Ghostove Privacy Notice
This Privacy Notice for Ghostove Technologies Inc. (“Ghostove,” “we,” “us,” or “our”) describes how and why we access, collect, store, process, and protect your personal information when you use our desktop application, web dashboard, interview simulation tools, resume builder, and real-time copilot services (“Services”).
Summary of Key Principles
A transparent, plain-English overview of how Ghostove protects your conversations, documents, and identity:
No Raw Audio Stored
Call audio is streamed purely in volatile memory during active live transcription and is immediately dropped. We never save raw audio files or call voice recordings to persistent disk or cloud storage.
Zero AI Model Training
Your conversations, resume documents, and interview transcripts are never used to train, retrain, or improve foundation artificial intelligence models. We operate under strict commercial zero-retention agreements.
Data Minimization
Each product capability processes only the minimum data payload strictly necessary to generate real-time assistance. Extraneous background data is never captured.
Desktop Privacy Controls
Our desktop copilot uses operating system window isolation to keep your private assistant visible to you while remaining excluded from your screen-sharing video feed. We do not monitor keystrokes or browser activity.
One-Click Permanent Deletion
You maintain total data sovereignty. You can delete individual session transcripts or initiate full account deletion with instant database purge directly from your dashboard.
Global Regulatory Rights
Full compliance with GDPR (EU & UK), California Consumer Privacy Act (CCPA/CPRA), 19 US state privacy frameworks, Canada PIPEDA, Australia Privacy Act, and South Africa POPIA.
01.What Information Do We Collect?
Personal Information Disclosed by You
The personal data we collect depends on your interactions with Ghostove and the features you choose to enable:
- Account Identifiers: First name, last name, email address, and authentication credentials (secured with modern cryptographic hashing).
- Career & Professional Documents: Resumes, employment history, skills, education, target job descriptions, STAR interview notes, and knowledge base documents you upload to your private account.
- Call Assistant Transcripts: Text transcripts produced during active sessions, recognized questions, and real-time situational guidance generated by the assistant.
- Mock Interview Records: Practice interview questions, candidate responses, technical feedback, and performance scores.
- Question Bank Data: Interview questions, categorization labels, and model STAR answers you curate or generate.
- Customer Support & Feedback: Inquiries, bug reports, and ratings submitted regarding AI responses.
Biometric & Facial Data Policy
We do not collect or derive biometric identifiers (such as facial geometry, retinal scans, fingerprints, or permanent voiceprints).
- Audio Streams: Live microphone and system audio streams are processed ephemerally in volatile memory solely for real-time speech-to-text conversion. No voice biometric template or permanent voiceprint is extracted or stored.
- Resume Photos: If you place a portrait on a resume in the Resume Maker, the image is stored solely as an asset within that resume document. We do not analyze facial geometry, do not perform identity verification, and do not use photos for facial recognition or marketing.
Payment & Billing Data
We do not collect or store full credit card numbers or sensitive payment authentication codes on our servers. All billing transactions are handled by PCI-DSS Level 1 compliant payment providers. We receive only transaction references, customer identifiers, payment statuses, and currency amounts required to credit your session balance.
Information Automatically Collected
When you access our web application or connect the desktop client, our servers automatically record diagnostic telemetry:
- Device & System Characteristics: Operating system type and version, hardware architecture, client application version, browser user agent, and language preferences.
- Network & Usage Logs: IP address (used for approximate geolocation to route connections to low-latency edge regions and prevent trial abuse), connection timestamps, latency metrics, and crash diagnostics.
02.How Do We Process Your Information?
We process personal data for documented, legitimate purposes:
- To deliver real-time call copilot assistance: Ingesting temporary audio streams, converting speech to text, identifying questions, and streaming relevant STAR-framework suggestions to your private interface.
- To manage accounts and entitlements: Managing user credentials, authenticating sessions, tracking remaining trial credits, and administering paid session balances.
- To provide career preparation tools: Storing uploaded resumes, documents, and historical session transcripts so you can review interview performance and prepare for upcoming conversations.
- To ensure security and prevent abuse: Enforcing rate limits, preventing fraudulent multi-account creation aimed at bypassing trial quotas, and defending against unauthorized access.
- To comply with statutory legal requirements: Retaining mandatory accounting, tax, and billing transaction records as required by financial regulations.
03.Legal Bases for Processing (GDPR & International Frameworks)
Under European (GDPR), United Kingdom (UK GDPR), and international data protection regulations, we process personal data only when a recognized legal basis exists:
Performance of a Contract (Art. 6(1)(b) GDPR)
Processing necessary to deliver the features you requested—including transcribing live audio, generating real-time suggestions, saving resume files, and maintaining your account.
