Privacy Policy

Who we are

GetPhantom is a done-for-you automation service for local service businesses, based in Ontario, Canada. This policy explains how we handle personal information for visitors to this website. You can reach us any time at inbox@getphantom.io or +1 (289) 367-9105.

What we collect

If you fill out the discovery call request or any contact form, we collect the details you give us: the name and business name you provide, a link to the website or Instagram you run, and an email or phone number so we can reply.

If you use the Business Bottleneck Scorecard, we store your answers and the resulting scores. If you ask for the emailed Operations Gap Report, we also ask a few extra questions about how the problem shows up in your business (where it starts, how often it happens, who owns it, what systems are involved, and what happens when it breaks), along with the name, business name, work email and website you enter and the revenue range, team size and business type you select, so we can send your report and follow up. That report is personalised in the sense that its content is selected from your answers, but it is generated by a fixed rules engine, not an AI model, so the same answers always produce the same report.

If we can generate a report, we store the answers, qualification details (revenue range, team size, business type) and the context questions above in our database, so the report can be shown again on a private, signed web page without you having to redo the Scorecard. Nothing we render is stored as finished text; the page is rebuilt from those stored answers every time it is opened. That page is reachable only through an unguessable signed link sent to you, is never listed in search results, and is served with a 'do not cache' response header.

If you request the free 20-minute Operations Review (with or without the Scorecard), we collect what you enter on that form: your name, business name, work email, phone number, website or Google Business Profile, business type, revenue range, team size, a description of what keeps going wrong with one recent example and its consequence, the systems involved as far as you know them, your preferred contact method, timezone or location, and the investment range you say would be comfortable. If you arrive from a completed Scorecard, the request also carries your Scorecard priority so Ross can prepare. The request is followed up through our CRM (GoHighLevel), as described below.

Like most websites, our host also records basic technical information such as an IP address and browser type for security and to keep the site running. We measure page and scorecard usage with privacy-friendly, cookieless analytics that does not identify you. We do not run advertising trackers or sell data to anyone.

The site also has a chat you can open in the corner of the page. If you type a message into it, that message is sent to an automated assistant that generates a reply. If you ask to be contacted, we use what you typed to follow up with you.

Why we collect it

We use the details from the form for one thing: to set up your discovery call and follow up about working together. We do not use it for unrelated marketing, and we never sell or rent it.

Sub-processors

To run the service we rely on a few trusted third-party providers, called sub-processors. Those details may pass through them so we can store and act on what you send. Each one processes that data only on our behalf, under its own data processing agreement (DPA) and data-protection terms:

Vercel (website hosting and delivery). GoHighLevel (the CRM where we create a contact record, track our conversation and follow up on Operations Review requests). Trigger.dev (moves the form submission from the site into the CRM). OpenAI (chat assistant — processes the messages you type into the site chat to generate replies, using the gpt-4o-mini model; data category: chat message content). Supabase (application database — stores submission records and operational data, such as a reference to your CRM contact and timestamps, used to run the service and prevent duplicate processing, and stores your Scorecard answers, qualification details and report context so your signed Operations Gap Report page can be shown again; data category: contact reference, submission metadata, Scorecard answers and report inputs).

We do not add other sub-processors without updating this list, which lives on our sub-processors page. If you need a copy of a provider's DPA, email inbox@getphantom.io and we will point you to it.

GetPhantom Review System

If you apply for the GetPhantom Review System on our /reviews page, the form is short: we collect your name, business name, work email, an optional phone number, a link to your Google Business Profile or website, and an optional note. The application never collects your customer list.

The application is a lead, so it flows into our CRM (GoHighLevel) the same way as other form submissions: we create a contact record, a note with the application context, an opportunity and a follow-up task, and we email you a confirmation. We do not ask you to send your customer list by ordinary email.

If you become a Review System client, then after an agreement we help set up review requests for your business. At onboarding we gather the rest of the setup details (your software, customer volume, social pages and your written confirmation that you have a lawful basis to contact your customers). At that stage additional data flows through the service: your connected Google Business Profile and social accounts, the eligible past-customer contacts you transfer through an approved secure method (not through this website), the SMS and email requests sent on your behalf, the public review data (rating, text and the reviewer display name Google exposes) we monitor, and the branded personalized images we generate. Personalized images are generated within our own hosting (Vercel), show a customer's first name only, and are served through unguessable links; we do not add an outside image provider unless we tell you and list it here first.

You remain responsible for having a lawful basis to contact your customers. We will not send review requests to purchased lists or to contacts without a genuine customer relationship, we apply do-not-contact and unsubscribe suppression, and we never gate, hide or filter reviews by predicted satisfaction. This is not legal advice; for a list you are unsure about, we recommend your own legal review.

How long we keep it

We keep this information for as long as we are in contact or working together, and for a reasonable period afterward in case you come back. You can ask us to delete it sooner at any time.

Your choices

You can ask to see, correct, or delete the personal information we hold about you. Email inbox@getphantom.io and we will take care of it. We follow Canada's PIPEDA rules for handling personal information.

Changes to this policy

If we change how we handle information, we will update this page and the date below. For anything that is not clear here, just ask us directly.