We collect as little as we can, we never sell it, and practice emails only ever go to people in the workspace you connect. If you're an employee who received a practice email, your employer decides how it's used, and we act on their instructions.
Who we are
Lureproof provides phishing simulation and security awareness training for small teams. Lureproof is a product of Fred Oyetayo, trading as Fred Web Studios, of Imperial Way, Thatcham, West Berkshire, RG19. In this policy, “we”, “us” and “Lureproof” mean that business. You can reach us about anything in this policy at privacy@lureproof.com.
We have two roles, depending on whose data it is:
- Controller for data about people who visit our website, join the waitlist or newsletter, or sign in as an administrator.
- Processor for data about a customer's employees (names, work email addresses and practice-email results). The customer organisation is the controller, and we only process it on their instructions under our terms.
What we collect
If you visit the website
We don't use advertising cookies. With your permission, we use Google Analytics to understand which pages are useful. It sets cookies and is only switched on if you choose “Accept” in the cookie banner. You can change your mind at any time with the “Cookie settings” link in the footer. Our hosting provider processes standard request data (such as IP address and browser type) to deliver and secure the site. Fonts are loaded from Google Fonts, so your browser connects to Google to fetch them. Some pages save small preferences in your browser's local storage, such as your chosen currency or which free lessons you've finished. That stays on your device and isn't sent to us.
If you join the waitlist or newsletter
Your email address, plus anything else you choose to give us on the form (company name, email platform, team size). The waitlist and the newsletter are separate lists, and we only email you about the one you joined.
If you're an administrator
When you connect Google Workspace or Zoho Workplace, we receive your name and work email and an access token for your organisation's directory. We store the refresh token encrypted (AES-GCM). We set a secure, httpOnly session cookie to keep you signed in for up to 14 days, and we only store a hash of the session token. If you upgrade, our payment provider (Stripe) handles your card details. We never see or store them.
If you're an employee of a customer
We sync names, work email addresses and active or suspended status from your organisation's directory. When a practice email is sent to you, we record whether it was delivered, opened (via a small image) and clicked, and whether you reported it. Clicks are recorded by the lesson page, so automated link scanners aren't counted. We don't read your mailbox, and we don't email anyone who isn't in the connected directory.
How we use it
- To run the service: syncing people, sending practice emails, showing lessons and producing reports for the customer.
- To contact waitlist members about early access, and newsletter subscribers with the monthly issue.
- To bill customers and handle support.
- To keep the service secure and fix problems.
Our lawful bases under UK GDPR are: performance of a contract (running the service for customers and administrators), legitimate interests (security, and processing employee data on the customer's behalf so they can train their team), and consent (the newsletter, which you can leave at any time).
Results are meant for training, never for discipline, and we encourage customers to tell staff that practice emails are part of their security training.
Who we share it with
We don't sell personal data or share it for advertising. We use these service providers (sub-processors) to run Lureproof:
- Cloudflare: hosting, database and network security.
- Resend: sending service emails, such as newsletter confirmations and the newsletter itself.
- Mailgun: sending practice emails.
- Google (Analytics): website statistics, only if you accept analytics cookies.
- Stripe: payments and billing.
- Google and Zoho: only to read the directory of the workspace you connect, and to sign you in.
Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or adequacy regulations. We'll also disclose data if the law requires it.
How long we keep it
- Waitlist entries: until you've been onboarded or you ask us to remove you.
- Newsletter: until you unsubscribe. Every issue has a one-click unsubscribe link, and unconfirmed sign-ups are deleted after 30 days.
- Customer data (people, campaigns and results): for as long as the account is active. People removed or suspended in the directory become inactive automatically. When a customer closes their account, we delete their data on request.
- Billing records: as long as tax law requires.
Your rights
You can ask to access, correct or delete your data, object to or restrict how we use it, or ask for a copy to take elsewhere. Email privacy@lureproof.com. If you're an employee of a customer, we'll pass your request to your employer, because they control that data, and help them respond.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put it right first.
Security
Provider refresh tokens are encrypted at rest, sessions use httpOnly cookies, and only token hashes are stored. Practice emails are sent from separate domains and carry an X-Lureproof-Simulation header so your IT team can recognise them. See Security & trust for more.
Changes
If we change this policy in a way that matters, we'll update the date at the top and tell customers by email before it takes effect.