Privacy policy.

1. Who we are

scamcanary is provided by scamcanary VOF, a Dutch general partnership (vennootschap onder firma) of Job van Breukelen and Oliver Milner, Amsterdamsestraatweg 152BIS, 3551 CM Utrecht, the Netherlands. Its registration with the Dutch Chamber of Commerce (KvK) is in progress, and this page will show the KvK number once there is one. For anything about your personal data, email [email protected] or use the contact page.

2. Our role

For your own account and for our website, we decide what happens with your data: we are the controller. When an employer or a family member trains you through scamcanary, they decide why the training happens and we process the training data on their behalf: we are then the processor, and they are the controller. Business customers sign a data processing agreement with us that sets this out. Every business customer receives that agreement before its people join.

3. What we collect

Your account: your name, email address and password, stored only as a secure hash that nobody can read, plus your two-step verification settings. To make practice emails realistic, optional details you or your organisation add: your job or situation, city, employer, the services you use, an age group and a short note. For every practice email: when it was sent and how you responded (reported, clicked or not yet). For training modules: which ones you finished and when, never your answers, because those are not stored. For the short quiz cards shown after a report (mini-lessons): which card you saw, the answer you chose and whether it was right. For the weekly games: your score and the points it earned. For emails you report: the subject, the sender, the start of the text and the result of our check; attachments are never stored. If you choose to receive practice text messages: your phone number and your consent, which your employer never sees. If your company connects its Microsoft 365: the names of its groups, so an admin can pick one, and once a day the name, work email address, job title, department, Microsoft user ID and whether the account is switched on of the people in the chosen group; only the people who join the team are kept, and we get no access to anyone's mailbox. If you sign in or join with Microsoft or Google: your email address and, for a new account made from an invite, your name, to find or make your account; we store nothing else from that sign-in, apart from a line in your account's security log saying you signed in that way. For companies: the company details the owner enters. A security log per account: sign-ins, failed sign-ins, lockouts, password changes and two-step being switched on or off, each with the IP address it came from. For companies, an audit log of what the owner and admins changed, also with the IP address. On our website: visit counts without cookies and without storing your IP address, and, when you sign up, which website or campaign brought you. We use no cookies for this; the cookie policy lists the few we do use. If you use the contact form: your name, email address and message. For each practice email sent during a free trial: a scrambled code (a keyed hash) of the recipient's email address and of their company's email domain, so the same people cannot be given a second free trial. The address cannot be read back from it.

Read the cookie policy

4. Why, and on what basis

To provide your account and the Service you signed up for: performance of the contract. To send and score practice emails and training: on behalf of the organisation doing the training, which is responsible for the lawful basis (see section 3 of the terms); we only send to people who accepted the invitation themselves, and stop when they withdraw. The optional details that personalise practice emails: your consent, which you can withdraw at any time in your settings. The security log, sign-in limits and abuse prevention: our legitimate interest in keeping accounts safe. Counting website visits without cookies: our legitimate interest in knowing how the site is used. The free-trial codes: our legitimate interest in preventing misuse of free trials. Service emails such as invitations, password resets and verification: performance of the contract. You never have to give the optional details; without them practice emails are simply less personal. An account needs a name and an email address. If your organisation chooses insights per person, fixed rules (not AI) give you a risk level of low, medium or high, always with the reasons; it may not be the only basis for decisions about your job (see section 7 of the terms).

5. Who helps us

Railway hosts the application and its database in its European region (Amsterdam). Cloudflare protects the website and network traffic, and receives the reports sent to our report address. Microsoft 365 hosts our [email protected] mailbox, so an email you forward there passes through Microsoft. Resend delivers our emails from its European sending region (Ireland). Anthropic's AI writes the text of practice emails. For that it receives your first name, your job title and department, the company's name and sector, the optional details above, and, for business accounts, the names, job titles and departments of up to twelve colleagues, so an email can mention a real colleague. That means your name and job title can appear in a colleague's practice email, as the colleague it claims to be from or mentions. Never passwords, email addresses or results; for scamcanary AI it receives only company and department totals, with departments renamed, and the admin's question with anything that looks like an email address, phone number or web address removed. When an admin turns a reported phishing email into a practice exercise, it receives that email's subject and an excerpt, with links, email addresses, phone numbers, account numbers and the names in greetings and signatures removed first. Some of these companies are based in the United States. Those transfers are covered as follows: Railway by standard contractual clauses (the data itself stays in Amsterdam); Cloudflare and Resend by the EU-US Data Privacy Framework and standard contractual clauses; Anthropic by standard contractual clauses in its data processing terms. Our contract with Microsoft is with Microsoft Ireland, in the EU. Each of them processes data for us under its own data processing terms. We do not sell or rent data, show adverts or use advertising trackers.

6. How long we keep it

Personal details used to write practice emails: wiped automatically 90 days after they were last updated, and at once if you withdraw your consent. A reported real email you shared with your admins: 90 days; one you did not share: nothing personal is kept once its window closes, within an hour. Account details, practice-email results and training progress: as long as the account is active, and deleted within 30 days after it is closed. The company audit log and each account's security log: one year. scamcanary AI summaries, which hold only totals: one year. Website visit counts: 13 months. Contact form messages: one year. Free-trial codes: two years after the last practice email. We make an encrypted backup every day and keep the last 14, on our server and as a copy in Cloudflare's storage in the EU, so deleted data is gone from backups within 14 days.

7. Your rights

You can ask to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a format you can take elsewhere. You can withdraw your consent at any time in your settings, which stops practice emails straight away and deletes the personal details used to write them. For anything else, use the contact page. If an organisation trains you through scamcanary, we may pass your request to them, because they are the controller for that data. We answer within one month.

8. Complaints

If you think we handle your data wrongly, tell us first so we can put it right. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl. In the United Kingdom, you can complain to the Information Commissioner's Office at ico.org.uk.

9. Security

All traffic is encrypted, passwords are stored as strong hashes, sessions and reset links are stored so a copy of our database could not use them, and every page and action checks you are allowed to see that data. The security page has the details.

10. Changes

We update this policy when what we do changes, and tell customers about important changes. The date at the top shows the latest version.