Terms of Use | Phishfy

Terms of Service

Phishfy LLC

Effective Date: May 14, 2025

Last Updated: Jun 07, 2026

PLEASE READ THESE TERMS CAREFULLY BEFORE ACCESSING OR USING THE PHISHFY WEBSITE OR PLATFORM. BY ACCESSING www.phishfy.com OR USING ANY PHISHFY SERVICE, YOU AGREE TO BE BOUND BY THESE TERMS OF SERVICE. IF YOU DO NOT AGREE, YOU MUST NOT ACCESS OR USE OUR SERVICES.

[ PART I — GENERAL TERMS (WEBSITE & ALL USERS) ]

1. About Phishfy and These Terms

Phishfy LLC ("Phishfy," "we," "us," or "our") is a Delaware limited liability company with principal offices in Orlando, Florida, USA. We operate a phishing simulation and security awareness training platform accessible at www.phishfy.com and related subdomains ("Website") and via a cloud-based platform and associated APIs ("Platform").

These Terms of Service ("Terms") govern your access to and use of our Website and Platform, including any content, features, software, and services made available by Phishfy. These Terms form a legally binding agreement between you and Phishfy.

Depending on how you use our services, additional terms may apply:

If you represent an organization that has executed a separate Master Service Agreement or Order Form with Phishfy, those documents govern your use of the Platform and supplement these Terms.
If you access the Platform as an End User (e.g., an employee subject to a simulation), your use is governed by your employer's agreement with Phishfy and by these Terms.

2. Definitions

The following definitions apply throughout these Terms:

"Client" means any organization or entity that has entered into an agreement with Phishfy to access and use the Platform for security awareness purposes.
"End User" means an individual (typically an employee or contractor of a Client) who is subject to phishing simulations or training campaigns managed through the Platform.
"Content" means all text, data, graphics, software, information, and other material made available through the Website or Platform.
"Client Data" means any data, files, or information uploaded, submitted, or generated by a Client or its End Users through the Platform, including employee records, simulation results, and training metrics.
"Services" means the Website, Platform, APIs, and any related products or services provided by Phishfy.
"Subscription" means a paid plan granting access to the Platform and selected features for a defined term.

3. Eligibility and Account Registration

3.1 Eligibility

By accessing or using the Services, you represent and warrant that:

You are at least 18 years of age;
You have the legal capacity to enter into binding contracts;
Your use of the Services does not violate any applicable law or regulation;
If you are accessing the Services on behalf of an organization, you have the authority to bind that organization to these Terms.

3.2 Account Registration

To access certain features of our Website or to use the Platform, you may need to register for an account. You agree to:

Provide accurate, current, and complete information during registration;
Maintain and promptly update your account information;
Keep your login credentials confidential and not share them with any third party;
Notify Phishfy immediately at [email protected] of any unauthorized access to your account;
Accept responsibility for all activities that occur under your account.

Phishfy reserves the right to suspend or terminate accounts that contain inaccurate information or that are used in violation of these Terms.

4. Acceptable Use

4.1 Permitted Use

You may access and use the Services solely for lawful purposes and in accordance with these Terms, applicable law, and any guidelines or policies published by Phishfy from time to time.

4.2 Prohibited Conduct

You agree not to:

Use the Services to conduct actual (non-simulated) phishing attacks or any other malicious cyber activity against any individual or organization;
Use the Services in a manner that violates applicable local, state, national, or international law or regulation;
Attempt to gain unauthorized access to any Phishfy system, network, or account;
Reverse engineer, decompile, disassemble, or attempt to derive the source code of any Phishfy software;
Resell, sublicense, or otherwise transfer access to the Services without Phishfy's prior written consent;
Use automated tools (bots, scrapers, crawlers) to access, index, or scrape the Website or Platform;
Upload or transmit viruses, malware, or any other code designed to disrupt, damage, or intercept systems;
Impersonate any person or entity, or falsely claim affiliation with any organization;
Use the Services in any manner that could damage, disable, or impair Phishfy's infrastructure or interfere with other users' enjoyment of the Services;
Collect or harvest personal data from the Services without authorization.

Violation of this Section may result in immediate suspension or termination of your access, without notice or liability.

5. Intellectual Property

5.1 Phishfy Ownership

The Services and all Content — including but not limited to the Phishfy name and logo, software, platform design, training modules, email templates, campaign configurations, reports, and documentation — are the exclusive property of Phishfy LLC or its licensors, and are protected by United States and international intellectual property laws.

