Privacy policy
Last updated: 13 September 2026
Overview
GhostClick is operated by Morecheckouts Limited, a company registered in the United Kingdom (“we”, “us”). GhostClick is a standalone application available at getghostclick.com, and the same application running embedded inside the Shopify admin for merchants who install it from the Shopify App Store. This policy explains what data we collect through either route, why, and how we handle it.
How you sign in
Standalone accounts
If you create an account at getghostclick.com, you sign in with Google. We receive your name and email address from Google and never see or store your Google password.
Shopify-installed accounts
If you install GhostClick from the Shopify App Store, your account is created automatically using Shopify's native OAuth flow. Shopify issues an offline access token scoped to your store, which we store encrypted at rest (AES-256-GCM) and use only to make the read-only Admin API calls described below. We never see or store your Shopify account password.
What we collect
Account information
Your email address, and — if you connect a Shopify store — your store's domain and the Shopify plan associated with it.
Journey definitions
The audit URL, the journey goal you write, any constraints you add, and any store password or login details you provide so a journey can get past a password- or login-protected page.
Screenshots and run logs
Screenshots of your own storefront captured during a simulated audit, the navigation steps the AI took, its reasoning, and the issues it detected. Screenshots are stored on Cloudflare R2.
Payment information
If you're billed through Stripe, payments are processed by Stripe and we do not store your card details. If you're billed through Shopify Billing, your subscription is managed by Shopify and appears on your regular Shopify invoice. Stripe's and Shopify's own privacy policies apply to that payment data.
Usage data
Basic usage data — pages visited, audits run, timestamps — which helps us operate and improve the Service. We do not use third-party advertising or analytics trackers.
What we do NOT collect
- We do not collect data from real visitors to your store. GhostClick's audits are performed by an AI agent in an isolated cloud browser session, not by a script running on your storefront.
- We do not install scripts, cookies, or tracking pixels on your storefront.
- We do not access your Shopify customer list, order history, or analytics, and we never store shopper personal data from your store.
- Shopify-installed accounts only grant GhostClick read-only access to your themes and products, requested solely to prefill audit URLs and suggest journey templates.
How we use your data
- To provide and operate the Service, including running audits you request or schedule
- To analyse screenshots and generate your audit reports
- To send alerts you've configured (email, and Slack once connected)
- To communicate with you about your account
- To process payments and manage your subscription
We do not sell your data. We do not share your data with third-party advertisers.
Sub-processors
We use the following sub-processors to operate the Service:
- Vercel — application hosting
- Supabase — authentication and database
- Cloudflare R2 — screenshot storage
- Browserbase — cloud browser sessions used to run audits
- Google (Gemini) — the navigation model that drives the AI agent
- Anthropic — the model used for screenshot analysis and report writing, accessed via the Vercel AI Gateway
- Stripe — payment processing for standalone accounts
- Shopify Billing — subscription billing for accounts installed from the Shopify App Store
- Resend — transactional and alert email delivery
- Slack — alert delivery, only if you connect a Slack workspace
- Inngest — background job scheduling for audits, monitoring, and alerts
Each sub-processor has its own privacy policy and only receives the data it needs to perform its function.
Data retention
Audit reports and screenshots are retained while the audit exists, and are deleted when the audit or your account is deleted. When you delete your account, or ask us to, we delete your data. We may retain anonymised, aggregated data for analytics purposes.
Shopify compliance and GDPR
For merchants who install GhostClick from the Shopify App Store, we honour Shopify's mandatory compliance webhooks:
- Shop redact — when Shopify notifies us a store's data must be redacted, we delete our stored access token and mark the connection as uninstalled.
- Customer data request / customer redact— acknowledged automatically. GhostClick does not store shopper personal data, so there is nothing held about an individual customer to return or delete.
Under UK GDPR and the EU GDPR, you have the right to:
- Access the data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Object to processing of your data
To exercise any of these rights, email us at support@getghostclick.com.
Cookies
We use essential cookies for authentication (keeping you signed in, including inside the Shopify admin iframe). We do not use tracking cookies or advertising cookies.
Legal basis and location
GhostClick is operated by Morecheckouts Limited, based in the United Kingdom. We process your data on the basis of performing our contract with you (providing the Service) and our legitimate interests in operating and improving it. Where required, we rely on your consent.
Changes
We may update this policy. Material changes will be communicated via email. The “last updated” date at the top reflects the most recent revision.
Contact
Questions about privacy, or a data request? Email us at support@getghostclick.com.
Morecheckouts Limited
United Kingdom