Privacy Policy
This Policy explains how Phishmake collects, uses, and protects information when you use our platform. Effective date: 1 June 2026.
Who We Are
Phishmake operates a phishing simulation and security awareness platform. This Policy explains what information we collect when you use the service, why we collect it, and the choices you have. We act as a processor for the employee data you upload, and as a controller for the account data tied to your subscription.
Information We Collect
We collect account details you provide (name, work email, role, organization), billing information processed by our payment partner, employee records you upload for simulations, and activity data generated as your team uses the platform (clicks, reports, completed trainings). We also collect basic technical signals like IP address, browser, and approximate location to keep the service secure.
How We Use Your Information
We use information to provide and improve Phishmake, run the simulations you configure, generate reports, communicate with you about your account, prevent abuse, and meet legal obligations. We do not sell personal data, and we do not use employee data to train third-party AI models.
Sharing & Disclosure
We share data with the subprocessors that help us deliver the service (hosting, email delivery, payment processing, analytics), with your organization's administrators, and with regulators or law enforcement when legally required. A current list of subprocessors is available on request from privacy@phishmake.com.
Data Retention
Account data is kept for as long as you maintain an active subscription. Employee records and campaign results are retained according to the retention period you choose in your workspace settings. When you close your account, we delete or anonymize personal data within 90 days unless we are required to keep it for legal or accounting reasons.
Security
Data is encrypted in transit and at rest, access to production systems is limited to vetted staff, and we run regular penetration tests and code reviews. No system is perfectly secure; if we ever detect an incident affecting your data, we will notify affected customers without undue delay.
Your Rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these rights, contact your workspace administrator or email privacy@phishmake.com. We respond within the timeframes required by applicable law.
Cookies & Tracking
We use a small number of cookies and similar technologies to keep you signed in, remember preferences, and measure how the marketing site is used. You can manage cookies through your browser. Phishmake does not run third-party advertising trackers on this site.
Children's Privacy
Phishmake is built for workplaces and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided personal information to us, please contact us and we will remove it.
International Transfers
Phishmake is operated from facilities in the regions described in your order form. When data moves between regions, we rely on legally approved safeguards such as Standard Contractual Clauses, and we maintain technical and organizational measures to protect the information in transit.
Third-Party Services
Some integrations (SSO providers, SIEM tools, HRIS systems) you choose to enable are operated by other companies. When you connect them, their privacy practices apply to the data they receive. Review their policies before turning on each integration.
Changes to This Policy
We may update this Policy as Phishmake evolves. Material changes are announced by email to account owners and posted here with a new effective date. Continued use after an update means you accept the revised Policy.
Contact Us
Questions, requests, or concerns about this Policy? Reach our privacy team at privacy@phishmake.com. You can also review our Terms & Conditions for the contract that governs use of the service.
Ready to Strengthen Your Defense?
Empower your team with realistic phishing simulations to build resilience, recognize threats, and create a security-first culture across your organization.