Nothing in these Terms transfers any intellectual property rights to you. All rights not expressly granted are reserved by Phishfy.

5.2 License to Use the Services

Subject to your compliance with these Terms and, if applicable, your Subscription agreement, Phishfy grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Services for their intended purposes. This license does not include the right to:

Copy, modify, or create derivative works of any Phishfy Content;
Use Phishfy Content for commercial purposes outside the scope of your Subscription;
Remove or alter any copyright, trademark, or other proprietary notices;
Use any Phishfy trademarks, trade names, or branding without prior written consent.

5.3 Your Feedback

If you provide Phishfy with feedback, suggestions, or ideas regarding the Services, you grant Phishfy a perpetual, irrevocable, worldwide, royalty-free license to use such feedback for any purpose, without compensation or attribution to you.

6. Privacy

Our Privacy Policy (available at www.phishfy.com/privacy) is incorporated into these Terms by reference and describes how we collect, use, and protect personal information in connection with our Website and, where applicable, our Platform. By using the Services, you consent to the data practices described in our Privacy Policy.

For Platform Clients, the processing of End User data is governed by the Data Processing Agreement (DPA) executed between Phishfy and the Client.

7. Third-Party Links and Services

The Website and Platform may contain links to, or integrations with, third-party websites, applications, or services. Phishfy does not control and is not responsible for the content, privacy practices, or terms of those third parties.

Your use of any third-party service is at your own risk and subject to that party's own terms and privacy policies. Phishfy's inclusion of a link or integration does not imply endorsement of the third party.

8. Disclaimer of Warranties

THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. TO THE FULLEST EXTENT PERMITTED BY LAW, PHISHFY DISCLAIMS ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO:

IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT;
WARRANTIES THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS;
WARRANTIES REGARDING THE ACCURACY, RELIABILITY, OR COMPLETENESS OF ANY CONTENT OR DATA;
WARRANTIES THAT THE SERVICES WILL MEET YOUR SPECIFIC REQUIREMENTS OR EXPECTATIONS.

PHISHFY DOES NOT WARRANT THAT PHISHING SIMULATIONS OR SECURITY AWARENESS TRAINING WILL PREVENT ALL SECURITY INCIDENTS OR GUARANTEE ANY PARTICULAR SECURITY OUTCOME.

9. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL PHISHFY, ITS OFFICERS, DIRECTORS, EMPLOYEES, PARTNERS, AGENTS, SUPPLIERS, OR LICENSORS BE LIABLE FOR:

ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES;
LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITIES;
DAMAGES ARISING FROM YOUR RELIANCE ON INFORMATION OR CONTENT PROVIDED BY THE SERVICES;
ANY UNAUTHORIZED ACCESS TO OR ALTERATION OF YOUR DATA;

WHETHER OR NOT PHISHFY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF THE THEORY OF LIABILITY.

IN JURISDICTIONS WHERE LIMITATION OF LIABILITY IS NOT PERMITTED, THE FOREGOING LIMITATION SHALL APPLY TO THE GREATEST EXTENT PERMITTED BY LAW. IN ALL OTHER CASES, PHISHFY'S AGGREGATE LIABILITY TO YOU SHALL NOT EXCEED THE GREATER OF (A) ONE HUNDRED U.S. DOLLARS (USD $100) OR (B) THE AMOUNTS PAID BY YOU TO PHISHFY IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

10. Indemnification

You agree to defend, indemnify, and hold harmless Phishfy and its officers, directors, employees, partners, agents, suppliers, and licensors from and against any claims, liabilities, damages, judgments, awards, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

Your violation of these Terms;
Your use of the Services in a manner not authorized by these Terms;
Your violation of any applicable law or the rights of any third party;
Any content you submit, upload, or transmit through the Services;
Your fraud, gross negligence, or willful misconduct.

11. Governing Law and Dispute Resolution

11.1 Governing Law

These Terms and any dispute arising from or relating to them shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to conflict of law principles.

11.2 Dispute Resolution

Before initiating any formal legal proceeding, you agree to attempt informal resolution by contacting Phishfy at [email protected] and giving us at least thirty (30) days to resolve the dispute.

If the dispute is not resolved informally, any claims shall be resolved exclusively by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules. The arbitration shall be conducted in Orlando, Florida, USA, or remotely as agreed. The arbitrator's decision shall be final and binding, and judgment may be entered in any court of competent jurisdiction.

