Privacy Policy

Last updated: September 11, 2026

This Privacy Policy describes how Ghost Layer Security ("Ghost Layer," "we," "us") collects, uses, and protects information when you visit ghostlayersecurity.com or use our services.

Ghost Layer Security is operated by JEFCA Labs LLC, a Wyoming limited liability company, operating as Ghost Layer Security, with operations conducted from Guadalajara, Jalisco, Mexico. We are the data controller for the information described below.

1. Information We Collect

Information you provide:

• Early access form submissions: name, work email, company name, role, tier of interest, optional message
• Email correspondence you send to us
• Account information when you become a customer (billing details processed by Stripe — see Section 4)

Information collected automatically:

• Standard web server logs (IP address, browser type, pages visited, timestamps) for security and analytics
• Cookies necessary for site functionality (we do not use advertising or tracking cookies)

Customer data (paid tiers only):

• API requests submitted to our threat analysis service
• Threat scores and classifications generated by our analysis, and a stored log of each scan that includes a 200-character preview of the scanned content, the source IP address, and the user agent of the originating request
• API key usage and rate limit data
• For customers on any tier using Ghost Gate: the cryptographic public keys and device and environment fingerprints of your registered agents — hostname, MAC address, CPU model, operating system version, timezone, and network ASN — used to verify agent identity

2. How We Use Information

• Respond to early access requests and support inquiries
• Provide and improve the Ghost Layer threat detection service
• Process payments through Stripe
• Detect and prevent abuse of our services
• Comply with legal obligations

We do not sell your information. We do not share it with advertisers. We do not use it to train third-party AI models.

Improving the Service: we may use aggregated and de-identified threat data — detection patterns, attack classifications, and scoring outcomes — to improve detection accuracy. This does not include the content previews, source IP addresses, or customer identifiers described in Section 1.

3. Data Retention

• Early access form submissions: retained until you request deletion or for 24 months, whichever comes first
• Threat logs (Starter and Pro tiers): 90 days
• Threat logs (Enterprise tier): 12 months
• Billing records: retained as required by US and Mexican tax law (typically 7 years)
• Ghost Gate agent records (all tiers): an agent's secret seed material is deleted at the moment the agent is deregistered. While your account is open, the per-request verification log (the attestation events shown in your Ghost Gate console, and the related scan-memory observations) is kept on the same schedule as your threat logs, measured from each record's own timestamp: 90 days on Starter and Pro, 12 months on Enterprise. On that schedule a daily job deletes events whose verification passed, and reduces events whose verification failed to the agent name, timestamp, gate results, ratchet counter and latency — the source IP address, user agent, request URL, payload hash and nonce are removed — so a security finding stays answerable without the origin data. The IP address recorded when an agent was registered is removed from the registration record on the same schedule. Twelve months after your account closes, a daily job deletes the remaining agent material and event logs — any agents still registered are deregistered (their seeds deleted), and attestation events (the per-request verification log in your Ghost Gate console), handshake events, trust scores and related scan-memory records for your account are deleted. The record that each agent was registered and deregistered is kept beyond that point, reduced to the agent name, timestamps, revocation reason and ratchet counter: the public key, key history, environment fingerprint hash, IP address and user agent are removed from it. You may request earlier deletion at any time. Closure is the date your subscription ends; reactivating your account before the twelve months have passed resets the clock.

Retention periods are measured from the date each record is created and are not extended by cancellation of your subscription.

4. Third-Party Services

We use the following third-party services to operate Ghost Layer:

• Stripe — payment processing (subject to Stripe's privacy policy)
• Vercel — website hosting
• Turso / libSQL — database storage for customer accounts, API keys, and threat logs
• Resend — transactional email delivery (account verification links, early-access lead notifications, and one-time API key delivery); processes recipient email addresses and lead contact information
• Google Cloud (Cloud Run, Firestore, Secret Manager) — application hosting, storage of Ghost Gate identity verification records (all tiers), and cryptographic material for Ghost Gate
• Anthropic API — AI-powered threat analysis. Scan payloads, including the content being scanned, are processed by Anthropic's API. Per Anthropic's Commercial Terms, customer content submitted through the API is not used to train Anthropic's models, and Anthropic retains API data for up to 30 days

Each of these providers is contractually obligated to protect your data.

5. Your Rights

Depending on your location, you may have the right to:

• Access the information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Object to or restrict processing
• Request data portability
• Withdraw consent at any time

For EU/UK residents: these rights are guaranteed under GDPR.

For California residents: these rights are guaranteed under CCPA/CPRA.

For Mexican residents: these rights are guaranteed under LFPDPPP, and you have the right to file a complaint with INAI.

To exercise any of these rights, email security@ghostlayersecurity.com. We will respond within 30 days.

6. Security

We take security seriously — it's our product. We use industry-standard encryption in transit (TLS 1.3) and at rest, cryptographic API key authentication, and rate-limited access controls. Customer data on every tier is additionally protected by Ghost Gate, our cryptographic identity verification layer, for the agents you register (Starter 3, Pro 10, Enterprise unlimited).

When we delete threat logs under our retention schedule (Section 3), deletion takes effect on the scheduled deletion run and removes the data from our live database; any residual copies held in our database provider's automated backups expire within that provider's point-in-time recovery window, currently 24 hours.

No security measure is perfect. If we become aware of a breach affecting your data, we will notify you without undue delay, and in any case within 72 hours of becoming aware where required by applicable law.

7. Children

Ghost Layer is not directed at children under 16. We do not knowingly collect information from children.

8. International Transfers

Ghost Layer is operated from Mexico with infrastructure in the United States. By using our services, you consent to your information being transferred to and processed in both jurisdictions.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated "Last updated" date. For paid customers, we will additionally send email notification at least 30 days before changes take effect.

10. Contact

Questions, concerns, or rights requests:

Email: security@ghostlayersecurity.com

Operator: JEFCA Labs LLC, a Wyoming limited liability company, operating as Ghost Layer Security, operating from Guadalajara, Jalisco, Mexico.