Ghost is an AI privacy agent. That phrase does real work: the AI part is what makes it possible to monitor 1,200+ data brokers in parallel, to recognise that a name with a middle initial on one site is the same person as a name without it on another, and to draft a jurisdiction-specific removal request in seconds rather than the twenty minutes a human paralegal would take. The privacy part is the contract we have with you: we use AI to act on your behalf, not to learn from you.
Where AI shows up in Ghost
- Ghost AI Assistant — a chat interface for investigating your own exposure. Typical asks: "find me on data brokers", "show mentions of my old phone number", "submit removals from the last scan", "summarise the last 30 days of activity for my account". The assistant never sends an outbound legal request without your explicit confirmation.
- OSINT Source Search — heuristics and embedding-based matching for aliases, prior names, prior emails, and old contact details across hundreds of public sources. A match is only surfaced when at least two independent identifiers agree; a single weak signal is filed as "suspected" for human review.
- Risk scoring — every exposure is ranked by the likely real-world harm it enables: phishing, doxxing, SIM-swap, stalking, account takeover, family safety. The score determines ordering in the dashboard and which removals get expedited.
- Removal-letter drafting — given an exposure and its jurisdiction, an AI drafts the correct removal request (CCPA opt-out, GDPR Article 17 erasure, UK GDPR right to be forgotten, PIPEDA correction, broker-specific suppression). A Ghost analyst reviews and submits.
- Dark-web triage — when a credential or identifier surfaces in a breach archive or paste, AI clusters related leaks, dedupes against your prior history, and writes the alert explanation in plain English.
How a typical scan flows
- You enter your identifiers (name, current and prior emails, phone, addresses, aliases).
- A scanner pool fans out across 1,200+ data brokers, people-search sites, breach archives, paste sites, and dark-web mirrors. Each source has a purpose-built parser; we do not rely on a single generic crawler.
- AI clusters the raw matches by likely identity, scores each cluster for confidence, and discards low-confidence hits below a tuned threshold.
- For every high-confidence exposure, AI drafts the right removal letter, which is queued for a Ghost analyst (or you, on a self-serve plan) to approve and submit.
- We re-scan on a rolling schedule (weekly for Premium, monthly for Intelligence) and reopen any case where the broker silently re-publishes the data.
What we do not do
- We do not train models on your data. Your identifiers, removal cases, dashboard activity, and support conversations are never used to train, fine-tune, or otherwise improve any general-purpose AI model — ours or anyone else's.
- We do not share your data with model providers for training purposes. Every third-party AI provider we contract with is bound by a no-training, no-retention clause on customer prompts and outputs. We log which provider handled which request so we can demonstrate compliance.
- We do not let AI auto-file consequential actions. AI suggests; humans approve. The legal record of a removal request is signed by you, your authorised agent, or a named Ghost analyst — never by "an AI".
- We do not use AI to investigate other people on your behalf. The product is locked to identifiers you have attested are yours, or are covered by an enterprise contract.
Models and providers
Ghost uses a mix of self-hosted open-source models (Llama- and Mistral-derived, fine-tuned on our removal corpus) and contracted API access from Anthropic (Claude) and OpenAI. We route each request to the smallest model that can do the job competently — risk scoring and clustering run on local models; letter drafting runs on contracted frontier models. All third-party providers are bound by data processing agreements that prohibit training on customer data and require deletion within 30 days of the request. The current provider list is in our Privacy Policy and we publish changes 30 days in advance.
Reporting AI safety issues
If Ghost AI produces output that worries you — for accuracy, fairness, privacy, or safety reasons — write to ai-safety@useghost.me. We respond within 48 hours and publish a quarterly summary of issues and the changes we made in response.