11.3 Class Action Waiver

YOU AND PHISHFY AGREE THAT EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.

11.4 Exceptions

Notwithstanding the arbitration provision, either party may seek emergency injunctive or other equitable relief from a court of competent jurisdiction to protect intellectual property rights or prevent irreparable harm.

12. Changes to These Terms

Phishfy reserves the right to modify these Terms at any time. When we make material changes, we will:

Post the revised Terms at www.phishfy.com/terms with an updated effective date;
Notify registered account holders by email at least thirty (30) days before the changes take effect;
Display a prominent notice on the Website or Platform.

Your continued access to or use of the Services after the effective date of any changes constitutes your acceptance of the revised Terms. If you do not agree, you must stop using the Services.

13. Termination

Phishfy reserves the right to suspend or terminate your access to the Services at any time, with or without notice, for any reason, including but not limited to violation of these Terms.

You may stop using the Services at any time. If you have a Subscription, termination is subject to the cancellation terms in your Subscription agreement.

Upon termination, Sections 5, 8, 9, 10, 11, and any other provisions that by their nature should survive, shall continue in full force and effect.

14. General Provisions

Entire Agreement: These Terms, together with the Privacy Policy and any applicable Subscription agreement, constitute the entire agreement between you and Phishfy regarding the Services.
Severability: If any provision of these Terms is found to be unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force.
No Waiver: Phishfy's failure to enforce any right or provision of these Terms shall not constitute a waiver of that right or provision.
Assignment: You may not assign your rights or obligations under these Terms without Phishfy's prior written consent. Phishfy may assign its rights without restriction.
Force Majeure: Phishfy shall not be liable for any delay or failure to perform resulting from causes beyond its reasonable control.
Notices: Legal notices to Phishfy must be sent to [email protected] or to our registered address in Orlando, Florida.
Language: These Terms are written in English. Translations are provided for convenience only. In case of conflict, the English version prevails.

[ PART II — PLATFORM TERMS (CLIENTS & END USERS) ]

15. Platform Access and Subscriptions

15.1 Subscription Plans

Access to the Phishfy Platform requires a paid Subscription. By purchasing a Subscription, you agree to the pricing, features, and terms specified in the applicable Order Form or checkout page, which are incorporated into these Terms by reference.

Subscriptions are available to organizations only. Individual consumer subscriptions are not currently offered.

15.2 Free Trials and Demos

Phishfy may offer free trials or demo access at its discretion. Free trials are subject to these Terms and any additional conditions communicated at the time of the offer. At the end of a trial period, continued access requires a paid Subscription. Phishfy reserves the right to terminate trial access at any time.

15.3 Subscription Term and Renewal

Subscriptions are offered on monthly or annual terms, as selected at purchase.
Subscriptions automatically renew at the end of each term unless cancelled at least thirty (30) days before the renewal date.
Renewal pricing will be communicated at least sixty (60) days before renewal. Phishfy reserves the right to adjust pricing with appropriate notice.

15.4 Cancellation

You may cancel your Subscription at any time through your account settings or by contacting [email protected]. Cancellation takes effect at the end of the current billing period. No refunds are provided for unused portions of a Subscription term, except as required by applicable law or as expressly stated in your Order Form.

16. Billing and Payment

16.1 Fees

You agree to pay all fees associated with your Subscription as set forth in your Order Form or checkout. All fees are quoted and payable in U.S. dollars unless otherwise agreed in writing.

16.2 Payment Methods

Phishfy accepts payment via major credit cards and other methods as indicated at checkout. By providing payment information, you authorize Phishfy (or its payment processor) to charge the applicable fees to your payment method on a recurring basis.

16.3 Late Payment

If payment is not received by the due date, Phishfy may suspend access to the Platform until payment is received. Overdue balances may accrue interest at the rate of 1.5% per month or the maximum rate permitted by law, whichever is lower.

16.4 Taxes

Fees are exclusive of applicable taxes. You are responsible for all sales, use, VAT, GST, and similar taxes imposed by any taxing authority on your purchase of the Services, except for taxes based on Phishfy's net income.

17. Client Data and Data Processing

17.1 Client Ownership

As between Phishfy and the Client, the Client owns all Client Data. Phishfy does not acquire any ownership rights in Client Data by virtue of these Terms.

17.2 License to Process

By uploading or submitting Client Data to the Platform, the Client grants Phishfy a limited, non-exclusive license to access, store, and process Client Data solely to: (a) provide and improve the Services; (b) generate aggregated, anonymized analytics and benchmarks; and (c) comply with legal obligations. Phishfy will not use Client Data for any other purpose.

