Privacy Policy | Phishfy

Privacy Policy

Phishfy LLC

Effective Date: May 14, 2025

Last Updated: Jun 07, 2026

This document governs how Phishfy LLC collects, uses, and protects personal data in connection with its phishing simulation, security awareness training, and related cybersecurity services. Please read it carefully before using our platform.

1. Who We Are

Phishfy LLC ("Phishfy," "we," "our," or "us") is a limited liability company incorporated in the State of Delaware, United States, with principal offices located in Orlando, Florida.

We develop and operate a phishing simulation and security awareness training platform designed to help organizations reduce human cyber risk. Our services are provided to businesses, government entities, managed security service providers (MSSPs), and other organizations ("Clients") and their employees ("End Users").

Legal name: Phishfy LLC
State of incorporation: Delaware, USA
Principal office: Orlando, Florida, USA
Email: [email protected]
Website: https://www.phishfy.com

2. Scope of This Policy

This Privacy Policy applies to:

Our website (www.phishfy.com) and any related subdomains
The Phishfy platform and all associated products and services
Communications between Phishfy and Clients, partners, prospects, or End Users
Any offline interactions where we reference this Policy

This Policy does not apply to third-party websites, applications, or services linked from our platform. We encourage you to review the privacy policies of those third parties independently.

3. Information We Collect

3.1 Information You Provide Directly

When you register for an account, purchase services, or contact us, we may collect:

Full name and professional title
Work email address and phone number
Company name, size, and industry
Billing address and payment information (processed via PCI-compliant third-party processors)
Login credentials (passwords are stored in hashed form and never in plain text)
Support requests, survey responses, and other communications

3.2 Information Collected Automatically

When you use our platform, we automatically collect certain technical and usage data, including:

IP address and approximate geolocation (country/city level)
Browser type, version, and operating system
Pages visited, features accessed, and actions taken within the platform
Session duration and navigation patterns
Device identifiers and referring URLs
Error logs and performance data

We collect this data using cookies, web beacons, server logs, and similar tracking technologies. Please see Section 9 (Cookies and Tracking) for more information.

3.3 Simulation and Training Data

As part of our core services, we process data related to phishing simulations and awareness training conducted on behalf of our Clients. This may include:

Employee email addresses and display names used in simulations
Click-through rates, link interactions, and attachment opens
Quiz scores, training completion rates, and behavioral metrics
Department, role, or group segmentation data provided by the Client

This data is collected and processed under the instructions of the Client organization, which acts as the data controller. Phishfy acts as a data processor in this context and processes such data solely to deliver the contracted services.

3.4 Information from Third Parties

We may receive information about you from:

Our partner ecosystem (resellers, MSSPs, and value-added resellers)
Integration platforms connected to your account (e.g., Azure AD, Okta, Google Workspace)
Publicly available sources for business contact enrichment
Marketing and analytics providers

4. How We Use Your Information

Phishfy uses personal information for the following purposes:

4.1 Service Delivery

Provision, configuration, and maintenance of the Phishfy platform
Execution of phishing simulation campaigns on behalf of Clients
Delivery of security awareness training content and assessments
Account management, billing, and customer support
Technical troubleshooting and platform improvements

4.2 Communications

Sending transactional notifications (account alerts, reports, receipts)
Providing product updates, security advisories, and service announcements
Sending marketing communications, where permitted by applicable law and your preferences
Responding to inquiries and support requests

4.3 Analytics and Product Development

Analyzing platform usage and performance metrics
Conducting research to improve our services and develop new features
Generating aggregated and anonymized industry benchmarks and threat intelligence reports

4.4 Legal and Compliance

Complying with applicable laws, regulations, and legal processes
Enforcing our Terms of Service and other agreements
Detecting, preventing, and investigating fraud, abuse, or security incidents
Protecting the rights, property, and safety of Phishfy, our Clients, and third parties

5. Legal Basis for Processing (GDPR / LGPD)

If you are located in the European Economic Area (EEA), the United Kingdom, or Brazil, we process your personal data based on one or more of the following legal bases:

Contract performance: Processing necessary to provide the services you have contracted with us or your employer has contracted on your behalf
Legitimate interests: Processing for our legitimate business interests, such as improving our services, preventing fraud, and communicating with existing customers, provided these interests are not overridden by your fundamental rights
Legal obligation: Processing required to comply with applicable law
Consent: Processing based on your freely given, specific, informed, and unambiguous consent, which you may withdraw at any time without affecting prior processing

Where Phishfy acts as a data processor on behalf of a Client, the legal basis for processing is determined by the Client as the data controller.

6. How We Share Your Information

We do not sell your personal information. We may share it only in the following circumstances:

6.1 With Clients and Authorized Administrators

If you are an End User participating in a phishing simulation or training program, your behavioral and training data is visible to the administrators designated by your employer (the Client). Phishfy does not control how Clients use this information and encourages End Users to review their employer's internal privacy policies.

6.2 With Service Providers

We share information with trusted third-party vendors who assist us in operating our platform, subject to confidentiality obligations and data processing agreements. These include:

Cloud hosting and infrastructure providers (e.g., AWS, Google Cloud)
Payment processors (e.g., Stripe)
Email delivery services
Customer support and CRM platforms
Analytics and product monitoring tools
Identity and access management providers

6.3 With Partners

With your consent or pursuant to a partner agreement, we may share information with our resellers, MSSPs, and channel partners to facilitate service delivery, billing, and support.

6.4 For Legal Reasons

We may disclose your information when required by law, court order, or government authority, or when we believe disclosure is necessary to protect the rights, safety, or property of Phishfy, our users, or the public.

