Privacy policy

Who we are

Ghosted AI is operated by Pyxion. For anything about your data, write to mawaz@pyxion.uk. For how reviews stay anonymous, read How we protect you.

What we collect

• Your account: email address, a one-way hash of your password, and an optional display name. If you sign in with Google or Microsoft, we receive the basic profile that provider shares (through Amazon Cognito) and no password.
• What you write: reviews, ratings, interview steps, wait times, and votes on other reviews.
• Optional evidence: files you choose to upload, after we strip their hidden metadata.
• Your consent: when you submit a review we record which version of the statements you accepted and when, and when you agree to us storing an uploaded file. We keep this so we can show what you agreed to.
• Employer verification: a keyed hash of your work email and a hash of the one-time code. Not the address itself.
• Saved companies: the companies you add to your watchlist, used for recommendations.
• Technical data: network address and request details, used to keep the service secure and to limit abuse.

Company information comes from the public Companies House register. It describes companies, not the people who review them.

Why we use it

• To run your account and show you your own reviews (so we can perform our service to you).
• To keep reviews trustworthy: moderation, spotting duplicates and fake evidence (our legitimate interest).
• To secure the service and prevent abuse (our legitimate interest).
• To process evidence you upload (your consent, which you can withdraw by asking us to delete it).
• To email you a verification code you asked for.

Who else handles it

• Amazon Web Services hosts the service and stores files, in Ireland (eu-west-1).
• Resend delivers the verification emails we send you.
• Google and Microsoft, only if you choose to sign in with them.

We don’t sell personal data, and we don’t use advertising or third-party analytics trackers.

Cookies and local storage

We use only what the site needs to work: your sign-in session, your light or dark theme, and your device type so we can serve the right layout. None of it is for advertising or tracking across sites.

We also count page views on our own analytics server, which we host ourselves and never share with anyone else. It doesn’t use cookies, doesn’t fingerprint your device, and doesn’t store your IP address or anything else that identifies you.

How long we keep it

We keep your account and reviews until you ask us to delete them. We have not yet set automatic time limits for uploaded evidence; when we do, we will state them here. Backups are overwritten on a rolling basis.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct anything wrong;
• delete your account, and either delete or detach the reviews you wrote, as you prefer;
• stop or limit how we use it, or hand it to you in a portable format.

There is no self-service delete button yet. Email mawaz@pyxion.uk from the address on your account and we will act on it within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, tell account holders by email.