Privacy Notice

GhostedBy determines how and why personal data is used under this Notice.

For privacy questions or requests, contact hello@ghostedby.xyz.

We only collect data needed to operate, secure and improve GhostedBy.

Our legitimate interest in processing reported outcomes is maintaining an accurate and useful candidate-experience record. You may object to processing based on legitimate interests at any time.

Your identity, email, job link, application dates and private notes are never displayed publicly.

Company pages may show:

• Aggregated reported outcomes.
• The sample size behind a rating.
• Role titles and aggregated outcomes for those titles.

Role titles are shown without your identity or application date. Identical titles may be grouped together.

Your individual application record is not published.

Optional analytics and session recording run only with your consent.

If you decline, they do not run. You can change your choice at any time through Cookie Settings.

Strictly necessary technologies may still be used to provide authentication, security, fraud prevention and other features needed for GhostedBy to work.

We do not use advertising cookies or sell personal data.

We use service providers to operate GhostedBy, including:

• Supabase for authentication and database services.
• Vercel for hosting and delivery.
• PostHog for consent-based product analytics and session recording.
• Loops for account and service emails.
• DataFast for consent-based traffic analytics.
• Fingerprint for anti-abuse controls where enabled and legally permitted.

These providers may process data only for the services they provide to GhostedBy.

Where personal data is transferred outside the European Economic Area, we use an applicable legal transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.

Account and private application data are kept while your account is active and deleted when you close it, subject to limited retention required for security, backups, disputes or legal obligations.

Analytics data is kept according to our configured provider retention periods. No new consent-based analytics data is collected after you withdraw consent.

Security and anti-abuse data is kept only for as long as needed to protect GhostedBy and the integrity of its records.

Support and legal records may be retained for as long as reasonably necessary to resolve the matter or meet legal obligations.

You can close your account from Settings.

We delete your account and private application data in accordance with the retention rules above.

A reported outcome may remain in a company-level aggregate only after it has been irreversibly anonymised so that it can no longer be linked to you.

Role-title aggregates may remain only where they can no longer reasonably be linked to you.

Depending on applicable law, you may:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Ask us to delete your data.
• Restrict certain processing.
• Object to processing based on legitimate interests.
• Receive eligible data in a portable format.
• Withdraw consent at any time.

Withdrawing consent does not affect processing that was lawful before it was withdrawn.

To exercise a right, contact hello@ghostedby.xyz. We may ask you to verify your identity before acting on a request.

If you have a privacy concern, contact hello@ghostedby.xyz.

You also have the right to complain to the data protection authority responsible for you.