Last updated 24 October 2026

Data Processing Agreement

This agreement sets out how SalesGhost Limited processes personal data on behalf of its customers. It forms part of our Terms of Service and applies automatically to every customer whose use of SalesGhost is subject to UK or EU data protection law, on free and paid plans alike. There is nothing to sign.

1. Parties and scope

This agreement is between SalesGhost Limited, a company registered in England and Wales with company number 16849068 (“SalesGhost”, “we”), and the person or organisation that has accepted our Terms of Service (the “Customer”, “you”). If a workspace is used on behalf of an organisation, that organisation is the Customer.

It covers personal data that we process on your behalf to provide SalesGhost (“Customer Personal Data”). That includes call audio, transcripts, speaker labels, recaps and follow-ups, meeting chat, calendar events, CRM context and the knowledge you add. You are the controller of that data, or a processor acting for your own controller, and we are your processor or subprocessor.

Data we process for our own purposes, such as accounts, billing, security, support and our own product analytics, is covered by our Privacy Policy, where we are the controller. Please do not include meeting content in messages to support.

“Data protection law” means the UK GDPR and Data Protection Act 2018, the EU GDPR, and any other data protection law that applies to the processing. Terms such as controller, processor, personal data, processing and personal data breach have the meanings given to them in that law. If this agreement conflicts with the Terms of Service on the processing of Customer Personal Data, this agreement prevails.

2. Our instructions

We process Customer Personal Data only on your documented instructions. Those instructions are this agreement, the Terms of Service, the settings you choose in SalesGhost and any further written instructions you send us that are consistent with them. If the law requires us to process data in any other way, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.

We do not use Customer Personal Data to train AI models, and we do not sell it, use it for advertising or combine it with other customers' data. Our AI suppliers process it only to provide the service to you and for their own security and abuse monitoring under their agreements with us, and do not use it to train their models.

3. Your responsibilities

You decide why and how SalesGhost is used, and you are responsible for having a lawful basis for that use. In particular, you are responsible for telling the people on your calls that SalesGhost transcribes the call and uses AI for guidance and notes, and for getting their consent where the law requires it.

SalesGhost is not designed for special category data, such as health information, or for criminal offence data. If your calls routinely involve that kind of data, tell us before you use SalesGhost for them so we can discuss whether suitable safeguards are in place.

4. Confidentiality and security

Only people who need access to provide, support or secure the service can access Customer Personal Data, and they are bound by confidentiality. We maintain the technical and organisational measures described in Schedule 2, and we will not change them in a way that materially reduces the protection they provide.

5. Subprocessors

You authorise us to use the subprocessors listed in Schedule 3. Each one is bound by a written contract that gives Customer Personal Data the protection required by Article 28 of the GDPR, and we remain responsible to you for their work.

Before a new subprocessor starts processing Customer Personal Data, we will update this page and email everyone who has asked to be notified at least 30 days in advance. To be notified, email privacy@salesghost.app. You can object on reasonable data protection grounds within that period. We will then work with you in good faith on an alternative. If we cannot resolve the objection, you may stop using the affected service and we will refund any prepaid fees for the unused period. Changes to which of the listed model hosts serves a request through OpenRouter do not need notice.

6. International transfers

We store Customer Personal Data in London. Requests to AI suppliers are relayed through AWS in London or, for the post-call agent, the United States. Transfers from the European Economic Area to SalesGhost rely on the European Commission's adequacy decision for the United Kingdom. If that decision ceases to apply, the European Commission's Standard Contractual Clauses (Module 2, or Module 3 where you are a processor) are incorporated into this agreement and apply to those transfers. For those Clauses: Module 2 applies where you are a controller and Module 3 where you are a processor; Clause 7 applies; Clause 9 Option 2 applies with the notice period in section 5; the optional language in Clause 11 does not apply; under Clauses 17 (Option 1) and 18, the law and courts of Ireland apply; section 1 and your account record form Annex I.A, Schedule 1 forms Annex I.B, Schedule 2 forms Annex II and Schedule 3 forms Annex III.

Where a subprocessor processes data outside the UK or the European Economic Area, we rely on an adequacy decision, including the UK Extension to the EU-US Data Privacy Framework for certified suppliers, or on the Standard Contractual Clauses with the UK International Data Transfer Addendum in our agreement with that supplier.

7. Helping with people's rights

You can export your data and delete meetings yourself in SalesGhost and at salesghost.app/account/privacy. Where you need more help to answer a request from someone exercising their data protection rights, we will assist you. If someone sends such a request to us directly about Customer Personal Data, we will pass it to you and will not answer it ourselves unless you ask us to or the law requires it.

8. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will tell you what happened, the data and people affected, the likely consequences and what we are doing about it, and update you as we learn more. We will cooperate with you on any notifications you need to make to regulators or the people affected.

