Privacy Policy

1. Introduction

Phish Net, LLC ("Phish Net," "we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Phish Net mobile application or web app (collectively, the "Service").

By using Phish Net, you consent to this Privacy Policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect only the information necessary to operate and improve our services.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service: Create and manage your account, perform scans (including phishing detection, link analysis, and spam identification), and operate core features.
• Process transactions: Manage billing, subscriptions, and payments through our authorized third-party processors.
• Communicate with you: Send notifications related to account activity, service updates, and respond to support inquiries.
• Improve functionality: Analyze usage trends and enhance overall performance of the app.
• Content moderation: We use automated AI-based processing to review community posts for compliance with our community guidelines before or after publication. By posting in NetConnect, you acknowledge that your content may be subject to automated moderation review.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases under GDPR:

• Contract Performance: Processing necessary to provide you with the Service and manage your account.
• Legitimate Interests: Detecting fraud, improving security, and maintaining service quality, where these interests are not overridden by your rights.
• Consent: Where you have explicitly agreed to processing, such as receiving marketing communications.
• Legal Obligation: Where we are required to process data to comply with applicable law.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only when necessary to provide or improve the Service:

• Service Providers: We share the data you submit for scanning (such as URLs or images) with our secure AI analysis providers solely to perform the requested detection service.
• Payment Processors: Subscription payments are handled by Stripe (web), Apple App Store (iOS), or Google Play Store (Android) depending on your platform. Each processor handles your payment securely on their own systems.
• Legal Compliance: We may disclose information if required by law, subpoena, or valid government request.

All third-party providers are required to maintain appropriate data protection and security practices.

6. Data Retention

We retain your personal data only as long as necessary to provide the Service. The following retention periods apply:

• Scan History & Alerts: Scan records and account alerts are automatically and permanently deleted after 90 days. Pro and Pro+ users who wish to retain scan results should export or record them before this period expires. You may also export your data at any time from the Settings page.
• Community Posts & Comments: User-generated community content is retained until deleted by the user or an administrator.
• Account Data: Retained until account deletion is requested.
• Support Tickets: Support ticket records (including contact information and correspondence) are retained for up to 3 years after resolution to allow for follow-up and dispute resolution, after which they are permanently deleted.
• Billing & Payment Records: We retain limited billing identifiers (such as Stripe Customer ID, Apple transaction IDs, and Google Play order IDs) for up to 7 years as required by applicable tax and financial recordkeeping laws. Full payment card details are never stored by us.
• Authentication & Security Logs: Login and authentication event logs are retained for up to 90 days for security monitoring purposes, then permanently deleted.

7. In-App Notifications

Phish Net sends in-app notifications (alerts) to keep you informed about activity related to your account and community interactions. You may receive alerts for events such as:

• New comments on your community posts
• Likes or favorites on your posts
• Mentions or interactions from other users
• Security-related account activity
• Service announcements or updates

These notifications are generated based on your activity within the Service. You can manage notification preferences in the Settings page. In-app alerts are stored within your account and are subject to the 90-day data retention policy described in Section 6.

8. Profile Visibility

Certain profile information is visible to other registered users of the Service when you participate in community features. This includes your display name, username, and profile picture. Your email address is never visible to other users.

If you choose to post content on NetConnect, your display name and profile picture will be associated with that content and visible to all users of the Service. You may choose to post anonymously (see Section 9 below), in which case your identity will be hidden from other users but will remain associated with your account internally for moderation purposes.

9. Community Content & User Responsibility

Phish Net's NetConnect community forum allows users to post content visible to other users of the Service. You are solely responsible for any content you share publicly.

Anonymous Posting: Phish Net offers an optional anonymous posting feature. When you post anonymously, your display name and profile picture are hidden from other users, your post appears as "Anonymous." However, anonymous posts remain internally associated with your account for moderation, safety, and legal compliance purposes. Phish Net administrators can identify the author of any anonymous post when required.

We strongly urge all users never to share confidential personally identifiable information (PII) such as full names, addresses, financial details, government identification numbers, passwords, or sensitive personal data in any public forum, post, or comment on the Service.

Phish Net expressly disclaims all liability for any harm, loss, identity theft, fraud, or other damages arising from a user's voluntary public disclosure of confidential or personally identifiable information on the Service. By using the community features, you acknowledge and accept this risk.

10. Cookies & Tracking Technologies

Phish Net uses only functional local storage (browser storage) necessary for the Service to operate, such as saving your theme preference (light or dark mode). We do not use:

• Third-party advertising or tracking cookies
• Analytics platforms (e.g., Google Analytics)
• Cross-site tracking technologies

A cookie consent notice is displayed on first visit confirming your acknowledgment of our use of functional storage only. You may clear local storage at any time via your browser settings without affecting your account data.

