The real problem is the WiFi spot itself. Some are fully open, meaning that they let any traffic in and out, but others are secured (*). Many hotel wifi hotspot only allow the following traffics:
- SMTP over port 25 (basic), 465 (SSL), 587 (STARTTLS) for sending mail
- POP over port 110, or IMAP over 143 (basic) or 993 (SSL) for reading mail
- HTTP over port 80 or HTTPS over port 443 via their own (transparent) proxy
- DNS to their local relay only
Depending on the way the client VPN works (and I could not guess from their internet page) it can work smoothly or not at all. I use a professional (private) VPN to connect to my corporate network from the outside, and it often does not work with hotel Wifi hostspots.
Anyway, it looks like GhostVPN is intended to do a good job to hide your address. I'm unsure it is intended to protect the data exchanged. HTTPS is normally enough to protect your data provided you:
- ensure that you only type secret data on a HTTPS page
- ensure the domain of the page is correct and belongs to your bank (for example)
- ensure that the certificate provided by the server is a valid one and don't type any secret if it is not valid for the domain used
If you do not control that, a VPN will not protect you anyway because it only encrypts traffic between you client machine and its final server but cannot do anything for what happens after.
(*) when their offer a wifi service to their clients, hotels become de facto Internet Service Providers. As such in case of legal inquiry, some countries require that they can give logs of Internet traffic. If they cannot, and if their network was used for illicit operations, they can be prosecuted for complicity.