1. Controller and scope of this policy
The controller for the processing described in this policy is Woolshy.com Group P.S.A., which operates the Anti Phishing Technologies brand, ul. Twarda 18, 00-105 Warszawa, Poland, National Court Register (KRS) 0001001707, tax identification number (NIP) 5252931203.
For matters concerning personal data, email contact@antiphishingtechnologies.com or write to us at the company address above.
This policy covers our public website, correspondence, the Anti Phishing apps for Android and Windows, and Enterprise Security Center (ESC). When providing services to organizations, we may also process data on a customer’s behalf. In that case, the customer determines the purposes of processing, and the contract sets out our obligations, including a data processing agreement where required.
2. Website and correspondence
When you visit, our website infrastructure may record technical request data such as your IP address, connection time, the path requested, the response code and browser information. We use this data to deliver the website, diagnose errors and prevent abuse.
If you write to us, we process your email address and the data in your message and attachments, such as your first and last name, job title, company and information about your intended use of the product. Providing this information is voluntary, but we need a contact address and the substance of your inquiry to reply.
If you contact us about a job, we process the information in your message and attachments as described below.
Past submissions to the public scanner may have included a URL and an analysis result. The previous retention periods continue to apply to these historical submissions. The results index is retained for up to 30 days, the technical record of an individual submission for up to 26 hours and rate-limit data for up to 2 days.
Email links open your email application. Clicking a link alone does not send us a message. The “Request a demo” button opens the form described below. The public website does not use advertising or analytics tools that track users.
Job applications
The careers form accepts your full name, email address, selected position and CV in PDF format. A phone number and short message are optional. We use this data to assess your application and contact you about the position in question. We do not use your application for future recruitment without a separate legal basis.
Acknowledging that you have read this policy does not constitute consent to processing for additional purposes. We process the data required for the current recruitment under applicable employment law. Where a candidate voluntarily provides additional information, we process it on the basis of their act of submitting it. Please do not include special categories of personal data in your CV unless they are needed for the application.
Authorized intranet users can view applications after signing in with multifactor authentication (MFA). We store metadata in Google Cloud Firestore and CV files in a private Google Cloud Storage bucket in the europe-west1 region. CVs have no public URL and can be downloaded only through the intranet. We keep the application and file for up to 180 days after submission unless they are deleted earlier or there is a separate legal basis for keeping them longer. You can request deletion by contacting the controller at the address above.
Demo request form and CRM
Use the form to express interest in the Android and Windows apps and in deploying the solution. We ask for the type of customer, your full name, email address and phone number. For a company, we also ask for its name and employee count range. You may describe your needs if you wish. We need the required fields to handle your request and arrange contact.
We process the data from this form on the basis of your consent under Article 6(1)(a) of the General Data Protection Regulation (GDPR), solely to handle this request and contact you about it by email or phone. This consent does not cover newsletters, unrelated marketing campaigns or disclosure to partners for their own marketing purposes. The checkbox is not selected by default.
In the CRM, we also record when and how we received the inquiry, product interest, the status of discussions, the staff member responsible, planned contact, notes, estimated opportunity value and the history of staff actions. The consent record contains the text and version of the consent, the date it was given and, where applicable, the date of withdrawal. Statuses and statistics help the team organize its work. We do not use them to make automated decisions that produce legal effects for the person submitting the request.
Only authorized employees can access the CRM after signing in to the intranet with MFA. We store the data in Google Cloud Firestore in the europe-west1 region in Belgium. The infrastructure provider processes the data to operate the service. The rules in the section on recipients and data locations apply to transfers.
We retain the request and consent record for 365 days from creation. At the end of that period, the request is no longer accessible in the CRM and the retention mechanism deletes the database record, subject to a possible technical delay. An employee can delete it sooner. Entering into a separate contractual relationship may require further processing in the contract documentation under the appropriate legal basis. The CRM request itself does not constitute that documentation.
After you submit the form, a private link appears on screen so you can manage your consent. Keep this link. Withdrawing consent through it deletes the contact details, content, notes and prior history of the request. Its status then indicates that you have not consented to further contact. A record of the withdrawal and its date, along with statistical information without contact details, remains until the end of the original retention period. You can also withdraw consent or exercise other rights by writing to contact@antiphishingtechnologies.com. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
To protect the form against abuse, we apply submission limits and prevent duplicate requests. Rate-limit records contain no plaintext email address and are retained for 24 hours. We retain a technical confirmation of the request, based on a cryptographic hash of the data, for up to 365 days so that retrying a submission cannot recreate a deleted request. The legal basis is our legitimate interest in the security and integrity of the service under Article 6(1)(f) GDPR.
For leads added manually from other channels, we record the source and basis for contact. An employee adding a record does not mean that the individual has given consent. If we did not obtain your data directly from you, we provide the required information on its source, processing purposes and your rights no later than our first contact or within the period specified by the GDPR.
