Your employer uses Lureproof to help everyone spot scams. Practice emails, assessments and drills are training, not a trap: nothing bad happens if you click, and results are for learning, not discipline.
Why you're getting practice emails
Your employer has signed up to Lureproof, a security awareness service provided by Fred Oyetayo, trading as Fred Web Studios, of Imperial Way, Thatcham, West Berkshire, RG19. You may receive realistic practice phishing emails at random times, a monthly hands-on assessment, and a short weekly drill. If you click a practice email, you'll see a 60-second lesson explaining the warning signs. Your employer is in charge of your data (the controller) and we process it on their behalf.
Who sees what
What your employer sees
Whether you received, opened, clicked or reported practice emails; your assessment scores, attempts and stage results; your weekly drill results; and your chosen replies in the live-attack practice chat, with its grade.
What colleagues see
Only the leaderboard: your name, department and points. Never who clicked or who failed.
What we never do
Read your inbox, files or calendar, collect real passwords, or use your answers to train AI models.
In the live attack
The “attacker” is a scripted scammer in a safe exercise. You pick each reply from a few options, so there's nothing to type. Choose what you'd really do at work.
The live attack and your replies
One stage of the monthly assessment is a practice chat with a scripted scammer. Their messages are written in advance by our team, and you choose each reply from three or four options. No AI is involved, and nothing is sent to an AI provider. Your chosen replies and your grade are stored so your employer can review them and so you can see feedback. They're kept for 12 months by default, or less if your employer chooses, and are deleted when your employer's account closes.
Leaderboard opt-out
The leaderboard celebrates people who spot and report scams. It never names anyone who clicked or failed. If you'd rather not appear on it, ask your Lureproof admin to hide your name. Your points still count for your team; your name just won't be shown.
What's collected
- From your employer: your name, work email, department and whether your account is active, either synced read-only from Google Workspace or Zoho, or from a staff list your employer uploads.
- From your training: practice-email events (delivered, opened, clicked, reported), assessment and drill answers and scores, your chosen replies in the live-attack practice chat and its grade, and leaderboard points.
- When you sign in: a single-use sign-in link sent to your work email, and a session cookie while you're signed in.
If you leave your organisation or are removed from its directory, you stop receiving practice emails automatically. Full details are in our privacy policy.
Questions and your rights
You can ask to access, correct or delete your data, or object to how it's used. Please ask your employer first, because they're in charge of it. You can also email privacy@lureproof.com and we'll pass your request on and help them respond. If you're unhappy, you can complain to the Information Commissioner's Office (ico.org.uk).