Privacy Policy – Smart Search for Ghost

These Product‑Specific privacy terms supplement the Website Privacy Policy at https://visitingobjects.com/docs/legal/privacy (the "Site Policy"). Capitalised terms not defined here have the meanings given in the Site Policy.

1. Scope and roles

Visiting Objects operates Smart Search for Ghost (the "Service") as a processor of the content you choose to index and as a controller of the account, billing and usage data required to run the Service.

2. Data we process

Category	Purpose	Examples
Indexed content	Provide search results to your site visitors	Ghost posts, pages, titles, tags, excerpts
Search‑usage metrics	Improve relevance; show analytics in your dashboard	Query text, timestamp, document IDs clicked
Operational logs	Maintain security and debug errors	HTTP status, truncated IP address, user‑agent
Account & billing	Authenticate users, collect payment	Name, e‑mail, Paddle customer ID

No biometric, precise‑location, or behavioural advertising data is collected.

3. Data location

Data is stored in the United States.

Third-party processors:

• Payment processing: Paddle

4. Retention and deletion

Data type	Retention	Deletion timing
Indexed content	While the Search Instance is active	Removed immediately when you delete the instance; purged from backups within 30 days
Search‑usage metrics	Rolling 30‑day window	Older records automatically dropped
Operational logs	≤ 14 days in ephemeral buffer	Not persisted to disk
Backups	Encrypted object storage; 2‑week cycle	Overwritten on the next cycle after deletion event

5. Security measures

• Encryption in transit and at rest.
• Access controls and authentication.
• Code review and security testing.

6. International data transfers

For data transfers outside the EEA or UK, we rely on Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum where applicable.

7. Your controls and rights

• Dashboard controls – pause or delete an index at any time; opt‑out of anonymous telemetry.
• GDPR/CPRA rights – access, rectify, erase, restrict, object; response within 30 days via privacy@visitingobjects.com.
• Portability – not applicable; indexed content comes from your own Ghost CMS site and can be exported there.

8. Children

The Service is not offered to individuals under 18. You must ensure your Ghost site complies with children's‑privacy laws if it targets minors.

9. Cookies and similar tech

The Service itself does not set cookies on your visitors. Paddle sets essential cookies during checkout; see the Site Policy for details. Plausible Analytics used on the dashboard is cookie‑less.

10. Updates

Material changes to this policy will be posted here at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the revised terms.

---

For questions contact: privacy@visitingobjects.com