PHANTOM AI SOLUTIONS

Privacy Policy

Last updated: 8 August 2026

This policy explains what information we hold about you, why we hold it, who else can see it, and what you can do about it. It is written to be read, not skimmed past.

---

1. Who is responsible for your information

Phantom AI Solutions is a brand operated by Phantom Global Holdings LLC, a limited liability company registered in Delaware, United States. We are the data controller for the information described here.

• Contact: support@phantomaisolutions.com
• Mailing address: 8 The Green, Suite A, Dover, DE 19901, United States

This policy covers the phantomaisolutions.com store and the Phantom member portal. It sits alongside our Terms of Service, which sets out the rules of the deal, and our Refund Policy, which sets out exactly when refunds are available.

2. The short version

• We collect your email address, your purchase details, and the work you create inside the portal.
• We use it to give you access, take payment, run the tools, and support you.
• Your work is stored in our database. Row-level security stops other members from seeing it. It does not stop us: as the operator of the database we are technically able to read member content, and we limit ourselves to doing so for the reasons listed in section 6.
• Text you send to the AI tools is processed by Anthropic, our AI provider. It is not used to train AI models.
• We do not sell your information, and we do not share it for advertising.
• You can ask us to delete your account and your data at any time.

3. What we collect

Information you give us when you buy Name, email address, billing address, and the country you are buying from, collected through our store platform at checkout. Payment card details go directly to the payment processor. We never see or store your full card number. We see the last four digits and the outcome of the transaction.

Account information Your email address and a password. Passwords are stored as an irreversible cryptographic hash by our authentication provider, not as text, which means nobody at Phantom can read your password.

The work you create in the portal This is the largest category, and it is worth listing honestly. Depending on which tiers you use, we store:

• Your conversations with the Ask Phantom assistant
• Notes you write
• Daily numbers, goals, and log entries from the Tracker
• Checklist progress across lessons and guides
• A/B tests you set up, their results, and the lessons you record
• Campaigns, market entry packs, and automation designs generated for you, including every version
• Weekly briefings generated from your data, and the approval queue and system health entries that come from them
• Text you paste into the Compliance Scanner, along with the reports it produces

Some of this may include information about your customers or your business if you choose to paste it in. Please only paste what you need to.

Support correspondence Emails you send us and our replies, kept so we have a record of the conversation.

Technical information Standard server and security logs from our hosting and database providers, such as IP address, browser type, timestamps, and error records. Session cookies that keep you logged in.

We do not collect special category data (health, race, religion, political views, biometrics) and ask that you do not paste it into the tools.

4. Why we use it, and our legal grounds

For members in the UK, EU, and other places with similar law, this table gives the legal basis we rely on.

What we do	Why	Legal basis
Create your account and give you access	To deliver what you bought	Performance of a contract
Store and display the work you create	The product does not function otherwise	Performance of a contract
Process AI generations and Ask Phantom replies	The tools you paid for	Performance of a contract
Take payment and handle renewals, refunds, and disputes	To run the transaction	Performance of a contract
Answer support requests and troubleshoot faults	To help you	Performance of a contract, and our legitimate interest in a working product
Keep the service secure, prevent fraud and account sharing	To protect the service and other members	Legitimate interests
Keep tax, accounting, and transaction records	Required of us	Legal obligation
Understand which features are used, in aggregate, to improve the product	To build the right things	Legitimate interests
Send marketing emails if you asked for them	You opted in	Consent, which you can withdraw at any time

5. Automated decisions

We do not make automated decisions that have a legal or similarly significant effect on you. The AI tools generate suggestions and drafts. Every one of them is a recommendation for you to accept or reject.

6. Who can see the work you create

This section matters, so it is stated directly rather than softened.

Other members cannot see your data. The database enforces row-level security, meaning every record is tied to your account and queries can only return your own rows.

We can. As the operator of the database, Phantom is technically able to access member content, including notes, conversations, tracker numbers, campaigns, and scans. There is no honest way to claim otherwise, so we do not claim it. What we commit to instead is a limit on why we would:

• To operate the service, including fixing faults and investigating errors
• To answer a support request, usually one where you have asked us to look at something
• To investigate a credible security concern, a suspected breach of the Terms of Service, or a legal obligation

We do not read member content out of curiosity, we do not use it to build marketing material, and we do not share it with anyone except as described in section 8.

7. AI processing

When you use Ask Phantom or any of the AI tools, the text you submit — plus, on some screens, relevant data already in your account, such as your recent tracker numbers or your closed tests — is sent to Anthropic, our AI provider, so a response can be generated. The response is stored in your account.

Your data sent through the Anthropic API is not used to train AI models. That is a commitment in Anthropic's commercial API terms, and it is one of the reasons the product is built on the API rather than a consumer chat product.