6.5 Business Transfers

In the event of a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website prior to such transfer and any change in the applicable Privacy Policy.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Our general retention practices are as follows:

Account and contract data: Retained for the duration of the contractual relationship plus five (5) years, for legal and accounting purposes
Simulation and training data: Retained as configured by the Client, with a default retention period of twenty-four (24) months from the date of collection
Website analytics data: Retained for thirteen (13) months
Marketing communications data: Retained until you unsubscribe or request deletion
Legal hold data: Retained as required by applicable legal or regulatory obligations

Upon expiration of the applicable retention period, we securely delete or anonymize personal information.

8. International Data Transfers

Phishfy is headquartered in the United States. If you are accessing our services from outside the United States — including from the European Economic Area, the United Kingdom, or Brazil — your personal information will be transferred to, stored, and processed in the United States.

We take appropriate safeguards to ensure that such transfers comply with applicable data protection laws, including:

Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA
UK International Data Transfer Agreements (IDTAs) for transfers from the United Kingdom
Contractual safeguards aligned with the requirements of Brazil's Lei Geral de Proteção de Dados (LGPD)

9. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and platform. The types of cookies we use include:

Strictly necessary cookies: Essential for core platform functionality and security (e.g., session management, authentication)
Performance cookies: Used to measure and analyze website traffic and usage patterns
Functional cookies: Used to remember your preferences and personalize your experience
Marketing cookies: Used to deliver relevant advertising and measure campaign effectiveness (subject to your consent where required)

You may manage your cookie preferences through our cookie consent banner or through your browser settings. Note that disabling certain cookies may affect platform functionality.

On our public website, optional Google Analytics 4 measurement loads only after you accept analytics. Your choice is saved in your browser for up to one year and can be changed using Cookie preferences in the footer. Website analytics events exclude form values and game player names. Advertising tracking is disabled.

10. Your Privacy Rights

Depending on your location and applicable law, you may have the following rights with respect to your personal information:

Right of access: Request a copy of the personal information we hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your personal data, subject to legal retention requirements
Right to restriction: Request that we limit processing of your data under certain circumstances
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests or for direct marketing purposes
Right to withdraw consent: Withdraw previously given consent at any time without affecting prior processing
Right to non-discrimination: Exercise your privacy rights without being subjected to discriminatory treatment

For End Users who are employees of a Client organization, please note that your primary point of contact for exercising data rights may be your employer, who acts as the data controller for simulation and training data.

To exercise your rights, please submit a request to [email protected]. We will respond within thirty (30) days, or the timeframe required by applicable law. We may request verification of your identity before fulfilling your request.

11. Security

Phishfy implements industry-standard technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. Our security practices include:

Data encryption at rest and in transit (TLS 1.2 and above)
Role-based access controls and principle of least privilege
Multi-factor authentication (MFA) for platform access
Regular penetration testing and vulnerability assessments
Security incident response procedures
Employee security training and background checks

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you as required by applicable law.

12. Children's Privacy

Our platform and services are directed exclusively to business organizations and their employees. We do not knowingly collect personal information from individuals under the age of 16 (or the applicable minimum age in your jurisdiction).

If you believe we have inadvertently collected information from a minor, please contact us immediately at [email protected] and we will take prompt steps to delete such information.

13. Third-Party Links and Integrations

Our platform may contain links to third-party websites or integrate with third-party services (such as identity providers, SIEM platforms, or ticketing systems). This Privacy Policy does not apply to those third-party services.

We encourage you to review the privacy policies of any third-party service you access through or in connection with our platform. Phishfy is not responsible for the privacy practices of third parties.

14. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights.

In the preceding twelve (12) months, Phishfy has not sold or shared personal information for cross-context behavioral advertising. We do not sell personal information.

California residents have the right to:

Know what personal information we collect, use, disclose, and sell
Delete personal information, subject to certain exceptions
Correct inaccurate personal information
Opt out of the sale or sharing of personal information
Limit the use and disclosure of sensitive personal information
Non-discrimination for exercising these rights

To submit a verifiable consumer request, contact us at [email protected] or mail a written request to our Orlando, Florida office. We will respond within forty-five (45) days.

15. Brazilian Privacy Rights (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados (Lei nº 13.709/2018 — LGPD) applies to the processing of your personal data.

In accordance with the LGPD, you have the right to:

Confirmation of the existence of processing
Access to your personal data
Correction of incomplete, inaccurate, or outdated data
Anonymization, blocking, or deletion of unnecessary or excessive data
Portability of your data to another service provider
Deletion of personal data processed with your consent
Information about entities with which we have shared your data
Information about the possibility of denying consent and the consequences thereof
Revocation of consent

Requests may be submitted to our Data Protection Officer (DPO) at [email protected]. Phishfy will respond within the timeframes established by the LGPD and regulations issued by the Autoridade Nacional de Proteção de Dados (ANPD).

16. Do Not Track

Some browsers offer a 'Do Not Track' (DNT) feature that signals your preference not to be tracked across websites. Our platform does not currently respond to DNT signals, as there is no industry-standard for how DNT should be interpreted. We will revisit this position as standards evolve.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will:

Post the revised Policy on our website with an updated effective date
Notify registered account holders via email at least thirty (30) days before the changes take effect
Display a prominent notice on the platform

Your continued use of our services after the effective date of any changes constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you must discontinue using our services.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us:

Phishfy LLC

Attn: Privacy / Data Protection Officer

Orlando, Florida, USA

Email: [email protected]

Website: https://www.phishfy.com

If you are located in the EEA or UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

If you are located in Brazil, you may also contact the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.

Phishfy LLC — A Delaware Limited Liability Company