Privacy Policy

Last updated: July 2026

This policy explains what personal information the Phishing Field Training platform collects, why, and how it's protected. It applies to anyone completing training through this site on behalf of an approved client organization.

What We Collect

• Identity information from your Google or Microsoft work account when you sign in: your name, email address, and profile photo (if available). We never see or store your password — sign-in is handled entirely by Google or Microsoft.
• Training data: your answers and scores across the Inbox Drill, Live Contact, and Debrief Quiz modules, your overall readiness rating, language preference, and the date/time you completed training.
• Company affiliation, inferred automatically from your email domain (e.g., an account ending in @example.com is recorded as belonging to "example.com") — not manually entered or independently verified beyond that.

How We Use It

Training data exists to give your employer visibility into phishing-readiness across their organization. Your individual results (email, scores, completion time) are visible to designated administrators at your own company through the admin dashboard. We do not sell, rent, or share this data with any other client company, advertiser, or unrelated third party.

Who Can See Your Results

• Administrators explicitly approved by your own employer, for your company's results only — not other companies' data.
• Shiryon Security operational staff, for the purpose of maintaining the platform and troubleshooting issues.

Where It's Stored

Training records are stored in a Cloudflare D1 database associated with this application. Authentication is handled entirely by Google or Microsoft using industry-standard OAuth — Shiryon Security never receives or stores your password.

Cookies

This site uses a small number of cookies, all of which are strictly necessary for it to function — there are no advertising, analytics, or tracking cookies of any kind.

• Session cookie — created when you sign in, so you stay logged in as you move between training modules. It's cryptographically signed, cannot be read or modified by anyone else, and expires automatically after 12 hours.
• OAuth state cookie — a short-lived cookie created only during the sign-in process itself, used to confirm your sign-in request wasn't tampered with in transit. It's deleted within minutes regardless of whether sign-in succeeds.

Because these cookies are essential to signing in and using the platform at all, there's no option to decline them and continue using the site — declining would be equivalent to not being able to log in. You can still block or delete cookies through your browser's own settings, but doing so will prevent you from staying signed in.

Data Retention

Training records are retained for as long as your organization maintains an active engagement with Shiryon Security, so results remain available for reporting and repeat-training comparison. If your organization's engagement ends, associated records are deleted within a reasonable period thereafter. If you'd like your individual data removed sooner, contact your company administrator or reach out using the details below.

Third Parties

Two categories of third-party service providers support this platform:

• Google and Microsoft — solely for authenticating your sign-in. Neither receives your training data.
• Cloudflare — provides the hosting infrastructure and database for this application.

Your Rights

Depending on where you're located, you may have rights to access, correct, or request deletion of your personal data. To make a request, contact your company administrator, who can escalate to Shiryon Security, or reach us directly using the contact details below.

Changes to This Policy

We may update this policy from time to time as the platform evolves. The "Last updated" date at the top reflects the most recent revision.

Contact

Questions about this policy or your data should be directed to your company's IT or security administrator, or to Shiryon Security directly through your existing points of contact.