Last Updated: April 19, 2026
This page lists the third parties ("Sub-processors") that Ghost AI, Inc. ("Ghost") engages to Process Customer Personal Data in connection with the Ghost services. It is maintained pursuant to Section 4 (Sub-Processing) of Ghost's Data Processing Agreement.
Each Sub-processor is bound by written data protection obligations no less protective of Customer Personal Data than Ghost's obligations under the DPA. To subscribe to notifications of new Sub-processors, email info@ghostgtm.ai.
Providers that host the Ghost services, store Customer Personal Data, or run the Ghost runtime.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Supabase | Primary database, object storage, and authentication backend for the Ghost platform. | Customer Personal Data (in transit and at rest), account data, workspace configuration. | United States |
| Railway | Hosts the Ghost MCP server that executes Ghost skills, integrations, and LLM calls. | Customer Personal Data in transit and in-memory during request processing; no persistent storage. | United States |
| Vercel | Hosts the public Ghost marketing website. | Website visitor data (IP address, browser, device, usage metrics). | Global edge network |
Used to perform inference for message generation, summarization, research, and related AI features. Ghost does not authorize any LLM provider to train foundation models on Customer Personal Data.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| OpenAI | LLM inference and text embeddings for prospect research, message drafting, and agent workflows. | Prompt and response content (including Customer Personal Data supplied in prompts). | United States / Global |
| Anthropic | LLM inference (Claude models) for reasoning, research analysis, and long-context workflows. | Prompt and response content (including Customer Personal Data supplied in prompts). | United States / Global |
| Google (Gemini) | LLM inference (Gemini models) for research and long-context analysis. | Prompt and response content (including Customer Personal Data supplied in prompts). | United States / Global |
| xAI (Grok) | LLM inference (Grok models) and web-grounded research via Grok tools. | Prompt and response content; web search queries associated with research tasks. | United States / Global |
Used to retrieve public information about companies and prospects in support of research workflows.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Brave Search | Web search for prospect and company research. | Search query content (typically company or person names). | United States |
| Exa | Semantic web search for articles, content, and professional signals. | Search query content and retrieved result metadata. | United States |
Third-party providers of prospect and company data derived from publicly available sources. Ghost relies on these providers for accurate, lawfully-sourced business contact information.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Apollo.io | Prospect discovery and enrichment; email and phone reveal for identified contacts. | Prospect name, business email, phone, LinkedIn URL, employment and firmographic data. | United States |
| Diffbot | Company intelligence (leadership, technographics, relationship graph, funding). | Company name, domain, leadership contact data, organizational metadata. | United States |
| CoreSignal | LinkedIn-sourced person and employment data for prospect research. | Prospect name, employment history, education, skills, professional profile data. | United States |
A waterfall of providers used to find and verify business email addresses when Customer requests contact discovery for a named prospect. Ghost may add, remove, or change providers within this category from time to time to improve match rates and verification quality; the current list is set out below, and Customer may request the up-to-date list at any time by emailing info@ghostgtm.ai.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Email discovery and verification partners | Find and verify business email addresses for named prospects. Current partners include Icypeas, LeadMagic, Dropcontact, Prospeo, Anymail Finder, Hunter.io, ContactOut, Forager, and ZeroBounce. | Prospect first and last name, company domain, LinkedIn URL (where available), and email verification status. | United States and European Union |
Integrations Customer authorizes to connect their own business systems to Ghost. Ghost accesses these only under the OAuth scopes Customer grants, and stops ingesting new data on disconnection.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| HubSpot | CRM read and write — contacts, companies, deals, activities, notes. | CRM records as authorized by Customer (contacts, companies, deals, activities, engagement data). | United States / European Union (per Customer HubSpot region) |
| Google Workspace — Gmail | Read thread metadata, create and send email drafts, monitor for replies on tracked threads. | Message content, thread metadata, attachments, reply events (scoped to permissions granted). | United States / Global (Google) |
| Google Workspace — Calendar | Access calendar events and attendees for meeting scheduling and context. | Event details, attendee emails, meeting metadata. | United States / Global (Google) |
| Google Workspace — Sheets | Read and write Google Sheets for batch data import/export. | Prospect research data, exported records, Customer-provided cell data. | United States / Global (Google) |
Integrations providing meeting transcripts and attendee data used for customer context and research.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Granola | Ingestion of meeting transcripts, summaries, and attendee lists authorized by Customer. | Meeting transcripts (including speaker content), meeting metadata, attendee emails. | United States |
Integrations Customer authorizes to connect documentation and messaging tools to Ghost.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Notion | Read and write documents and databases for customer context and skill configuration. | Page content, database records, and metadata within Customer-authorized workspaces. | United States / European Union (per Customer Notion region) |
| Slack | Post notifications and workflow alerts; read messages from Customer-authorized channels for context. | Workspace member identifiers, message content from authorized channels, notification payloads. | United States |
Providers that support billing, scheduled execution, and other operational functions of the Ghost services.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Trigger.dev | Scheduled and background execution of Ghost skills, pipelines, and automation workflows. | Task payloads (which may include Customer Personal Data for the duration of the task), execution logs, runtime metadata. | United States |
| Autumn | Subscription billing, usage metering, and checkout. | Workspace and account identifiers, usage counts, billing events. No Customer Personal Data content. | United States |
Providers that support Ghost’s public marketing website. These do not process Customer Personal Data submitted through the Services.
| Name | Purpose | Data Processed | Region |
|---|---|---|---|
| Vercel Analytics | Aggregate website traffic and performance measurement. | Anonymous page-view data, device and browser metadata, referrer information. | Global (Vercel Edge Network) |
| RB2B | Business-visitor identification on the public marketing website for Ghost’s own sales and marketing. | Anonymous visitor identifiers resolved to business contact information. | United States |
Ghost may update this list from time to time as we engage new Sub-processors or discontinue existing ones. In accordance with Section 4.3 of the DPA, Ghost will provide notification of new Sub-processors to subscribers at least fourteen (14) days before the new Sub-processor begins Processing Customer Personal Data.
To subscribe to these notifications, or to submit a data-protection-based objection to a proposed Sub-processor, email info@ghostgtm.ai.
