Privacy Policy

1. Who we are

Ghost Team LLC ("Ghost Team", "we", "us") is a limited liability company organized under the laws of the State of Delaware, United States. We operate agentdiscoverability.com and the Agent Discoverability platform, which measures how AI agents find, select, and invoke our customers' products.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to our public website, our product documentation, and the authenticated dashboard. Questions go to [email protected].

2. Information we collect

We collect the following categories of information:

• Information you give us. Your name, work email address, company name, job title, and anything else you type into a demo request, sign-up, waitlist, newsletter, or support message.
• Account information. Credentials and profile details associated with your account and your organization's membership, handled through our authentication provider.
• Billing information. Subscription plan, billing contact, and transaction history. Card numbers are collected and stored by our payment processor, not by us.
• Product usage data. The pages, reports, prompts, and brands you view in the dashboard, along with the actions you take, so we can operate and improve the service.
• Clicks on this website. Which elements you click on agentdiscoverability.com, recorded automatically: the element's visible text and, for a link, where it points. This happens on the public website only, not in the signed-in dashboard.
• Session replays. A recording of your visit — the pages as they rendered, where you click, how far you scroll — which we can play back as video. It covers this website and the signed-in dashboard alike. Anything you type into a form is masked and never captured, but a replay of a signed-in session does show your account's screens as you saw them. "Analytics and product usage data" below sets this out in full.
• Your privacy choices. Whether you allowed product analytics and when you last answered, kept on your account so we can honour that choice everywhere you sign in.
• Technical data. IP address, browser and device type, referring page, and timestamps, collected in server logs when you request a page.
• Marketing attribution. First-touch campaign parameters (utm_source and similar) that we store in your browser's session storage and attach to a form you choose to submit.

We do not intentionally collect special categories of personal data, and we ask that you not send them to us.

3. Public measurement data

Most of the data in the Agent Discoverability platform is not personal information. It consists of publicly observable facts about products, integrations, and agent behaviour: listings in public app and connector directories, the prompts we run against AI platforms, and the responses those platforms return. We treat that measurement data as business data about products, not as data about individuals.

4. How we use information

We use personal information to:

• Provide, operate, secure, and support the service.
• Create and administer accounts, organizations, and role-based access.
• Process subscriptions, invoices, and payments.
• Send transactional messages such as sign-in, billing, and alert emails.
• Respond to demo requests, sales enquiries, and support questions.
• Send product and marketing email where you have opted in or where permitted by law; every marketing message includes an unsubscribe link.
• Diagnose faults, monitor reliability, prevent abuse, and investigate security incidents.
• Watch session replays — of this website and of the signed-in dashboard — to see where people get stuck, and fix it.
• Produce aggregated, de-identified statistics about how the service is used.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. Legal bases

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (operating the service you signed up for); legitimate interests (securing the service and understanding usage where consent is not required, and business-to-business marketing); consent (analytics in the EEA and the UK, and optional marketing, withdrawable at any time); and compliance with legal obligations.

6. Cookies and analytics

Our public marketing pages run one analytics tool, PostHog, which sets a cookie. It does more here than count pages: it also records which elements you click, and records your visit as a session replay we can play back as video. They set no advertising or cross-site tracking cookies and run no third-party advertising pixels. Marketing attribution parameters are separately held in your browser's session storage and are cleared when you close the tab. The public integration tracker runs analytics that set cookies too. Wherever consent is required, we ask for it before anything is set.

The authenticated dashboard sets a strictly necessary session cookie so that you stay signed in. Without it, the dashboard cannot function, so it is not subject to an opt-in banner.

Everything beyond that is analytics. We name each tool, say what it receives, and set out your choices in the next section.

7. Analytics and product usage data

We would rather name our tools than describe them vaguely. These are the ones that run in your browser or on our servers, and what each one gets:

• Google Analytics. Runs on our websites and in the signed-in dashboard. It receives the pages you view, an approximate location derived from your IP address, your device and browser type, and, when you are signed in, your user ID. It sets its own cookies and processes that data under Google's own terms. We have not enabled advertising features or Google Signals, and none of it is linked to a Google advertising product.
• PostHog. Runs on our marketing pages and in the signed-in dashboard. On the marketing pages it receives the pages you view, the site that referred you, any campaign parameters in the link you followed, an approximate location derived from your IP address, your device and browser type, the elements you click — their visible text and, for a link, where it points — and a session replay of your visit, described below. There is no account there, so there is no account data to send. In the dashboard it also receives the actions you take, your user ID, your role, your organization's ID, slug, and plan, and a session replay of your signed-in session as well; what it does not do there is capture your clicks automatically. It sets one cookie on agentdiscoverability.com and its subdomains, which is what lets us see that the person who read a page before signing up and the person who then signed up are the same person: when you create an account, those earlier pageviews are attached to it. Until you sign up the record is pseudonymous — an identifier stored in your browser, with no name and no email address. PostHog runs on the public integration tracker too: those pages are served by this same website and are treated the same way.
• Vercel Web Analytics. Measures aggregate traffic on both sites. It sets no cookies; it derives a short-lived hash from the request, which is discarded within 24 hours.
• Chatwoot. Powers the support chat inside the dashboard. When you open a conversation it receives your name, email address, role, and organization, because we cannot answer you without knowing who is asking. It sets a cookie to keep the conversation attached to you.
• Server logs. Our own servers record your IP address, the time, and the page requested. These stay internal and are not handed to an analytics vendor.

