Phantom Review privacy notice

About this service

This notice covers Phantom Review at phantom-review.vercel.app. It describes the review service, not every Ashlr product or your host's separate processing. Phantom Review runs remotely, not solely on your device.

Information and use

We process content supplied to the tools to perform the requested review. Depending on the tool, this can include selected text, vocabulary and notes, document or revision identifiers, proposed edits, reviewer labels, decisions, reasons and quotations, test reports and diagnostics, and task, evidence, handoff or setup metadata. These materials can contain personal information. Results may contain submitted and revised text and labels, not just hashes.

The plugin does not independently read your private files, accounts or full conversation. Your host or model can put selected material into tool arguments. Submit only what the task needs. Do not submit credentials, authentication codes, payment-card data, protected health information or government identifiers. Credential-pattern checks are not comprehensive.

Processing and recipients

Requests and results pass through your host, such as ChatGPT or another MCP client, and the Phantom Review service hosted by Vercel. The server performs deterministic checks without a separate model API call or an outgoing action to providers named in submitted plans. Your host's own model processing, conversation records and controls are separate.

The service processes requests in memory without a durable user-content database or a stored cross-request review session. The embedded view holds temporary inputs and results. This is not a promise that all copies are immediately erased. The application wrapper records fixed generic failure messages rather than submitted content. Hosting can also record operational metadata, including request times, paths, status codes, IP addresses and user agents, to operate, diagnose and protect the service.

Retention

Vercel's published standard runtime-log history windows are up to three days, depending on the hosting plan. Phantom Review currently has Observability Plus disabled and no configured log drains. The three-day figure describes standard runtime-log history, not a deadline for erasing every provider-held record. Other platform or security records, recovery copies and previously retained extended-history data may remain subject to Vercel's applicable retention processes and obligations.

If you contact support@ashlr.ai, we and our email service provider receive your contact details, messages and attachments to answer your request, troubleshoot the service or handle a privacy request. We remove resolved messages and attachments from active support systems no later than 90 days after the request is closed. If a legal obligation or an open security incident or dispute requires specific records, we retain only those records for that reason and remove them when it ends.

This 90-day policy concerns active support records, not a promise to erase every email-provider backup or recovery copy within 90 days. Provider-held recovery, backup and legally preserved copies follow their applicable retention processes.

Your controls and requests

The view's Clear control resets its temporary inputs and results. It does not delete host conversations, previously returned outputs or hosting records. Use your host's controls for its records. Email support@ashlr.ai with “Phantom Review privacy” for questions or requests concerning records under our control. Include only enough information to locate the request; do not send additional private documents or credentials. We may need appropriate information to verify a request without asking for unnecessary sensitive material. This notice does not promise immediate deletion or a particular response time.