Consent (Art. 6(1)(a) GDPR)
When you voluntarily submit optional information (such as candidate photos on resumes, mock interview recordings, or customer support feedback). You may withdraw consent at any time.
Legitimate Interests (Art. 6(1)(f) GDPR)
Maintaining platform uptime, debugging connection drops, monitoring network latency, and protecting against abusive exploitation or security threats.
Legal Obligations (Art. 6(1)(c) GDPR)
Retaining tax, invoice, and payment transaction logs as mandated by statutory financial and corporate compliance laws.
04.When & With Whom Do We Share Your Information?
| Subprocessor Category | Processing Purpose | Data Transferred | Contractual Safeguard |
|---|---|---|---|
| Speech-to-Text Providers | Real-time speech transcription | Ephemeral audio streams (in-memory only) | Zero data retention; no model training |
| Large Language Model Providers | STAR answer generation & question detection | Transcripts, resume excerpts, job descriptions | Enterprise zero-retention commercial terms |
| Cloud Database & Storage | Account auth, session storage, and document files | User profiles, saved transcripts, resumes | AES-256 encryption at rest, tenant isolation |
| Payment Processors | Subscription and session balance billing | Billing email, customer reference, amounts | PCI-DSS Level 1 compliance |
| Application Telemetry | System health and diagnostic performance | Anonymized page views, errors, latencies | EU Cloud hosting, IP masking enabled |
Corporate Transactions: In the event of a merger, acquisition, or sale of corporate assets, customer records may be transferred to the acquiring entity subject to the ongoing commitments of this Privacy Notice.
05.Cookies & Telemetry
We minimize the use of tracking technologies across our web properties:
- Strictly Necessary Authentication Cookies: Cryptographically signed session tokens stored as secure, HTTP-only cookies to keep you safely authenticated between visits.
- Product Telemetry: We use privacy-focused analytics hosted within the European Union to monitor application health and detect connection drops. We do not use third-party behavioral advertising trackers, and our desktop application contains no advertising SDKs.
06.Artificial Intelligence Products: Feature Breakdown
Ghostove integrates enterprise artificial intelligence capabilities to assist you during professional conversations. Below is an overview of how data flows across our features:
Live microphone and system call audio is streamed through encrypted connections directly to enterprise speech-to-text models to generate real-time transcripts. The resulting transcript segment, combined with relevant resume bullet points, job description context, and document notes you attached to the session, is processed by advanced language models to stream real-time STAR suggestions. Raw audio is never saved to disk.
When you upload an existing resume, text is extracted to populate your professional background. When optimizing a resume for a specific job posting, resume text and job requirements are analyzed by language models to recommend tailored improvements. Profile photographs on resumes are stored locally within the document record and excluded from text analysis prompts.
Practice interview questions and responses are processed to assess technical clarity, depth, and STAR structuring. Scores, feedback, and improvement suggestions are saved to your private dashboard.
Interview questions you save or organize are grouped into behavioral, technical, and scenario-based categories, with recommended STAR response outlines generated for practice.
All external AI providers operate under commercial contracts that strictly prohibit using Ghostove customer content (audio streams, transcripts, resumes, or prompts) to train or refine their foundation models.
07.Desktop Client & Operating System Permissions
The Ghostove desktop client is designed for privacy, performance, and minimal system permissions:
- Screen-Sharing Privacy: The application utilizes native operating system display isolation flags to prevent the private assistant overlay from appearing within your outbound video feed when sharing your screen during video calls. Ghostove does not modify third-party meeting applications, inject foreign code, or alter web browser runtimes.
- Audio Permissions: Standard operating system microphone and system loopback permissions are activated solely while a session is active. Audio stream processing shuts down immediately when you end a session.
- Shortcut Activation: The client registers an operating system shortcut solely to toggle assistant visibility on and off. The application contains no background keyloggers and does not monitor general typing activity.
08.Call Recording Consent & Legal Compliance
The legality of capturing conversation audio and generating real-time transcriptions varies by jurisdiction:
- One-Party Consent Jurisdictions (e.g., US Federal Law, New York, Texas, UK in private contexts): One participant in the conversation (you) may lawfully authorize real-time transcription.
- Two-Party / All-Party Consent Jurisdictions (e.g., California, Florida, Massachusetts, Illinois, Germany): All participants must give informed consent prior to intercepting or transcribing conversation audio.
User Responsibility: You are solely responsible for ensuring your use of Ghostove complies with applicable local laws, professional conduct codes, non-disclosure agreements (NDAs), and workplace policies.