17.3 Data Processing Agreement

Where applicable under GDPR, LGPD, or other data protection laws, the parties will enter into a Data Processing Agreement (DPA) that governs the processing of personal data on behalf of the Client. The DPA is available upon request at [email protected] and is incorporated into these Terms by reference upon execution.

17.4 Security Obligations

Phishfy implements industry-standard technical and organizational security measures to protect Client Data, as further described in our Security Overview at www.phishfy.com/security. The Client is responsible for maintaining the security of its account credentials and for the actions of its administrators and End Users.

17.5 Data Retention and Deletion

Upon expiration or termination of a Subscription, Phishfy will retain Client Data for a period of sixty (60) days, during which the Client may export its data. After this period, Phishfy will securely delete or anonymize Client Data, unless a longer retention period is required by law.

18. Authorized Use of the Platform

18.1 Simulations

The Platform is designed exclusively for authorized, internal phishing simulation campaigns conducted by organizations on their own employees or contractors, with appropriate internal authorization. Clients represent and warrant that:

They have obtained all necessary internal approvals and, where required, employee consent or notice under applicable law before conducting simulations;
Simulations will not be conducted against individuals or organizations outside the Client's own workforce without express written consent;
The Platform will not be used to conduct actual (non-simulated) cyberattacks.

Phishfy reserves the right to suspend access immediately upon detection or reasonable suspicion of misuse, without notice.

18.2 Administrator Responsibilities

Client administrators are responsible for:

Configuring and managing the Platform in compliance with applicable law and these Terms;
Ensuring End Users are informed of simulation programs in accordance with applicable employment and privacy laws;
Managing access permissions and promptly revoking access for departed employees;
Monitoring usage and reporting suspected misuse to Phishfy.

19. Uptime, Support, and SLA

19.1 Uptime Commitment

Phishfy targets a Platform uptime of 99.5% measured monthly, excluding scheduled maintenance and circumstances beyond Phishfy's reasonable control. Scheduled maintenance will be communicated at least 48 hours in advance.

19.2 Support

Platform Clients receive technical support as specified in their Subscription plan. Support is provided via the Phishfy support portal at support.phishfy.com and by email at [email protected], during published business hours. Response times vary by Subscription tier and issue severity.

19.3 Service Credits

If Phishfy fails to meet the uptime commitment, Clients may be eligible for service credits as specified in their Order Form or SLA addendum. Service credits are the Client's sole and exclusive remedy for uptime failures.

20. Confidentiality

Each party (the "Receiving Party") may receive confidential information from the other party (the "Disclosing Party") in connection with the Services. Confidential information includes pricing, technical specifications, Client Data, and any information marked as confidential or that a reasonable person would understand to be confidential.

The Receiving Party agrees to: (a) protect Confidential Information with at least the same degree of care it uses for its own confidential information, but no less than reasonable care; (b) use Confidential Information only for the purposes of these Terms; and (c) not disclose Confidential Information to any third party without prior written consent.

These obligations do not apply to information that: (i) is or becomes publicly known through no breach of this agreement; (ii) was rightfully known to the Receiving Party prior to disclosure; (iii) is received from a third party without restriction; or (iv) is required to be disclosed by law or court order, provided the Receiving Party provides prompt notice and cooperates with the Disclosing Party's efforts to limit disclosure.

21. End User Terms

If you are an End User participating in a phishing simulation or training program administered by your employer through Phishfy:

Your employer (the Client) controls the configuration and administration of the program.
Phishfy acts as a data processor on behalf of your employer. Requests regarding your personal data should be directed to your employer in the first instance.
You may access training content and view your own simulation results through the End User portal, subject to permissions granted by your employer.
You must not attempt to circumvent, reverse-engineer, or otherwise interfere with simulation mechanics or the Platform.

22. Partner and Reseller Terms

If you are an authorized Phishfy partner or reseller (MSSP, VAR, or similar), your access to and use of the Platform on behalf of your customers is subject to a separate Partner Agreement. In the absence of a signed Partner Agreement, these Terms govern your use.

Partners are responsible for ensuring their customers comply with these Terms and for the actions of their customers on the Platform. Partners may not offer or represent Services in a manner inconsistent with Phishfy's published materials without prior written approval.

Phishfy LLC — A Delaware Limited Liability Company