Privacy
Privacy Policy
Last updated: this policy is illustrative and should be reviewed by qualified legal counsel before commercial launch.
What we collect
Account information (name, email, organisation), asset identifiers you provide for scanning, scan evidence and findings, billing details processed by Stripe, and usage/audit logs necessary for security and support.
How we use it
To operate the service (scanning, scoring, reporting), to secure your account, to communicate service-related notifications, and to improve the product. We do not sell personal data.
Your rights
You may request an export or deletion of your account and organisation data from Settings, or by contacting privacy@ghostscanai.com. Retention periods are configurable per plan (see your Organisation settings).
UK/EU data subjects
GhostScanAI is built with UK GDPR and EU GDPR principles in mind (data minimisation, purpose limitation, configurable retention, export and deletion tooling). This is not a claim of formal certification — no automated system can certify its own compliance, and you should seek your own legal advice for your specific obligations.
Sub-processors
Stripe (billing), an S3-compatible object storage provider (evidence storage), and an email delivery provider (transactional email). AI interpretation may use OpenAI when configured by your organisation's administrator; a non-AI, rules-based writer is used by default.