Our analytics events carry identifiers, not content. An event records ids, slugs, and fixed values — a user ID, an organization ID and slug, a plan name, a page name, a brand identifier — and never the free text you type, the prompts or reports you look at, or your email address as an event property. The support chat is the deliberate exception: it needs your name and email to be a conversation at all.

Session replay is the exception to that. PostHog records your visit and we can play it back as video: the pages as they rendered on your screen, where you click, and how far you scroll. It runs on every page of this website, including the public tracker, and in the signed-in dashboard at app.agentdiscoverability.com.

Anything you type is masked at the point of capture, on both surfaces, so a demo request, a waitlist sign-up, or a search box appears in the recording as keystrokes into a blanked field and never as content. Frames embedded from other companies are excluded from the recording entirely. A recording only ever starts where analytics is allowed to run: in the EEA and the UK nothing is recorded until you accept the banner, in every region a Global Privacy Control or Do Not Track signal stops it outright, and declining — or changing your mind later, including in Settings → Privacy — stops the recorder along with everything else. We keep recordings for 30 days and then delete them.

What a replay of a signed-in session shows is your account as you saw it: the brands you track, the reports and scores you opened, rendered on the screen. The difference between the two surfaces is click capture, not replay — on this website PostHog also records every click automatically, and in the dashboard it does not.

We run no advertising pixels, build no advertising audiences, and pass nothing to an ad network. We do not sell personal information and we do not share it for cross-context behavioural advertising.

In the EEA and the UK, analytics runs only after you say yes, and you can change your mind at any time. Everywhere else, we tell you up front and leave you a switch: in the dashboard, Settings → Privacy turns analytics off. In every region, a Global Privacy Control or Do Not Track signal from your browser is a hard off — we do not load analytics at all, whatever you have chosen elsewhere. Opting out changes nothing about what you can do in the product.

If you create an account from the EEA or the UK, we ask in the sign-up form itself: a separate, optional checkbox, unticked, never folded into accepting the terms. Leaving it unticked creates exactly the same account as ticking it. Your answer is kept on your account, so we do not ask again on the next browser or device you sign in from, and turning analytics off in Settings → Privacy applies everywhere you sign in. On this site and the public integration tracker there is no account to keep it on, so the answer is kept in that browser and those pages still ask with a banner — as they do for anyone who has never had an account, or whose account predates the sign-up checkbox.

If two answers ever disagree — a browser that said no and an account that said yes, or the other way round — the stricter one wins and analytics stays off.

We keep product analytics events for 12 months and then delete them.

8. Third-party subprocessors

We use a small number of vendors to run the service. Each is bound by a contract that limits their use of personal information to providing their service to us. The current categories are:

• Cloud hosting and application delivery.
• Managed database hosting for application data.
• Object storage for run artifacts and screenshots.
• Authentication and identity management.
• Payment processing and subscription billing.
• Transactional and marketing email delivery.
• Error monitoring, logging, and product analytics.
• Managed browser infrastructure used to run measurement sessions.
• AI model providers used for classification and summarisation of public measurement data.
• Customer relationship management and support tooling.

We update this list as our vendors change. For the current named list of subprocessors, or to be notified when it changes, email [email protected].

9. How we share information

Beyond our subprocessors, we disclose personal information only: to other members of your organization, where the service is shared by design; to professional advisers under a duty of confidentiality; where required by law, legal process, or a valid government request; to protect the rights, safety, and property of Ghost Team, our customers, or the public; and to an acquirer as part of a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different policy.

10. Data retention

We keep personal information only as long as we need it for the purposes described above:

• Account and organization records: for the life of the account, and up to 12 months after closure so the account can be restored.
• Billing and tax records: for as long as applicable financial and tax law requires, typically seven years.
• Support and sales correspondence: up to 24 months after the last message.
• Server and security logs: typically 90 days, longer where an investigation requires it.
• Product analytics events: 12 months, then deleted.
• Session replays, of this website and of the dashboard alike: 30 days, then deleted.
• Measurement runs and their artifacts: retained as the historical record behind your scores, because reinterpreting a past run must never rewrite it.

When a retention period ends, we delete the information or irreversibly de-identify it.

11. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, to receive a portable copy, to correct it, to delete it, to restrict or object to certain processing, to withdraw consent, and to not be discriminated against for exercising these rights.

To make a request, email [email protected] from the address associated with your account, or tell us enough for us to locate your records. We will verify your identity, respond within the period required by applicable law (generally 30 to 45 days), and tell you if we need more time. You may use an authorised agent where the law allows it.

If we act as a processor on behalf of a customer, we will refer your request to that customer and support them in responding.

If you are in the EEA or UK, you also have the right to complain to your local supervisory authority.

12. Security

We use encryption in transit, encryption at rest for stored artifacts, least-privilege database roles, tenant isolation enforced in the data layer, access logging, and dependency and secret scanning. No system is perfectly secure, but we work to protect your information and will notify you and any regulator as required if a breach affects your personal data.

13. International transfers

We are based in the United States and our infrastructure is operated primarily in the United States. If you access the service from outside the United States, your information will be transferred to and processed there. Where required, we use the European Commission's Standard Contractual Clauses or another approved transfer mechanism.

14. Children's privacy

The service is a business tool that is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy as the service and the law change. When we do, we revise the "last updated" date at the top of this page. For material changes we will give additional notice, by email or in the product, before the change takes effect.

16. Contact us

Ghost Team LLC is the controller of the personal information described in this policy. For privacy questions, data requests, or anything else in this document, email [email protected].