Privacy Policy

Who we are

GetPhantom provides marketing management for owner-led service businesses and is based in Oshawa, Ontario, Canada. This policy explains how we handle personal information for visitors to this website. You can reach us any time at inbox@getphantom.io.

What we collect

If you fill out the form on the home page to get your 3 marketing priorities, we collect what you enter: your name and email address and, if you add them, your phone number, your website, your Google Business Profile link, where you think you lose customers, and a note. We also record which page of the site the form was on and how you reached the site: the website that linked to it, or the ad or campaign tag in the link you clicked.

Like most websites, our host also records basic technical information such as an IP address and browser type for security and to keep the site running. We measure page usage with privacy-friendly, cookieless analytics that does not identify you. We do not run advertising trackers or sell data to anyone.

Why we collect it

We use the details from the form for one thing: to review your business, send you your 3 marketing priorities and follow up about working together. We do not use it for unrelated marketing, and we never sell or rent it.

Sub-processors

To run the service we rely on a few trusted third-party providers, called sub-processors. Those details may pass through them so we can store and act on what you send. Each one processes that data only on our behalf, under its own data processing agreement (DPA) and data-protection terms:

Vercel (website hosting and delivery). Supabase (our database, where a copy of your form submission is stored). Resend (sends the form submission to us by email). Telegram (delivers a copy of the form submission to our phone).

We do not add other sub-processors without updating this list, which lives on our sub-processors page. If you need a copy of a provider's DPA, email inbox@getphantom.io and we will point you to it.

Google Ads accounts we manage

For clients whose advertising we run, we work inside their own Google Ads account through Google's API. Every account we touch is linked under our manager account, and that link is accepted by the account's own administrator. We do not access accounts we do not manage, and no visitor or client ever signs in to Google through this website.

The connection is server to server, from our own infrastructure, using one credential that belongs to our manager account. What we read is advertising performance: campaigns, ad groups, keywords, search terms and the money spent against them. What we write is the advertising itself: campaign, ad group, keyword and ad changes, and conversion events.

Conversions are the part that involves a person. When somebody fills in a client's form or taps their phone number, we report that to Google as a conversion so the client can see which ads produce real enquiries. That report can carry a hashed copy of the phone number or email address the person typed into the client's own form, which is what lets Google match the enquiry to the ad click that led to it. The hashing happens before anything leaves the browser, so Google receives a fingerprint and not the number itself, and we send nothing else about that person. Later, when an enquiry turns into money at the counter, we can report the amount against the same click.

What comes back from Google is stored in our own database (Supabase) and used for one thing: running and reporting on that client's advertising. We do not combine it with any other client's data, we do not build advertising audiences from it, we do not sell or transfer it, and we do not use it to train models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How long we keep it

We keep this information for as long as we are in contact or working together, and for a reasonable period afterward in case you come back. You can ask us to delete it sooner at any time.

Your choices

You can ask to see, correct, or delete the personal information we hold about you. Email inbox@getphantom.io and we will take care of it. We follow Canada's PIPEDA rules for handling personal information.

Changes to this policy

If we change how we handle information, we will update this page and the date below. For anything that is not clear here, just ask us directly.