GHOSTREPLY
Privacy policy
Last updated 3 September 2026
This describes what GhostReply does with information about you: as someone reading this page, as someone who books a call with us, and as a client whose X account we run.
Those three are very different, and the third one involves access to your account, so they are kept apart below rather than averaged into one paragraph about "your data".
Who is responsible
Individual Entrepreneur ARTEM GASPARIAN, Chugureti district, Lochini street N3, floor 2, apartment N5, Tbilisi, Georgia, operating ghostreply.agency. We are the controller of everything described here.
Write to hello@ghostreply.agency about anything on this page. If you are already a client, your Telegram thread is faster: https://t.me/aljemm3a.
If you are only reading the page
We measure how the site is used: pages opened, where the visit came from, how quickly the page loaded, and — for a share of visits — a replay of scrolling, clicks and pointer movement, which is how we find the places the page loses people.
That runs on our own installation of Umami rather than on an analytics company. It sets no cookies and it does not identify you.
Whatever you type on the booking page is masked in that replay before it leaves your browser: the recording shows that a field was filled, never what was in it. The calendar itself is a frame served by Cal.com, and nothing inside it is recorded by us at all — we cannot see into it.
We also remember, in your browser only and only until you close the tab, where you arrived from — the referring link and any campaign tags or advertising click identifiers in the URL. That travels with your booking if you make one, and is described in the next section.
Advertising cookies, and the choice about them
We buy ads on Google and on X. To know which ad brought someone who actually became a client — rather than which ad got clicks — those two need to be told when a call is booked, and they use cookies and click identifiers to match it back to the ad.
Where those cookies are concerned we split the world in two:
- In the EEA, the UK and Switzerland nothing advertising-related is stored until you say yes. Google’s tag loads in a mode that stores nothing and measures only in aggregate; X’s tag is not loaded at all. A bar at the bottom of the page asks, Accept and Decline are the same size, and declining changes nothing about what you can read or book.
- Elsewhere the tags load normally, which is the ordinary standard for the rest of the world and is what these networks assume.
Your answer is kept in your own browser. To change it, clear this site’s data in your browser and answer again; ask us and we will tell you exactly how for the browser you use.
Neither network is given your name, your handle or your contact details. What they receive is that a call was booked, and an identifier of the click that led to it.
If you book a call
The booking page asks for three things before it shows you any times: your email address, the X profile the call is about, and what you want out of the account. All three are needed to have a useful conversation, and the first two are how we reach you.
Sent with them, without being typed by you: the link that brought you to the site if you arrived from one, any campaign tags and advertising click identifiers from that visit, and the time.
Those three answers are stored in our own records the moment you give them — before the calendar is shown — so that if you look at the times and decide not to book, we can still write to you. If you would rather we did not keep them, ask us and we will delete them.
Choosing a time happens inside a calendar served by Cal.com, which is where your booking lives and where the invitation is sent from. It receives your name, your email address, the X profile you gave us and the same campaign tags; it is acting on our instructions and for nothing else. Its frame sets one cookie of its own, from Cloudflare, to tell people from bots — it appears only when you open the calendar and lasts half an hour.
When a call is booked it arrives in our Telegram and is recorded with everything above, so we can tell later which advertising actually produced a paying client. Nobody outside us reads it. Your IP address is used, in the memory of the server and for a few minutes only, to stop the same address flooding the booking page.
If you become a client
To publish as you, we need to be able to post from your account — and that runs through X's own delegate feature rather than through anything we store. You invite our operator account as a Contributor; we never receive your password, a verification code or a copy of your session, so there is nothing of that kind here to lose, leak or hand back.
What the delegate role gives us is X's decision rather than our promise, and §4 of the terms sets out both sides of that line — including the one thing the platform does expose and we undertake not to touch, your Direct Messages. You keep the kill switch: remove us in your delegate settings and the access ends the same second.
We do hold what you tell us at onboarding about your voice and your subject, the log of replies we published for you, our correspondence, and what you paid and when.
A term is paid on an invoice, by card or PayPal balance through PayPal. Your card number is entered on PayPal's own page and never passes through this site — what comes back to us is the name and email address on the PayPal account, the payment's identifier, and what was paid and when. We could not produce your card number if you asked us to, because we have never had it.
If you ask to pay by crypto transfer instead, we invoice you. Please read the obvious thing about that once: a blockchain is public and permanent. We can delete our record of a transaction; nobody can delete the transaction.
Why we are allowed to hold it
Different reasons for different things, and it is worth knowing which is which because your rights differ:
- To do what you asked us to do — running your account, holding the call you booked, taking payment. This is the contract between us.
- Because we have a legitimate interest — keeping the booking page free of bots, keeping the site working, knowing which advertising is worth paying for. Where the interest is ours rather than yours, you can object; see below.
- Because you agreed — the advertising cookies described above, and nothing else on this list.
- Because the law requires it — invoices and tax records, which we cannot delete on request.
Who else it passes through
Named, because a category cannot be checked and a name can:
- Vercel — hosting for this site and the server that receives your booking.
- Upstash — the database holding the booking records described above.
- Railway — the server running our own Umami analytics.
- Cal.com — the calendar on our booking page, which receives your name, your email address and the X profile you gave us, and sends you the invitation. Its frame sets one cookie of its own, from Cloudflare, to tell people from bots; it is set when the calendar loads and lasts half an hour.
- PayPal — the invoices, and the page a card is entered on to pay one.
- Telegram — where bookings arrive and where we talk to clients.
- WhatsApp — the second messenger we answer on, if you write to us there.
- Google and X — advertising measurement, only within the limits set out above.
Most of these are processors acting on our instructions. Google and X are not — they decide things about the data themselves and are better described as acting alongside us. Neither is PayPal: it is a regulated payment institution with its own legal duties, and it holds your payment details as a controller in its own right rather than on our behalf. We do not sell data to anyone, and we do not use your account or its content to train anything.
Some of these companies are in the United States, so some of this information is processed there under the transfer terms in their own agreements with us.
How long we keep it
- Access to your account: nothing to keep or destroy — it is a delegation inside X, and it ends the moment you revoke it.
- Contact details and correspondence: up to twelve months after we last spoke, then deleted.
- Booking records, including the advertising identifiers: twenty-four months, because judging whether a campaign paid for itself needs more than one year of it.
- Analytics and session replays: as configured in our Umami installation, and never longer than twelve months.
- Invoices and payment records: as long as tax law requires, which is longer than any of the above and not ours to shorten.
What you can ask for
A copy of what we hold. A correction. Deletion. A restriction on what we do with it. To object to anything we do on the legitimate-interest basis above, including the advertising measurement. To withdraw consent to the cookies, at any time, without it affecting what was collected before.
Ask at hello@ghostreply.agency or in your Telegram thread. We answer within thirty days and do not charge for it. We may ask you to confirm you are who you say you are — for an X account, that usually means a message from the account itself.
Deleting things while an engagement is running may end the engagement, because some of it is what the engagement runs on. We will say so before doing it rather than after.
If you think we have handled this badly, tell us first — we would rather fix it. You can also complain to the data protection authority where you live, and that right is not conditional on asking us first.
Age
This service is not for anyone under 18, and we do not knowingly hold information about anyone who is. If you believe we do, write to us and it will be deleted.
Changes
We update this page when what we do changes, and the date at the top is the date it last did. If a change materially affects a client, we say so in their Telegram thread before it takes effect.
The rest of the agreement is in the terms of service (/terms) and the refund policy (/refund).