Privacy policy

GhostAI Privacy Policy

Version 7 · 5 November 2026

1. Data controller and contact

The data controller is Tomasz Dzidek, Trakt 59, 62-004 Kliny, Poland, NIP (tax identification number) 9231556825, REGON (statistical number) 301001162. For data matters and to exercise your rights, write to contact@ghostai.website or to the address above. The service is intended for adults who are at least 18 years old.

2. Data, purposes and legal bases

We process only data appropriate to the given purpose:

Providing the data necessary for an account is voluntary, but without it we cannot provide that feature. Additional data, e.g. an in-game identifier, is needed only for the features that use it. We do not treat acceptance of the policy as consent to marketing or as a separate legal basis for processing. If a given activity requires consent, we ask for it separately, with the option of withdrawing it.

3. Sources of data and visibility

We receive data from you, from your application and device, from the sign-in provider you chose, from event organizers, from other participants, and from public results and replays in supported games. It may include a public driver identifier, an in-game name, a result and a lap recording of a person without a GhostAI account. Public availability does not remove the protection of this data or the duty to inform.

Other users and visitors may see your nickname, results and information on public group and event pages. If you do not set a nickname, the displayed name may include your first name and surname. The organizer also decides on the visibility of the group and of the names of event participants. Set a nickname before taking part if you do not want to appear under your first name and surname.

People who manage a group may see the part of your e-mail address before the @ sign and, in the case of an e-mail invitation, the entire address of the invitation, including after it has been accepted. The organizer of an event you enter may see the PSN and GT7 identifiers you provide, which are needed to match results. Authorized administrators of the service have access to the data necessary for support.

Data derived from laps may be used for comparisons, including by other users. Removing a name or identifier does not mean automatic anonymization. We do not publicly disclose the identity of the author of a lap segment merely because it was used for a comparison.

4. Automated analysis and external AI

We automatically calculate statistics, comparisons, results and training guidance. Such an assessment of driving may constitute profiling; it serves the simulator features described. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. You may report an error in a result or in a match for clarification.

We do not pass user data to external generative AI providers for reports or for training their models.

5. Recipients and place of processing

We store data on the controller's own infrastructure in Poland. The mailbox contact@ghostai.website is operated by cyber_Folks. Access may be given to authorized persons who operate the service, to providers of e-mail services and necessary technical services acting on appropriate terms, to the Google or Discord sign-in providers you chose, to group members and organizers within the scope described above, and to authorized authorities where the law so requires.

Connecting a group's features to Discord may transmit notifications and a mention of the linked Discord account to the channel you specify; take into account the settings of this feature and of the channel. The organizer may be a separate data controller in connection with their own event and should provide their own information.

We do not sell data or use external advertising or analytics tracking tools on the service. Google and Discord also carry out their own processing on the terms described in their policies.

Using the services of these providers may involve processing outside the European Economic Area. A transfer that we arrange requires an appropriate basis under Chapter V of the GDPR, e.g. an adequacy decision or standard contractual clauses with appropriate safeguards. We make available at the contact address information on the recipient, on the safeguard applied in a particular case and on how to obtain a copy of it.

6. Retention period

We keep account and lap data for as long as is needed to maintain the account and the features ordered. We do not promise an indefinite archive. After the service ends or deletion is requested, we delete data for which there is no longer a basis and purpose for keeping it.

We keep, to a limited extent, data needed to examine claims and to demonstrate the course of the contract for the relevant limitation period, and documentation required by law for the period it requires. The mere existence of a potential claim does not justify keeping all telemetry.

We keep submitted diagnostic packages for up to 90 days. The planned retention period of routine database backups is 14 days; they are usually rotated after about 15–16 days. A failure of the backup process may delay rotation. We keep file backups for 3 days.

We keep application logs in the central event register for 30 days as standard, after which they are subject to automatic deletion carried out in the background. Selected entries may be preserved for longer only to the extent and for the time necessary to clarify an incident, to perform a legal obligation or to protect specific claims; this does not justify keeping the entire log history.

We keep other technical logs only as long as their security, repair or recovery purpose requires; they must not be used as an indefinite data archive after a deletion request. If we restore a backup, we take into account deletion requests made earlier.

Results of shared events and derived data may require a separate assessment after an account is deleted. We do not guarantee their complete deletion by the automatic account operation alone. Further storage of personal data requires a specific basis, a limited scope and consideration of your request or objection; we do not regard the data as anonymous merely because a name has been replaced.

7. Your rights and requests

To the extent arising from the GDPR, you have the right of access and to a copy of your data, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on a legitimate interest. If you have given consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Write to contact@ghostai.website. You may attach the code generated in your account in the section on legal documents and data; this makes it easier to confirm your entitlement to the account. If you do not have access to the account, tell us — we will determine another proportionate means of verification. We do not routinely require proof of identity to be sent.

We respond without undue delay, in principle within one month. Where complexity or the number of requests requires an extension of up to two further months, we inform you of the reason in the first month. Requests are in principle free of charge; exceptions are set out in the GDPR. In the event of refusal we give reasons and the remedies available.

Export and deletion are handled by the operator; the code in the account does not perform these actions by itself. Where the standard export package does not cover all data covered by your right, we supplement the response with the relevant data. We do not require an additional request merely because of limitations of the tool.

You may lodge a complaint with the President of the Personal Data Protection Office (https://uodo.gov.pl) or with the competent supervisory authority in the EU, in particular in the country of your habitual residence, place of work or of the alleged infringement.

8. Device, security and changes

The application stores on the device sign-in data, settings, the queue of laps waiting to be sent and logs. You can delete local data in the application or device settings. Uninstalling alone does not delete data previously uploaded to the service.

We apply safeguards appropriate to the risk, including encryption of connections and restriction of access. We do not publish details of the architecture or of the security configuration. The rights to data do not automatically include disclosure of source code or trade secrets, but protected information must not be used to refuse a response required by law.

The current policy and previous versions are available in the section on legal documents. We inform you of material changes before new processing begins. A change to the policy does not replace required consent or another legal basis.