Privacy Policy

1. Who we are

Ghost Team LLC ("Ghost Team", "we", "us") is a limited liability company organized under the laws of the State of Delaware, United States. We operate agentdiscoverability.com and the Agent Discoverability platform, which measures how AI agents find, select, and invoke our customers' products.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to our public website, our product documentation, the authenticated dashboard, and our MCP server at mcp.agentdiscoverability.com. Questions go to vincent@ghostteam.ai.

2. Information we collect

We collect the following categories of information:

• Information you give us. Your name, work email address, company name, job title, and anything else you type into a demo request, sign-up, waitlist, newsletter, or support message.
• Account information. Credentials and profile details associated with your account and your organization's membership, handled through our authentication provider.
• Billing information. Subscription plan, billing contact, and transaction history. Card numbers are collected and stored by our payment processor, not by us.
• Usage and analytics. The pages you view and the actions you take on this website and in the dashboard, including session replays. "Cookies and analytics" below sets out what is recorded.
• MCP server usage. When you connect an AI app such as Claude or ChatGPT to our MCP server and sign in, we record which tool was called, which app called it, how long it took, and whether it worked, linked to your account. We do not record what you asked, the tool's arguments, or the data it returned.
• Information about you from public sources. When you sign up, we look up publicly available information about you and your company: for you, your job title, seniority, professional background, location, and recent public activity; for your company, its size, industry, headquarters, and funding. We do this with an AI model that searches the web, and our team uses the result to understand who signed up and to prepare your onboarding.
• Technical data. IP address, browser and device type, referring page, and timestamps, recorded in our server logs when you request a page.
• Marketing attribution. First-touch campaign parameters (utm_source and similar) that we store in your browser's session storage and attach to a form you choose to submit.

We do not intentionally collect special categories of personal data, and we ask that you not send them to us.

3. Measurement data

Most of the data in the Agent Discoverability platform is not personal information. It consists of facts about products and integrations: listings in public app and connector directories, and how AI platforms recommend products. Those facts sometimes name a person, such as a company's founder. We treat measurement data as business data about products, and we do not use it to build profiles of individuals.

4. How we use information

We use personal information to:

• Provide, operate, secure, and support the service.
• Create and administer accounts, organizations, and role-based access.
• Process subscriptions, invoices, and payments.
• Send transactional messages such as sign-in, billing, and alert emails.
• Respond to demo requests, sales enquiries, and support questions.
• Research new sign-ups from public sources, as described above, so we know who we are talking to and can prepare their onboarding.
• Notify our team about new sign-ups, MCP server sign-ins, and support conversations in our internal workspace, and, where your organization has joined a shared channel with us, carry support conversations there.
• Send product and marketing email where you have opted in or where permitted by law; every marketing message includes an unsubscribe link.
• Diagnose faults, monitor reliability, prevent abuse, and investigate security incidents.
• Watch session replays to see where people get stuck, and fix it.
• Produce aggregated, de-identified statistics about how the service is used.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. Legal bases

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (operating the service you signed up for); legitimate interests (securing the service, understanding product and site usage through analytics and session replay, researching new sign-ups from public sources, and business-to-business marketing); consent (optional marketing, withdrawable at any time); and compliance with legal obligations.

Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling grounds to continue. We do not make decisions about you that have legal or similarly significant effects by automated means.

6. Cookies and analytics

We use one analytics tool, PostHog, on this website and in the dashboard. It records the pages you view, the site that referred you, your device and browser, errors in your browser, and an approximate location derived from your IP address. On this website it also records your clicks. In the dashboard it links what you do to your account (your name, email address, role, and organization).

Session replay. PostHog also records visits to this website and the dashboard so we can play them back: what was on screen, clicks and scrolling, console messages, and network timings. Anything you type is masked and never recorded. We delete replays after 30 days and other analytics events after 12 months.

Cookies. PostHog sets one cookie on agentdiscoverability.com and its subdomains, so visits before and after you sign up are linked to the same account. The dashboard sets a strictly necessary cookie to keep you signed in, and the support chat sets one to keep your conversation together. Campaign parameters from the link you followed are kept in your browser's session storage until you close the tab.

We run no advertising pixels and do not sell or share personal information for advertising. If your browser sends a Do Not Track signal, PostHog collects nothing from it.

7. Third-party subprocessors

We use a small number of vendors to run the service. Each is bound by a contract that limits their use of personal information to providing their service to us. The current categories are:

• Cloud hosting and application delivery.
• Managed database hosting for application data.
• Object storage for service data and files.
• Authentication and identity management.
• Payment processing and subscription billing.
• Transactional and marketing email delivery.
• Error monitoring, logging, and product analytics.
• AI model providers, used to analyse service data and to research new sign-ups from public sources.
• Team messaging, for internal notifications and shared support channels.
• Customer relationship management and support tooling.

We update this list as our vendors change. For the current named list of subprocessors, or to be notified when it changes, email vincent@ghostteam.ai.

8. How we share information

Beyond our subprocessors, we disclose personal information only: to other members of your organization, where the service is shared by design; to professional advisers under a duty of confidentiality; where required by law, legal process, or a valid government request; to protect the rights, safety, and property of Ghost Team, our customers, or the public; and to an acquirer as part of a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different policy.

9. Data retention

We keep personal information only as long as we need it for the purposes described above:

• Account and organization records: for the life of the account, and up to 12 months after closure so the account can be restored.
• Billing and tax records: for as long as applicable financial and tax law requires, typically seven years.
• Support and sales correspondence: up to 24 months after the last message.
• Server and security logs: typically 90 days, longer where an investigation requires it.
• Product analytics events: 12 months, then deleted.
• Session replays, of this website and of the dashboard alike: 30 days, then deleted.
• Research about new sign-ups: kept with our sales correspondence, on the same terms.
• Measurement data behind your scores: retained as the historical record, so past results never change after the fact.

When a retention period ends, we delete the information or irreversibly de-identify it.

10. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, to receive a portable copy, to correct it, to delete it, to restrict or object to certain processing (including the sign-up research described above), to withdraw consent, and to not be discriminated against for exercising these rights.

To make a request, email vincent@ghostteam.ai from the address associated with your account, or tell us enough for us to locate your records. We will verify your identity, respond within the period required by applicable law (generally 30 to 45 days), and tell you if we need more time. You may use an authorised agent where the law allows it.

If we act as a processor on behalf of a customer, we will refer your request to that customer and support them in responding.

If you are in the EEA or UK, you also have the right to complain to your local supervisory authority.

11. Security

We use encryption in transit, encryption at rest for stored files, least-privilege database roles, tenant isolation enforced in the data layer, access logging, and dependency and secret scanning. No system is perfectly secure, but we work to protect your information and will notify you and any regulator as required if a breach affects your personal data.

12. International transfers

We are based in the United States and our infrastructure is operated primarily in the United States. If you access the service from outside the United States, your information will be transferred to and processed there. Where required, we use the European Commission's Standard Contractual Clauses or another approved transfer mechanism.

13. Children's privacy

The service is a business tool that is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy as the service and the law change. When we do, we revise the "last updated" date at the top of this page. For material changes we will give additional notice, by email or in the product, before the change takes effect.

15. Contact us

Ghost Team LLC is the controller of the personal information described in this policy. For privacy questions, data requests, or anything else in this document, email vincent@ghostteam.ai.