This policy explains what personal data Phishvoid collects through this website, why, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and Türkiye’s Personal Data Protection Law No. 6698 (KVKK). The Turkish KVKK information notice is available at Gizlilik ve KVKK.
1. Who we are
Phishvoid is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] (“Phishvoid”, “we”, “us”). We are the data controller for the personal data described in this policy.
For any privacy question or request, contact privacy@phishvoid.com.
2. What we collect and why
| Where | Data | Purpose | Legal basis |
|---|---|---|---|
| Phishing report form | Suspicious URL, brand name, optional e-mail address, optional details, IP address, page language, time of submission | Verify the report, act against the phishing site, follow up with you if you left an e-mail, protect the form from abuse | Legitimate interest in fighting fraud and protecting the public (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Demo request form | Name, company, work e-mail, brands and domains to protect, IP address, page language, time of submission | Reply to your request, prepare an exposure scan and a proposal | Steps taken at your request before entering into a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) and legitimate interest |
| E-mail and Telegram | Whatever you choose to send us, such as your name, contact details and message | Answer your message and keep a record of the conversation | Legitimate interest; pre-contract steps where relevant |
| Website visits | IP address, browser and device information, requested pages, time (server logs kept by our hosting provider) | Run the website securely, detect attacks, meet legal obligations | Legitimate interest; legal obligation where applicable (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç), Law No. 5651) |
You don’t have to give us any personal data to report a phishing site: the e-mail field is optional and reports can be anonymous. We need the details marked as required on the demo form to reply to you.
When we provide our takedown service to a client, the data we handle on the client’s behalf is governed by our written agreement with that client.
3. Cookies and tracking
The public website does not set cookies and does not use analytics, advertising or tracking tools. Fonts and all other files are served from our own server, so opening a page does not send your data to third parties. We don’t sell personal data and we don’t build marketing profiles.
Our internal staff panel uses one strictly necessary session cookie to keep authorized team members signed in. It is never set for website visitors.
4. Who we share data with
- Hosting provider ([HOSTING PROVIDER, COUNTRY]), which stores the website and our database.
- Telegram: our team receives an internal alert when a form is submitted. These alerts contain only a case number, the brand, the company name and a non-clickable copy of the reported URL, not your name or e-mail.
- Takedown recipients: to remove a phishing site we send the phishing URL and technical evidence to hosting providers, domain registrars and registries, Cloudflare and other CDNs, browser and e-mail blocklists (such as Google Safe Browsing, Microsoft SmartScreen, Netcraft, APWG, PhishTank), search engines and national CERTs such as USOM. We don’t share the identity of the person who reported the site unless you ask us to.
- Authorities, when we are legally required to.
5. International transfers
Some of the providers above (for example Telegram) process data outside Türkiye and the European Economic Area. Where this happens we rely on the safeguards required by GDPR Chapter V and KVKK Article 9, such as standard contractual clauses, and we keep the data we send to them to a minimum.
6. How long we keep data
- Anti-abuse records (IP address and time of a form submission, used for rate limiting): 24 hours.
- Phishing reports: while the case is open and for up to 2 years after it is closed, so we can act if the same site comes back. Your e-mail address on a report can be deleted at any time on request.
- Demo requests: up to 2 years after our last contact, unless you become a client.
- Server logs: for the period kept by our hosting provider and required by law.
7. Security
The website runs only over HTTPS. Submissions are stored in a database that is not publicly reachable. Only authorized team members can access it, with individual accounts and hashed passwords. Suspicious URLs are stored and displayed in a non-clickable form.
8. Your rights
Depending on where you live, you can ask us to:
- confirm whether we process your data and give you a copy of it;
- correct inaccurate data;
- delete your data, or restrict how we use it;
- object to processing based on our legitimate interest;
- send your data to you or another controller in a portable format.
Send your request to privacy@phishvoid.com. We reply within 30 days and free of charge. We may ask you to confirm your identity first.
You also have the right to complain to a data protection authority: in the EU, the authority in your country; in Türkiye, the Personal Data Protection Authority (KVKK). Rights under KVKK Article 11 are explained in the Turkish notice.
9. Children
Our website and services are intended for businesses and are not directed at children.
10. Changes to this policy
We may update this policy as our service changes. The date at the top shows the latest version. For significant changes affecting clients, we will notify them directly.