing

We use industry-standard providers to facilitate our service:

•Supabase: We use Supabase securely to store user account information, authentication data, and activity logs.
•AI Processing: Incoming messages are processed by advanced AI models to generate relevant responses. These third-party AI providers do not use your data for training their models without your explicit consent.

4. Data Collection

We collect the following types of information:

•Account Information: Your email address, phone number, and authentication tokens required to link your Instagram and WhatsApp Business accounts.
•Communication Data: Logs of incoming messages and outgoing AI-generated replies for the purpose of maintaining conversation history and improving service quality.

5. Quality Assurance & AI Response Monitoring

To ensure AI response accuracy, system reliability, safety, and customer support quality, authorized platform operators, system administrators, and account owners may review automated chat transcripts, activity logs, and message histories processed by the platform.

6. Contact Us

If you have questions about this Privacy Policy, please contact us at support@getghostagent.com.

Google API Services User Data Policy & Limited Use Disclosure

GhostAgent's integration with Google APIs (specifically the Google Calendar API) is designed to synchronize booking schedules and prevent double-booking. We take user privacy and data security extremely seriously.

Google API Limited Use Attestation

"GhostAgent's use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

1. Data Sharing, Transfer, and Disclosure

GhostAgent does not sell, trade, or rent user data obtained from Google APIs to third parties. Google user data (such as calendar event titles, durations, and free/busy times) is strictly processed to execute calendar synchronization requested by the workspace owner.

When extracting appointment parameters, Google user data may be securely processed using compliance-vetted third-party AI services: **OpenAI API** and **Google Gemini API**. These models are integrated strictly in their API capacity—meaning that they do not use, store, or train on any submitted customer or Google user data. No Google user data is shared, disclosed, or transferred to any other entities or used for training generalized AI models.

2. Data Protection and Security Mechanisms

We employ industry-standard security controls to protect sensitive information, including Google user data.

Encryption in Transit: All data transferred between our servers, database, and client devices is encrypted using Transport Layer Security (TLS/HTTPS).
Encryption at Rest: All database storage, credentials, and access tokens (including OAuth refresh tokens) are encrypted at rest using AES-256 standard encryption.
Access Isolation: Access tokens are restricted to dedicated server-side environments and are only used for the authenticated workspace. Strict database row-level security (RLS) guarantees data isolation.
Vulnerability Management: We perform regular audits and dependency updates to prevent security risks or unauthorized access.

5. Data Deletion Instructions

You have the right to request the complete deletion of your personal data stored on our servers at any time. To exercise this right:

1.Send an email to support@getghostagent.com with the subject line "Data Deletion Request".
2.Include your registered email address and your connected Instagram handle and/or WhatsApp phone number.
3.We will process your request within 30 days and permanently delete your account, authentication tokens, and all associated chat logs from our database.