11. Your Data Rights and Choices

You have full control over your personal data within Phish Net:

• Access & Update: You can update your display name, username, and profile image in your account settings.
• Delete Content: You may delete your scan history or remove your own community posts at any time.
• Data Retention: Scan records and alerts are automatically deleted after 90 days as described in Section 6.
• Data Portability (GDPR Article 20): You may request a machine-readable export of your personal data (scans, alerts, community posts, and account activity) at any time from the Settings page using the "Export My Data" feature.
• Communication Preferences: You can control email and in-app notifications in the "Settings" page.
• Subscription Management: You can manage or cancel your subscription through Stripe (web), your Apple App Store account settings (iOS), or your Google Play Store account settings (Android), depending on where you subscribed.
• Account Deletion: You may request permanent deletion of your account and data by emailing support@phishnetapp.com or by selecting "Delete Account" in the "Settings" page.

12. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and share about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions permitted by law.
• Right to Correct: You may request that we correct inaccurate personal information we hold about you.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information for money, nor do we share it for cross-context behavioral advertising. No opt-out action is required. If this practice ever changes, we will update this policy and provide a clear opt-out mechanism.
• Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information (such as screenshots containing financial data or credentials submitted for analysis), we limit its use strictly to performing the requested scanning service and do not use it for any secondary purpose.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Do Not Sell or Share My Personal Information: Phish Net, LLC does not sell, rent, trade, or share your personal information with third parties for cross-context behavioral advertising purposes. No opt-out mechanism is required because this activity does not occur. You may contact us to confirm this at any time.

To submit a California privacy request, contact us at support@phishnetapp.com. We will respond within 45 days as required by law.

13. Sensitive Personal Information

As part of our scanning services, users may voluntarily submit content that contains sensitive personal information, such as screenshots of emails or messages that include financial account details, passwords, government ID numbers, or health-related information.

Phish Net, LLC treats all submitted scan content as sensitive. We use submitted content solely to perform the requested phishing or threat detection analysis. We do not use scan content for advertising, profiling, or any secondary purpose unrelated to the detection service.

We strongly advise against submitting unredacted sensitive personal information unless it is necessary for the analysis. You are responsible for the content you choose to submit.

14. Data Security & Breach Notification

We use industry-standard security measures to protect your information, including HTTPS encryption for all data transmission and secure authentication. We work with SOC 2 compliant infrastructure providers including OpenAI, Stripe, and Resend.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required under GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected users without undue delay in accordance with GDPR Article 34.

However, no online system is completely secure. You use the Service at your own risk, and we encourage you to take steps to protect your own data and device.

15. Children's Privacy

Phish Net is not intended for children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided personal data through the app, please contact us at support@phishnetapp.com, and we will delete the information.

16. International Data Transfers

Phish Net, LLC is based in the United States. If you access our Service from the European Economic Area (EEA), United Kingdom, or other regions with data protection laws that differ from U.S. law, please be aware that your information may be transferred to and processed in the United States.

We use third-party service providers including OpenAI (AI analysis), Stripe (payments), and Resend (email delivery), all of which are U.S.-based companies. These providers maintain appropriate safeguards for cross-border data transfers, including Standard Contractual Clauses (SCCs) where required under GDPR.

By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate.

17. Data Protection Officer

Phish Net, LLC is a small business and is not currently required to designate a formal Data Protection Officer (DPO) under GDPR Article 37. However, all data protection inquiries, privacy requests, and concerns can be directed to us at support@phishnetapp.com. We are committed to responding promptly and in compliance with applicable law.

18. Changes to This Policy

We may update this Privacy Policy periodically to reflect new features, laws, or practices. The updated version will include a revised "Last Updated" date and take effect once posted. For material changes, we will make reasonable efforts to notify you via email or in-app notice.

19. Your GDPR Rights (EEA & UK Users)

If you are located in the European Economic Area (EEA) or United Kingdom, in addition to the rights described elsewhere in this policy, you have the following rights under the GDPR:

• Right to Object (Article 21): You have the right to object at any time to our processing of your personal data where we rely on legitimate interests as our legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is necessary for legal claims.
• Right to Restrict Processing (Article 18): You may request that we restrict the processing of your personal data in certain circumstances, such as while a dispute about accuracy is being resolved.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority at any time. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, you may contact the supervisory authority in your country of residence.

To exercise any of these rights, contact us at support@phishnetapp.com. We will respond within 30 days.