Privacy Policy

Version 1.1 · 15 August 2026

This notice describes the current Phantom AI website, Private Preview, payment and manually approved outreach data flows. Stripe Production Commerce is available only through approved Private Preview purchase flows; Phantom AI does not operate a public storefront.

1. Controller

ING Bleek UG (haftungsbeschränkt)
Rosa-Luxemburg-Straße 17
10178 Berlin
Germany

Represented by Managing Director Luca Ingenbleek.

Email: luca@phantom-ai.io

2. Website and runtime logs

When you visit the website, the hosting and runtime infrastructure may process your IP address, request time, requested URL, browser or device information, referrer, response status and security-related log data. This is used to deliver the site, diagnose faults, prevent abuse and maintain security. The legal basis candidate is our legitimate interest in operating a reliable and secure B2B website (Article 6(1)(f) GDPR).

The website is hosted on Vercel. Exact production log-retention settings and the corresponding processor documentation are maintained as ongoing operational compliance work. No fixed retention period is stated without evidence.

3. Private Previews

A Private Preview is reached through an opaque, personalized URL. We process the business name, preview and build references, the assets selected for display, offer information, expiry or revocation state, and provider-neutral attribution identifiers. The browser also creates a random anonymous session identifier in session storage so a preview opening can be recorded without placing personal details in the URL. It is removed when the browser session ends.

Private Preview pages are marked noindex, nofollow and noarchive. This reduces discovery by search engines but is not document DRM. Access may still be withdrawn or expire. Preview responses and assets are served with private/no-store controls where supported.

The purpose is to show a personalized B2B offer, operate the purchase flow, prevent abuse and retain accurate commercial attribution. Depending on the stage of the relationship, the legal basis candidates are steps requested before a contract (Article 6(1)(b) GDPR) and our legitimate interest in providing and protecting the personalized preview (Article 6(1)(f) GDPR).

4. Checkout and payment

If you choose to purchase through an approved Private Preview, Stripe-hosted Checkout may collect your email address, name, business or billing details, billing address and, if deliberately enabled, tax identification details. Stripe processes payment-card data. Phantom AI does not receive or store full card details.

We retain only the provider identifiers, payment state, amount, currency, timestamps, offer and preview attribution, and the billing or business information needed for fulfillment, accounting and support. Payment completion is recorded only after a signed Stripe webhook is verified. The legal basis candidates are contract performance (Article 6(1)(b) GDPR) and applicable accounting or tax obligations (Article 6(1)(c) GDPR).

Stripe is the payment recipient/processor for this flow. Automatic Stripe Tax is not enabled in the current implementation.

5. Fulfillment and corrections

After verified payment, we may process the purchaser’s name, role, business email, business phone, address, professional credentials and a limited correction note where these facts are required to finalize the purchased assets. We use this information only to verify factual details, correct Phantom production errors, complete final QA and deliver the personalized set privately.

6. Public contact and manually approved outreach

If you submit the public contact form, we process your name, work email, company or website, message, submission time, source and inquiry status so we can review and respond to your request. The inquiry is stored in the private Phantom database on Supabase. Resend sends one operational notification to Phantom AI; it is not an outreach message, does not subscribe you to marketing and contains no open-tracking pixel or click-tracking link. The legal basis candidates are steps requested before a contract (Article 6(1)(b) GDPR) and our legitimate interests in responding to relevant B2B inquiries and protecting the form from abuse (Article 6(1)(f) GDPR).

The form uses a honeypot and short-lived server-side rate limiting. Hosting and security logs may contain the request data described in section 2. A direct email link remains available; if you use it, your email provider and ours process the message and its metadata so we can respond.

For individually approved B2B outreach, Phantom AI may process a professional recipient’s name, business email address, company, message content, delivery status and reply or suppression status. Resend is used as an email delivery provider for this controlled workflow. We do not use an open-tracking pixel or invisible beacon. The legal basis candidate is our legitimate interest in relevant, restrained business-to-business outreach (Article 6(1)(f) GDPR), subject to the applicable communications rules and a case-specific pre-send review.

You can object to further outreach at any time by replying or emailing luca@phantom-ai.io.

7. Service providers and transfers

The currently identified providers are Vercel for website hosting and runtime, Supabase for the private operational database, Stripe for hosted payment processing, and Resend for controlled email delivery. These providers may process data in the United States or other countries outside the EEA depending on the account configuration. Detailed processor agreements, regional settings, retention settings and transfer documentation are maintained as ongoing operational compliance work; this notice does not claim a fixed provider region or retention period where one has not been established.

8. Analytics, cookies and local storage

Google Tag Manager is disabled. The current production-facing site does not intentionally deploy an analytics tracker or marketing cookie. Private Preview uses the session-only random identifier described above. Stripe may use its own necessary technologies after you choose to leave Phantom AI for hosted Checkout; Stripe’s own notice applies there.

9. Retention

Exact production retention periods have not yet been approved. No fixed duration is stated as fact in this notice. Commercial, payment and accounting records must be retained only for the period required by the applicable contract, accounting, tax, limitation and security obligations; contact inquiries, previews, outreach and runtime-log retention schedules remain ongoing operational compliance decisions.

10. Your rights

Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability of your personal data, and may object to processing based on legitimate interests. You may also lodge a complaint with a competent data-protection supervisory authority.

For any privacy request, email luca@phantom-ai.io. We may need to verify your identity before acting on a request.

11. Changes

This notice will be versioned when the actual data flows, providers or approved retention and transfer settings change. Historical operational records are not silently rewritten by a policy update.