Privacy Policy

askghost ("we", "us") provides an email-channel feedback tool for SaaS operators ("Customers") to collect opt-in feedback from their own end users ("Recipients"). This Privacy Policy describes how we collect, use, and protect personal data.

1. Data we collect

• Customer account data: name, email address, authentication tokens, billing identifiers (via Polar, our Merchant of Record).
• Recipient data uploaded by Customers: email address, first name, custom attributes, and prior consent timestamps. Customers warrant they have a lawful basis (opt-in consent) for processing.
• Engagement data: open / click / response events for messages we send on behalf of Customers.
• Suppression data: bounce and complaint records from AWS SES, retained to prevent re-sending to addresses that have asked to stop or that have hard-bounced.

2. How we use it

• To deliver the feedback emails Customers compose.
• To honor unsubscribe (RFC 8058 list-unsubscribe) and complaints.
• To bill Customers and prevent abuse.
• To improve product reliability (aggregate analytics — no personal content scanning).

3. Sub-processors

• Cloudflare (Workers / Pages / R2 / D1 / KV — application hosting)
• Neon (Postgres database, AWS us-east-1)
• AWS SES (email delivery, us-east-1)
• Polar (payments, Merchant of Record)
• Sentry (error monitoring)
• Google Analytics 4 (aggregate visit statistics)

4. Google Analytics 4

Our website uses Google Analytics 4 (GA4) to understand aggregate visit statistics. GA4 uses cookies to collect anonymized, aggregated data such as page views, and that data is transmitted to Google. We do not send personally identifiable information — email addresses, names, or response content — to GA4.

How collection works depends on your region. In the EU/EEA, the United Kingdom, and Switzerland, GA4 is enabled only after you accept the consent banner (opt-in). In other regions it is enabled by default, and we honor your browser's Global Privacy Control (GPC) signal. In any region you can opt out by blocking cookies in your browser. Ad personalization (Google Signals) is disabled everywhere.

5. Data location and retention

Production data is stored in AWS us-east-1. Recipient engagement data is retained for the lifetime of the Customer's account or until Customer-initiated deletion. Suppression entries are retained indefinitely as required by sender reputation best practice.

6. Your rights

Recipients can unsubscribe via the one-click List-Unsubscribe header in every message, or by emailing [email protected]. Customers can export or delete their tenant data via the in-app account settings or by contacting support.

7. Contact

Privacy inquiries: [email protected]