09.Data Retention & Auto-Purge Lifecycle
| Data Category | Retention Period | Deletion Mechanism |
|---|---|---|
| Raw Call Audio Streams | 0 seconds (In-memory only) | Destroyed automatically following STT inference |
| Session Transcripts & Guidance | Account lifetime or until deleted | User-controlled one-click delete in Sessions dashboard |
| Resumes & Career Documents | Until deleted by user or account termination | Delete from Resume / Documents manager |
| Account Credentials & Profiles | Account lifetime | Full purge upon account deletion request |
| Billing & Tax Transaction Logs | 7 years | Statutory tax archive; purged automatically thereafter |
10.Security Safeguards & Encryption
We maintain comprehensive organizational and technical security measures:
- In-Transit Encryption: All communications between your client applications and our cloud infrastructure are secured using TLS 1.3 / HTTPS.
- At-Rest Encryption: Cloud databases, storage volumes, and document archives are encrypted using industry-standard AES-256.
- Strict Tenant Isolation: Databases enforce cryptographic row-level access control policies, ensuring authenticated user tokens can access only their own records.
- Principle of Least Privilege: External services are accessed through isolated server-side credentials with restricted operational scopes.
While we enforce strict defenses, no Internet-connected system can be guaranteed to be 100% impenetrable. We encourage you to access our Services within secure network environments.
11.Information From Minors
Ghostove is intended for adult professionals and job applicants. We do not knowingly solicit or collect personal information from individuals under 18 years of age. If we learn that personal data from a user under 18 has been collected, we will deactivate the account and promptly delete the associated records. If you believe a minor has registered an account, contact us at privacy@ghostove.ai.
12.Global Privacy Rights (EEA, UK, Switzerland)
Residents of the European Economic Area (EEA), United Kingdom (UK), and Switzerland possess statutory rights under the GDPR:
Request copies of personal information maintained about you.
Request correction of inaccurate or outdated information.
Request permanent deletion of your account and personal records.
Export your data in a structured, machine-readable format.
You have the right to submit a complaint with your relevant national Data Protection Authority or the UK Information Commissioner’s Office (ICO).
13.Do-Not-Track & Global Privacy Control Signals
We recognize Global Privacy Control (GPC) signals. Because Ghostove does not sell personal data, participate in data broker networks, or engage in third-party behavioral advertising, our platform inherently honors privacy preferences across all interfaces.
14.United States Residents: State Privacy Rights Matrix
Residents of California (CCPA/CPRA), Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia possess specific statutory rights.
California Customer Records & CCPA Category Disclosure
In the preceding 12 months, Ghostove has collected the following categories of personal information:
| CCPA Category | Examples in Ghostove | Collected | Sold / Shared |
|---|---|---|---|
| A. Identifiers | Name, email, IP address, user identifier | YES | NO |
| B. Customer Records | Name, employment history, resume details | YES | NO |
| D. Commercial Information | Subscription tier, purchase records | YES | NO |
| E. Biometric Information | Permanent voiceprints, facial geometry | NO | NO |
| H. Audio & Sensory | Live call audio processed in-memory during session | YES (Ephemeral) | NO |
| I. Professional Information | Job titles, target roles, interview materials | YES | NO |
Ghostove has not sold or shared any consumer personal data for cross-context behavioral advertising in the preceding 12 months, and will not do so in the future.
California Shine the Light: Under Cal. Civ. Code § 1798.83, California residents may request once per calendar year a list of categories of personal information disclosed to third parties for direct marketing. Ghostove does not disclose personal data to third parties for direct marketing purposes.
15.Other Regional Rights (Canada, Australia, New Zealand, South Africa)
- Canada (PIPEDA): We adhere to principles of accountability, identifying purposes, and consent. You may challenge compliance with the Office of the Privacy Commissioner of Canada.
- Australia & New Zealand: We comply with the Australian Privacy Principles (Privacy Act 1988) and New Zealand Information Privacy Principles (Privacy Act 2020).
- South Africa (POPIA): Data subjects may contact the Information Regulator (South Africa) at PAIAComplaints@inforegulator.org.za.
16.Do We Make Updates to This Notice?
Yes. We may update this Privacy Notice periodically to reflect changes in our services, applicable laws, or industry standards. The "Last Revised" date indicates when changes were published. When material changes occur, we will notify registered users via email or an in-app notice.
17.Contact Us & Data Protection Officer (DPO)
Ghostove Data Protection Office
Email: privacy@ghostove.aiFor formal inquiries, Data Protection Agreements (DPAs), or legal notices, address correspondence to:
Attn: Data Protection Officer (DPO)
Email: privacy@ghostove.ai / support@ghostove.ai
18.How Can You Review, Update, or Delete Your Data?
Under applicable privacy laws, you can review, update, or permanently delete the personal information we maintain:
You can permanently delete any session transcript, resume, or question bank entry instantly from your private dashboard. You may also request total account closure and data scrubbing.