Privacy
What GhostForm keeps, and what it throws away.
GhostForm is built and run by one person in Kalispell, Montana. This policy is written to be read rather than skimmed past, and it describes what the software actually does.
Your clients' information
Most of what GhostForm holds is not about you. It is about your clients and leads — their name, email, phone, and whatever they told you about what they are looking for.
That information belongs to you and to them, not to us. We hold it so the software can do its job, on your behalf. We do not sell it, rent it, share it with other realtors, or use it to advertise anything to anyone.
You decide what happens to it. You can export your leads at any time, delete any record, and delete your whole account from Profile — which removes everything at once. If a client asks you to delete their information, delete their record and it is gone, files included.
What we collect
About you: your name, email, phone, brokerage, mailing address, photo, logo and branding, the vendors you add (your lender, inspector and so on), how you'd like your social posts to sound, and — if you subscribe — your plan and its status. Card details go to Stripe and never touch our servers.
About your leads: what they enter on your forms, what you import or type in, answers to any questionnaire you send them, the notes, tags and tasks you add, and whether and when they replied to an email from you.
What you upload or send in: contracts, inspection reports, photographs of paper sign-in sheets, and lead emails you forward to your GhostForm lead address.
Email to your clients is sent through Resend from your own GhostForm address — your name at ghostform.app. When a client replies, it passes through GhostForm on its way to your inbox: we note that they replied (so they stop showing as overdue), then forward the email to you. GhostForm doesn't keep the body of the reply; Resend, as our email provider, holds it for a limited time as part of delivering it.
Lead emails you forward to your lead address are read once, by AI, to pick out the person's name, contact details, what they asked about, and their message — which becomes the new lead and its note. Only what you choose to send there is read. We never connect to or read your inbox.
Every marketing email carries a working unsubscribe link and your postal address, as US law (CAN-SPAM) requires — in both the designed version and the plain-text one. An unsubscribe takes effect immediately. If an address bounces permanently, we stop sending to it; if someone marks your email as spam, we stop sending them yours.
Texts are never sent by GhostForm. The Text button opens your own phone's messages with a draft, and you send it yourself.
Voice notes
When you speak a note, your browser turns the words into text using its own speech recognition — in Chrome that means Google's servers, in Safari Apple's. GhostForm never receives, records or stores any audio; we only ever see the text.
The text is used to create the note or task you asked for, and then discarded — once the task has been actioned or the note filed, the transcript is deleted automatically. Anything older than thirty days is deleted regardless.
Documents
Files you upload are stored privately. Links to view a document expire after five minutes, so a copied link is useless by the time anyone could share it.
Before a document is summarised, social security numbers and account numbers are stripped out and are never stored. Prices, dates and parcel numbers are kept, because those are the point.
Where AI is used — and the fair housing rule
GhostForm uses OpenAI and Anthropic to read contracts and sign-in sheets, understand voice notes and questions, read lead emails you forward, analyse a lead's readiness, draft messages, lightly reword recurring campaign emails, and draft social posts. Under their API terms, these providers do not use your data to train their models.
Every feature that writes for you follows US fair housing law. None of them may mention, infer or appeal to race, colour, religion, sex, disability, familial status, national origin, age, sexual orientation or source of income — or proxies for them, such as "good schools", "safe neighbourhood" or "family-friendly". They describe the property and the transaction, never who should live there.
This is enforced twice: in the instructions every AI feature is given, and again on what comes back. A draft message that fails the check is replaced by a plain template; a campaign rewording that fails is sent as you wrote it; a social post that fails is not shown. Tags describing who a person is — "Hispanic", "Catholic", "has kids" — can't be created at all. The lead analysis never sees a lead's age or the second person on a lead.
Every point in an analysis traces back to something the lead told you. Where they said nothing, it says so rather than guessing.
Improving the software
We keep a record of what the software predicted and what actually happened — a readiness score, and whether the deal closed. This is how we find out whether the scoring is any good. It holds a score, an outcome and how long it took — no names, emails or phone numbers — and it is deleted with the lead.
If we ever want to use more than that, we will ask you first and you will be able to say no without losing anything.
Cookies and your device
One cookie keeps you signed in. There are no advertising or tracking cookies. If you install GhostForm on your phone, it keeps a copy of the public pages (sign-in, sign-up, this policy) for when signal drops — never your signed-in pages, and that copy is cleared when you sign out. If you turn on notifications, your browser's push service (Apple, Google or Mozilla) delivers them. A notification can show a client's name and what's due, or where a new lead came from — never what anyone wrote to you.
Who else touches your data
- MongoDB Atlas — where the database lives
- Vercel — where the application runs
- Cloudflare R2 — where uploaded files are stored
- OpenAI and Anthropic — the AI features listed above
- Resend — sending and receiving email
- Stripe — taking payment and managing your plan
- Your browser's push service — delivering notifications, if you turn them on
How long things are kept
- Voice transcripts — until the task is done, and never beyond 30 days
- Leads, notes, documents and files — until you delete them or your account
- Client replies — we keep only that they replied, and when; the email itself is forwarded to you (Resend holds it for a limited time)
- Outcome records — until the lead is deleted; no personal details
- Your account — until you delete it in Profile, when everything above is removed at once. Cancelling your plan alone doesn't delete your data — email us if you'd like it gone without deleting the account yourself.
- Payment records — kept by Stripe as tax law requires
Security
Everything travels over HTTPS. Passwords are stored only as hashes. Each realtor's data is kept separate from every other realtor's, and every request is checked against the account making it. Uploaded files are private, and document links expire after five minutes.
Children
GhostForm is a tool for real estate professionals and is not meant for anyone under 18. We don't knowingly collect information from children.
What we ask of you
You are responsible for the people in your database. Only add someone who gave you their details, only email people who agreed to hear from you, and add your mailing address so your campaigns are lawful. GhostForm gives you the tools to honour that; it cannot make the decision for you.
Your rights, and asking us anything
You — or a client of a realtor who uses GhostForm — can ask to see what we hold, correct it, get a copy, or have it deleted. Some US states (California, Colorado, Virginia and others) give these rights in law; we honour them for everyone. Clients can also ask their realtor directly, who can do it themselves in GhostForm.
Email hello@ghostform.app. It reaches a person, not a queue.