Anthropic retains API data only for a limited period for abuse monitoring and safety purposes, in line with its own terms.

8. Who else your information goes to

We use a small number of service providers to run Phantom. They act on our instructions and are bound by their own contracts and privacy obligations. We do not sell personal information and we do not share it with advertisers or data brokers.

Provider	What it does	What it handles
Shopify	Store, checkout, and payments	Name, email, billing address, order records
Payment processors used by our store	Take the payment	Card details, which go to them and not to us
Supabase	Authentication and database	Your login and everything you create in the portal
Vercel	Hosting for the portal	Requests, server and error logs
Anthropic	AI generation	Text you submit to the AI tools, plus account data used as context
Resend	Sends our automated emails	Email address, message content
ImprovMX and Google	Receive and hold support email	Anything in your emails to support

We may also disclose information if the law requires it, to respond to a valid legal request, to protect our rights or someone's safety, or to a buyer if the business is sold — in which case this policy continues to apply until you are told otherwise.

9. Where your information is stored

Our providers store data in the United States. If you are in the UK, EU, or elsewhere, using Phantom means your information is transferred to and processed in the US.

Where personal data is transferred out of the UK or EEA, we rely on the transfer mechanisms in our providers' data processing terms, including the European Commission's Standard Contractual Clauses and the UK Addendum where applicable.

10. How long we keep it

• Account and content: while your account is open, and for a short period after it closes so an accidental cancellation can be reversed.
• Deleted at your request: within 30 days of a verified request. See section 11.
• Transaction and tax records: kept as long as tax and accounting law requires, typically several years. These are kept even after account deletion, because we are required to keep them.
• Support email: kept while it is useful for support history, then deleted periodically.
• Security and server logs: kept for the retention period set by each provider, generally short.

11. Your rights and how to use them

Wherever you live, you can ask us to:

• See the information we hold about you
• Correct anything that is wrong
• Delete your account and the data attached to it
• Export a copy of the work you created, in a portable format
• Stop sending you marketing email, at any time

If you are in the UK or EU, you additionally have the right to restrict or object to certain processing, to withdraw consent where we relied on it, and to complain to your data protection authority. In the UK that is the Information Commissioner's Office. In the EU it is the authority in your country. We would rather you came to us first, but that right is yours regardless.

If you are in California, you have the right to know what we collect and why, to delete it, to correct it, and not to be treated worse for exercising those rights. We do not sell or share personal information as those terms are defined in California law, so there is no opt-out to offer you.

To use any of these rights, email support@phantomaisolutions.com from the address on your account. We will confirm it is you before acting, and we will respond within 30 days. There is no charge.

One honest note on deletion: account deletion is currently carried out manually by us rather than by a self-service button in the portal. The result is the same, and it happens within the window above.

12. Cookies

The portal uses cookies that are strictly necessary to work: they keep you logged in and keep your session secure. Blocking them means you cannot log in.

The store at phantomaisolutions.com is run on our store platform, which sets its own cookies for the cart, checkout, security, and its built-in store analytics. Where required by law, the store shows a cookie banner and lets you choose what is optional.

We do not currently run third-party advertising pixels or cross-site tracking. If that changes, this section and the banner change with it before any such cookie is set.

13. Marketing email

Transactional email — order confirmations, access details, password resets, security notices, billing notices — is part of the service and is sent regardless, because you need it.

Marketing email is only sent if you asked for it, either by subscribing or by ticking the option at checkout. Every marketing email has an unsubscribe link that works immediately, and our postal address at the bottom. Unsubscribing from marketing does not affect your access or your transactional email.

14. Security

What we do:

• All traffic is encrypted in transit
• Passwords are hashed by our authentication provider and are unreadable to us
• Row-level security on every table, so a member's records can only be returned to that member
• API keys and secrets are held as server-side environment variables and are never exposed in the browser
• One credential per service, so any one of them can be revoked without breaking the others

What we will not pretend: no system is perfectly secure, and no one can promise otherwise. If a breach affects your personal data and creates a real risk to you, we will tell you and the relevant authority within the time the law requires.

15. Children

Phantom is sold to adults. Accounts must be held by someone aged 18 or over, and we do not knowingly create accounts for anyone under 18.

A parent or legal guardian may buy Phantom for a younger person, and by buying it they approve that use. Where that happens, the account and everything in it belongs to the adult who holds it, and it is the adult who decides what the younger person puts into the tools.

If you believe someone under 18 has opened an account in their own name, email us and we will close it.

16. Changes to this policy

We will update this policy when the product, our providers, or the law changes. The date at the top always shows the current version. For changes that materially affect how we handle your information, we will tell you by email or inside the portal before they take effect.

17. Contact

If you have a privacy concern, write to us first. We will take it seriously and answer it.