Privacy Policy

Last updated: April 13, 2026

This Privacy Policy describes how Ghost Layer Security ("Ghost Layer," "we," "us") collects, uses, and protects information when you visit ghostlayersecurity.com or use our services.

Ghost Layer Security is operated by [JEFCA LLC, formation pending — Wyoming or Delaware, USA], with operations conducted from Guadalajara, Jalisco, Mexico. We are the data controller for the information described below.

1. Information We Collect

Information you provide:

• Early access form submissions: name, work email, company name, role, tier of interest, optional message
• Email correspondence you send to us
• Account information when you become a customer (billing details processed by Stripe — see Section 4)

Information collected automatically:

• Standard web server logs (IP address, browser type, pages visited, timestamps) for security and analytics
• Cookies necessary for site functionality (we do not use advertising or tracking cookies)

Customer data (paid tiers only):

• API requests submitted to our threat analysis service
• Threat scores, classifications, and metadata generated by our analysis
• API key usage and rate limit data

2. How We Use Information

• Respond to early access requests and support inquiries
• Provide and improve the Ghost Layer threat detection service
• Process payments through Stripe
• Detect and prevent abuse of our services
• Comply with legal obligations

We do not sell your information. We do not share it with advertisers. We do not use it to train third-party AI models.

3. Data Retention

• Early access form submissions: retained until you request deletion or for 24 months, whichever comes first
• Threat logs (Starter and Pro tiers): 90 days
• Threat logs (Enterprise tier): 12 months
• Threat logs (Custom tier): as agreed in your Master Service Agreement
• Billing records: retained as required by US and Mexican tax law (typically 7 years)

4. Third-Party Services

We use the following third-party services to operate Ghost Layer:

• Stripe — payment processing (subject to Stripe's privacy policy)
• Vercel — website hosting
• Turso / libSQL — database storage for customer accounts, API keys, and threat logs
• Google Cloud (Firestore + Secret Manager) — storage of enterprise and custom tier identity verification records and cryptographic material for Ghost Gate
• Anthropic API — AI-powered threat analysis (no customer data is used to train Anthropic's models)

Each of these providers is contractually obligated to protect your data.

5. Your Rights

Depending on your location, you may have the right to:

• Access the information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Object to or restrict processing
• Request data portability
• Withdraw consent at any time

For EU/UK residents: these rights are guaranteed under GDPR.

For California residents: these rights are guaranteed under CCPA/CPRA.

For Mexican residents: these rights are guaranteed under LFPDPPP, and you have the right to file a complaint with INAI.

To exercise any of these rights, email ghostlayersecurity@gmail.com. We will respond within 30 days.

6. Security

We take security seriously — it's literally our product. We use industry-standard encryption in transit (TLS 1.3) and at rest, cryptographic API key authentication, and rate-limited access controls. Customer data on Enterprise and Custom tiers is additionally protected by Ghost Gate, our cryptographic identity verification layer.

No security measure is perfect. If we become aware of a breach affecting your data, we will notify you without undue delay.

7. Children

Ghost Layer is not directed at children under 16. We do not knowingly collect information from children.

8. International Transfers

Ghost Layer is operated from Mexico with infrastructure in the United States. By using our services, you consent to your information being transferred to and processed in both jurisdictions.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated "Last updated" date. For paid customers, we will additionally send email notification at least 30 days before changes take effect.

10. Contact

Questions, concerns, or rights requests:

Email: ghostlayersecurity@gmail.com

Operator: [JEFCA LLC, formation pending], operating from Guadalajara, Jalisco, Mexico