Privacy Policy
This Privacy Policy explains what information the Scamsavvy service (“we”, “our”, or “the Service”) collects, why we collect it, how we use and protect it, and the choices you and the participants you enroll have.
1. Who this policy covers
This policy covers two roles:
- Submitters — people who enroll a participant (you).
- Participants — the people who receive the training simulations.
A participant is only ever contacted after giving explicit, verified consent (see Section 4).
2. What we collect
From submitters:
- Your email address (used for enrollment confirmations, status notifications, and training reports).
- Your relationship to the participant (e.g. daughter, son).
From participants (only after they enroll):
- Phone number — stored hashed and encrypted at rest. It is used solely to deliver the simulation by text and/or phone call and to verify consent.
- First name — used to personalize the simulation and emails.
- Device information — the device type, operating system, and browser you provide at enrollment (used to make the simulation feel realistic).
- Scenario preferences — the scenario type, timing preference, and the fictional caller’s name/relationship you choose.
- Conversation content — the participant’s replies during the simulation. These are processed by an AI to generate realistic scammer responses and are stored encrypted while a session is active. Transcripts are deleted when the session ends and are also purged automatically if stale.
- Outcome data — whether the participant engaged, refused, or shared information during the simulation, used to generate the training report.
We do NOT collect: real payment information, real account credentials, Social Security numbers, or any other real sensitive data. If a participant shares sensitive information during a simulation, the simulation halts immediately, the message is discarded, and it is never stored or used (see Section 5).
3. How we use the information
- To operate the Service: deliver simulations by SMS and voice, send transactional emails, and generate training reports.
- To verify consent before any simulation begins.
- To improve the Service (in aggregate, never with personal identification).
We do not sell personal information and do not use it for advertising.
4. Consent
Participants must confirm they want to participate before any simulation occurs. The consent flow works like this:
- The participant receives an invitation describing the training.
- They review a consent page explaining that a practice scam message or call may follow and that it may realistically ask for passwords or account information — and that they should never share real information.
- They must enter a verification code sent to their own phone, which records their explicit agreement.
If consent is not confirmed, no simulation is sent. Consent can be withdrawn at any time (see Section 7).
5. Sensitive-data protection
The Service includes a privacy safeguard: participant messages are scanned for sensitive information before they are processed or stored. If sensitive data is detected:
- The simulation halts immediately;
- The message is discarded and never reaches the AI, the logs, or the database;
- Nothing the participant shared is retained.
Voice calls are transcribed to text for processing; no audio recordings are kept.
6. Data retention and deletion
- Conversation transcripts are encrypted, live only for the duration of a session, and are deleted when the session ends (a scheduled sweep also removes stale transcript rows automatically).
- Phone numbers are stored hashed and encrypted and are used only while a participant is enrolled.
- Consent records (who consented, when, and opt-out status) are kept for the Service’s compliance records.
- Expired consent links are deleted automatically.
- When a session completes, the participant’s consent record is auto-opted-out (see Section 7), so no further simulation messages are sent.
7. Your choices
For participants:
- Opt out of messages: reply STOP to any text, or use the opt-out link in the consent flow. We will stop sending simulation messages.
- Revoke report access: a participant’s report can be revoked by the submitter at any time using the “revoke” link on the training report, after which the report can no longer be viewed.
- Request deletion: to request full deletion of a participant’s data, contact us at support@mail.scamsavvy.xyz.
For submitters:
- You may revoke access to a training report at any time.
- You may stop enrolling participants at any time.
8. Third-party services
The Service uses the following third parties to operate. Each processes data only for the purposes described:
| Service | Purpose | Data involved |
|---|---|---|
| Twilio | Sending SMS and placing voice calls | Phone number, message/call content |
| Google (Gemini) | Generating the AI scammer’s responses | Conversation turns |
| Resend | Sending transactional email | Email address, participant first name |
| Railway | Cloud hosting of the Service | Server logs (may include IP addresses) |
| Cloudflare | DNS and content delivery | Standard web request data |
These providers have their own privacy policies and data-processing terms.
9. Security
We protect data with:
- Encryption at rest — phone numbers and conversation transcripts are encrypted in the database.
- Encryption in transit — traffic to and from the Service uses HTTPS.
- Access control — training reports are only accessible via signed, expiring links tied to the submitter’s email.
- Minimization — we store the least data needed to run the Service, and delete transcripts automatically.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
10. Children’s privacy
The Service is not directed at children under the age of 13. If you enroll a minor as a participant, you must be their parent or legal guardian and they must consent to the best of their ability.
11. International transfers
The Service is hosted on cloud infrastructure that may process data outside your country. By using the Service, you consent to this processing in accordance with this policy.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date. Material changes will be highlighted where feasible.
13. Contact
Questions or requests about this policy or your data: support@mail.scamsavvy.xyz
Scamsavvy · Ontario, Canada