Terms of service.

1. What the Service does

scamcanary sends simulated (fake, harmless) phishing messages to people you have added, and provides training, tracking and reporting based on how they respond. Simulated links never collect real credentials or payment details.

2. Accounts & eligibility

Whoever creates an account or pays for a subscription must be at least 18. Everyone who takes part in the training must be at least 16. Provide accurate information. You are responsible for activity under your account and for keeping your password secure.

3. Consent and lawful basis

scamcanary only sends a practice email once someone has accepted the invitation themselves, and stops the moment they withdraw. That agreement from each participant is a condition of the Service, and the Service records it. The organisation doing the training makes sure it has a lawful basis and tells its people beforehand why and how they will practise. For employees that basis is often not their consent but, for example, a legitimate interest; that assessment is yours. Never use the Service to harass, deceive for gain, or target someone without a proper basis.

4. Acceptable use

Do not use the Service to send real phishing, to attempt to obtain real credentials or money, to break any law, or to target people who have not been properly enrolled with consent. We may suspend accounts that do.

5. Payment

A new subscription starts with 14 days free. Cancel within those 14 days and you pay nothing; otherwise the subscription starts automatically afterwards. Paid plans are billed per the prices shown, per seat or per person, monthly, and can be cancelled at any time; a cancellation takes effect at the end of the month already paid. Prices may change with 30 days' notice by email, and you can cancel before the new price applies. (Billing is being connected during the prototype phase.) A free pilot follows the pilot letter we agree with you instead: it costs nothing and does not turn into a paid subscription by itself.

Read about cancelling and refunds

6. Data & privacy

We process personal data under the GDPR and only as needed to run the Service. Profiles used to personalise simulations expire automatically. You can request export or deletion of your data. Our privacy policy sets this out in full. For business customers our data processing agreement applies as well, which you receive before your people join; for personal data it takes precedence over these terms.

Read the privacy policy

7. Insights, risk levels and scamcanary AI

Insights and risk levels are there to help you give people the right training. They are worked out by fixed rules from how people respond to practice emails and how far they are with the training. You may not use them as the only basis for decisions about someone’s employment, such as warnings, pay or dismissal. If you choose per-person insights, you are responsible for informing your employees and, where the law requires it, for involving your works council or doing a data protection impact assessment. scamcanary AI writes summaries from company and department totals only; it never assesses individuals, and it can make mistakes, so the numbers on the page are what counts.

8. Prototype notice

The Service is under active development. Some features may be incomplete or change, and availability is not guaranteed during this phase. We are not liable for a failure caused by something outside our reasonable control, such as an outage at our hosting, email or network providers; this never reduces what we owe you under the data processing agreement.

9. Liability

The Service is provided “as is”. If we fall short, tell us in writing and give us a reasonable time to put it right; we are only liable if we still fall short after that, unless putting it right is no longer possible. For business customers our liability is limited as follows. For all events in any 12 months together, we pay at most the fees you paid or owed us for the Service in the 12 months before the event that caused the loss, or €10,000 if that is more. Loss caused by a breach of the data processing agreement or of data protection law falls under a separate, higher limit instead: twice those fees, or €25,000 if that is more. We are not liable for indirect loss, such as lost profit, lost savings, damage to reputation or business interruption. These limits do not apply to loss caused by intent or deliberate recklessness on our part, or to any liability the law does not allow us to limit, and they never limit the rights that data subjects or supervisory authorities have under the GDPR. They also protect the partners of scamcanary VOF, and anyone working for us, when a claim is made against them personally. In turn, you are responsible to us for loss caused by your breach of sections 3, 4 or 7, or of your duties as controller in the data processing agreement, including claims against us from your people or a supervisory authority, and you indemnify us against them. The same limits apply to that, except for a breach of section 4 or intent or deliberate recklessness on your part. A claim lapses unless you tell us about it in writing within 12 months after you discovered the loss, or reasonably could have. If you use the Service as a consumer, the limits in this section do not apply to you; the law’s own rules do.

10. Termination

You may stop using the Service at any time. We may suspend or end access for breach of these terms.

11. Changes

We may update these terms; material changes will be notified. Continued use means you accept the updated terms.

12. Governing law

These terms are governed by the laws of the Netherlands, and disputes fall under the competent Dutch courts. For customers in the United Kingdom, the UK GDPR also applies to personal data.

13. Transfer to a company

If we move scamcanary from the partnership into a private limited company (B.V.) in which the partners together hold most of the shares, you agree now that we may transfer our agreement with you to that company, including the data processing agreement and all rights and obligations. We tell you by email at least 30 days before; if you do not want the transfer, you may end your subscription before it takes effect and get the unused part back. You may only transfer your agreement with us to someone else with our written agreement.