Privacy Policy

Last updated: October 9, 2026

EN/ES

Ghosty Studio ("Ghosty", "we"), based in Mexico and reachable at hola@ghosty.studio, is the controller of your personal data under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.

1. What we collect

  • Identity and contact: name, email address and, if you provide them, phone number and organization.
  • Account and billing: your plan, payment history and tax details when you request an invoice.
  • Content you upload: messages, documents, files and the instructions you give your agents.
  • Technical data: IP address, browser type, operating system, pages visited and access logs.
  • Connected services: when you link an integration, we receive only the data you authorize in that connection.

We do not deliberately collect sensitive personal data. If you upload documents containing it, that data is handled under the security measures described below and remains your responsibility as its owner or processor.

2. How we use it

Primary purposes, required to deliver the service:

  • Create and administer your account and workspace.
  • Run the agents, documents, calls and other features you request.
  • Measure usage for your plan and billing.
  • Provide support and answer your requests.
  • Detect abuse and fraud and protect the security of the platform.
  • Comply with legal, tax and contractual obligations.

Secondary purposes, which you may decline without affecting the service: product news, educational content and surveys. To opt out, write to hola@ghosty.studio or use the unsubscribe link in any email.

3. Your content does not train models

We do not use the content of your conversations, documents or files to train AI models, ours or anyone else's. Your content is processed solely to deliver the service you asked for.

4. Who we share it with

We do not sell your personal data. We share it only with the providers that let us operate, and only as far as necessary:

  • AI model providers, to process your agents' turns: the one each agent uses for its engine — Anthropic (Claude) or DeepSeek on Ghosty's account — and, if you configure your own key, also OpenAI or Google (Gemini). Each agent shows its engine and model on its page. They receive only what you send to the agent — your messages, the files you attach and the instructions you give it — plus the conversation history needed for context; never your name, email or device identifiers.
  • Google (Gemini), for the Ghosty for Mac cursor ("Show me", ⌃⌥G), only after you accept it in the app: it receives your question, a capture of the window you chose and, to decide which window to look at, a thumbnail of your screen with the names and titles of your open windows. If you ask by voice, we transcribe the audio on our own servers and only the text reaches Google. We do not store the capture, the thumbnail or the audio: they are used for that question and discarded.
  • Infrastructure and storage, to host the application and your files.
  • Payment processors, where applicable, to charge your plan.
  • Competent authorities, upon a duly founded and motivated request.

Some of these providers are located outside Mexico. By using the service you consent to those transfers, which are governed by the corresponding data processing agreements.

5. Retention

We keep your data while your account is active and, after cancellation, for as long as legal and tax obligations require. You may request deletion of your workspace by writing to us; removal from backups can take up to 90 additional days.

Sites you publish with Ghosty on the Free plan are paused after 30 days without changes and, unless reactivated, unpublished 30 days later. An unpublished site may be kept in backup for up to 6 months before it is permanently deleted, in case you want it back.

If you connected Facebook, Instagram or Messenger, the steps to delete that data are in Data deletion.

6. Security

We apply reasonable administrative, technical and physical safeguards: encryption in transit, per-workspace isolation, role-based access control and logging of sensitive operations. No system is infallible; should a breach significantly affect your rights, we will notify you without delay.

7. Cookies

We use first-party cookies that are strictly necessary to keep you signed in and remember preferences such as language. You can block them in your browser, but you will not be able to sign in.

8. Your rights

You have the right to access, rectify, cancel or object to the processing of your data (ARCO rights), to withdraw your consent and to limit the use or disclosure of your data. Send your request to hola@ghosty.studio stating your name, the email you registered with and which right you wish to exercise. We will respond within 20 business days.

9. Minors

The service is not directed to anyone under 18 and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy. The current version is always published on this page with its update date; if a change is substantial, we will notify you by email or in the application.

11. "Ghosty" Chrome extension

The "Ghosty" Chrome extension lends your browser to your agent when you ask it to from Ghosty Studio (chat, app or terminal). It only acts in the tabs of its "Ghosty" tab group and only while a task is running.

  • Data it handles: the URL and title of those tabs, the text and structure of the pages, screenshots when the agent needs them and, if you ask it to check your site, console messages and network requests. Also the clicks and text the agent types for you.
  • Why: solely so the agent can decide and perform the next step of the task you asked for. It is sent to Ghosty Studio and to your agent's model provider (see section 4) and stays in your conversation like any other message.
  • What it does not do: it never reads or types passwords, never touches tabs outside its group, does not record your browsing when there is no task, shows no ads, and does not sell or transfer this data to third parties beyond the cases in section 4.
  • Screenshots: stored as private files in your account (never public or indexed by search engines; viewed through a signed, expiring link) and deleted automatically after 14 days, unless you choose to keep them in Files.
  • Irreversible actions: sending, publishing, paying, buying, deleting, transferring, changing passwords or security settings and accepting terms require your confirmation in the chat with your agent. Nothing a web page says counts as confirmation.
  • Retention and control: everything else follows section 5. You can stop any task with the Stop button, disconnect the extension, sign the browser out (revokes your terminal agents' access) or uninstall it at any time.

The use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

12. Your Google account data

If you connect your Google account to Ghosty Studio, your agent can use these permissions, only the ones you grant and only for what you ask:

  • Google Drive (drive.file): read and edit only the files you pick with the file picker.
  • Google Calendar (calendar.events): view your events and free time, and create, move or cancel events when you ask, e.g. booking an appointment and rescheduling it.
  • Gmail (gmail.send): send emails on your behalf when you ask. We do not read your inbox.
  • Google Contacts (contacts): look up, save and update contacts, e.g. adding a new customer or fixing their phone number.

How we use it: only to provide the features you use in Ghosty Studio. The data the agent needs for your request is processed by your agent's model provider (section 4) solely to answer you. Only agents running Anthropic (Claude) or OpenAI models receive it; on our accounts with both providers, model training and data sharing are turned off, so they do not use what we send them for training. It never reaches DeepSeek or Gemini: with those models the Google connectors are disabled, and a conversation that already holds Google data is not shared with them (not its history, not cross-conversation search, not memories that came from it). We do not sell it, do not use it for advertising, do not use it to train or improve generalized AI models, and no human reads it unless you explicitly allow it, for security purposes, or to comply with the law.

Retention and control: we store the access token encrypted. We keep no separate copies of your email, calendar or contacts: what the agent shows you is kept only as part of that conversation (and of a memory if you ask it to remember something), under section 5. You can delete memories yourself at any time in Memories, and ask us to delete conversations. You can disconnect each service in Connectors at any time (we delete the token) and fully remove the permission at https://myaccount.google.com/permissions.

Ghosty Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.