9. Assessments and regulators

We will give you the information you reasonably need about our processing to complete data protection impact assessments and any prior consultation with a regulator, and we will cooperate with regulators on request.

10. Deletion and return

At the end of the service you choose whether we return or delete Customer Personal Data. You can download it at any time at salesghost.app/account/privacy or ask us for an export. When you delete your account, we delete your meetings, private knowledge and connected calendars from our live systems within 30 days. Content shared with a workspace stays with that workspace. To close a workspace and delete its content, or when our agreement ends, email privacy@salesghost.app and we will delete it from our live systems within 30 days, unless the law requires us to keep it. Copies in database recovery history expire within 7 days after that, and service logs within 30 days. Earlier versions of files you replaced are deleted with the file. We do not restore deleted data to live use.

While you use SalesGhost, transcripts, recaps and meeting chat are kept for the retention period chosen for your workspace in Settings, Privacy. Call audio is streamed for transcription and is not stored by SalesGhost.

11. Information and audits

We will make available the information you reasonably need to show that we meet our obligations under this agreement and Article 28 of the GDPR, including answers to security questionnaires. If that information is not enough, you or an independent auditor you appoint may audit our compliance once a year, with 30 days' notice, at your cost and under a duty of confidentiality. Additional audits are allowed after a personal data breach affecting you or when a regulator requires one.

12. Liability, duration and changes

Each party's liability under this agreement is subject to the limitations in the Terms of Service, except where data protection law does not allow liability to be limited. This agreement applies for as long as we process Customer Personal Data. It is governed by the laws of England and Wales, except where the Standard Contractual Clauses require otherwise.

We may update this agreement to reflect changes in law or in our service. We will not reduce the protection it gives Customer Personal Data, and we will tell customers about material changes before they take effect.

If your organisation needs a signed copy, email privacy@salesghost.app.

Schedule 1: Details of the processing

  • Purpose - Providing SalesGhost: live transcription and guidance on calls, meeting preparation, recaps and follow-ups, meeting chat, checklists, the knowledge base and connected calendars and CRMs
  • Processing - Capture, transmission, transcription, storage, retrieval, AI analysis, display, export and deletion
  • People - Your staff and contractors, and the prospects, customers and others who take part in your calls or appear in your calendars, CRM records and knowledge
  • Data - Voice audio, names, contact and job details, meeting details and participation, transcripts, notes, recaps, chat messages, AI inputs and outputs, CRM records and the contents of your documents and imported web pages
  • Special category data - Not intended; see section 3
  • Frequency - Continuous while you use SalesGhost and while connected services sync
  • Duration - For as long as you use SalesGhost, then as set out in section 10

Schedule 2: Security measures

  • Encryption in transit (TLS 1.2 or later) and at rest
  • Database and file storage in London, in private storage that blocks public access
  • Server-side access checks on every request for calls and knowledge, scoped to the signed-in user and their workspace
  • Calendar access tokens encrypted at the application layer, on top of database encryption at rest
  • Sign-in through WorkOS, with single sign-on available for organisations
  • Production secrets held in AWS Secrets Manager, and production access limited to named SalesGhost staff
  • Short-lived credentials for the desktop app's connection to transcription
  • Encrypted pending uploads in the desktop app, and removal of the app's local copy when you sign out or your session ends
  • Database recovery history kept for 7 days and service logs for about 30 days
  • Product analytics and error reports that exclude call audio, transcripts and notes

Schedule 3: Subprocessors

These suppliers may process Customer Personal Data. Some are used only when you use the related feature.

  • Amazon Web Services - API hosting, file storage and logs. United Kingdom (London); post-call agent model requests from the Americas are relayed through AWS in the United States
  • Neon - Application database and its 7-day recovery history. United Kingdom (London)
  • AssemblyAI - Live transcription of call audio. European Union (desktop versions released before the EU service used the United States service)
  • OpenRouter - Routing AI requests for live guidance, meeting preparation and web research, recaps and document reading. United States
  • Google, OpenAI and Microsoft Azure, through OpenRouter - Hosting the AI models that answer those requests. United States and other countries
  • OpenAI - The optional practice call with an AI buyer and the optional post-call agent. United States
  • Vercel - Website and account dashboard hosting, and knowledge imports from websites. United States
  • WorkOS - Sign-in, single sign-on and workspace membership. United States
  • Resend - Account emails, such as workspace invitations. United States

Calendars, CRMs and other services you connect are not our subprocessors. They process data under your own agreements with them.

Contact

SalesGhost Limited
Willow Cottage, Nuthampstead, Royston, Hertfordshire, SG8 8ND, United Kingdom
Email: privacy@salesghost.app