3. Android app
Local protection
The app works without a user account. It compares domains in DNS queries and addresses visible in supported browsers against a threat database locally. It keeps a local history of detected threats and records protection status.
Network protection uses a local VPN to check DNS queries from apps on the device. It blocks domains marked as dangerous in the database. It does not decrypt HTTPS traffic. A DNS query does not contain a URL path and cannot distinguish pages on the same domain. Other DNS queries go to the configured or fallback resolver. The network operator and DNS provider may process connection information under their own policies.
When you enable full web protection, the accessibility service reads the current address from the address bar of a supported browser. It does not read form contents, passwords, keystrokes or browsing history. It can also navigate back when blocking a dangerous page.
The app does not receive or analyze SMS messages.
Detections and sharing
The app keeps a history of blocked domains and addresses on the device. Addresses identified as dangerous can be sent to the shared register only if voluntary sharing is enabled in the app or under the policy of the organization to which the device is connected. Addresses without a database match are not reported through this channel. We keep register entries for 30 days, subject to a possible technical delay in deletion. Authorized staff can inspect the full address submitted, including its parameters.
Updates, statistics and diagnostics
The app downloads updates to threat data. Detections of addresses in supported browsers are also sent as anonymous daily aggregate threat counts. These batches contain neither website addresses nor a persistent installation identifier. Once connected to an organization, the app reports separately the number of times it read addresses from supported browsers and the number of blocked DNS queries. Voluntary sharing of detected addresses is off by default. The option appears during setup and can be changed in settings. When it is enabled, the app sends the domain, URL known to the app, result and time. Turning it off stops new submissions and clears the local queue awaiting transmission. Local protection and anonymous counts continue to operate.
A diagnostic report is sent only if the user takes a separate action after a technical error. It includes the error code and time, app and Android versions, device model and protection level. It contains no domains, URLs, SMS messages or browsing history.
You can revoke VPN, accessibility and notification permissions in Android settings. This disables features that depend on them. Scanning a QR code to join an organization uses a system or Google module and does not give the app ongoing camera permission. The app does not display advertisements or create marketing profiles.
Windows sensor
The sensor first compares the address against the threat database and assesses it locally. When browser protection is enabled and deeper analysis is needed, it may automatically send the full address and an HTML copy of the page displayed in Chrome or Edge to the Argus V6 cloud engine. This includes pages revealed after an anti-bot check without a change of address. Before transmission, the sensor removes form field values, editable field contents and session data recognized in attributes from the copy. The visible page content may still contain other personal data. The HTML copy is used to perform the analysis. It is neither archived nor used to train models. Technical request metadata may remain in logs.
A completed cloud analysis result may be visible in the internal Global Web Filtering system for 30 days. The record contains the domain, address without parameters or fragment, hashes of the full address and of the page copy analyzed, assessment and time. We do not store the HTML copy. The result for a single page does not automatically create an exception or block for the whole domain.
A separate feature shares detections with the common register. On a private installation, the sensor submits only domains detected as suspicious or dangerous, and only after threat sharing is enabled. This option is off by default. A device connected to an organization follows the administrator’s ESC setting. A register report contains no URL path, address parameters, process name or Windows account data and does not trigger a new analysis. We keep the entry details for 30 days, subject to a possible technical delay in deletion.
Organization devices and app inventory
Once voluntarily connected to an organization, the app reports its protection status and security configuration, Android and app versions, phone model, contact time and the dates and results of detections to that organization. These reports exclude website addresses and message contents. The organization can require protection to stay enabled. The app then prevents users from turning it off and guides them through granting missing Android permissions. It does not grant permissions automatically or allow remote access to the contents of the phone.
The organization’s administrator can enable sharing of detected addresses in ESC for global protection. A connected device follows the organization’s choice instead of a separate user setting. The global entry contains the address, result, time and source type, without the organization, account or device name. Disabling the policy stops new submissions after the configuration is synchronized.
After you explicitly confirm the scope of data in the app, it also submits an inventory of user apps and updated system apps in the current profile. This includes names, package identifiers, versions, installer and installation source, and declared and granted permissions. The inventory is synchronized periodically. It excludes app contents and usage history. Administrators of the authorized organization use it to assess exposure arising from permissions. It does not by itself diagnose an infection.
The inventory is available for up to 35 days. The retention mechanism may complete technical deletion later. We retain the history of events and changes in security posture for 90 days and daily statistics for 365 days. The device register, cumulative counts and audit trail of policy changes remain subject to the organization’s data retention rules. Disconnecting a device stops further reporting. The organization is responsible for the legal basis and scope of processing when managing its devices.
4. Enterprise Security Center (ESC)
To administer accounts and organizations, we process users’ contact details, organization membership and roles, authentication data, MFA configuration and invitation information. The data may come directly from the user or from the organization granting access.
The console stores the organization’s protection settings, connected device data, event reports and a history of permission and configuration changes. We retain data from previous API integrations, including key metadata, usage and billing, to the extent needed for billing, security and legal obligations. Access to information depends on the user’s role in the organization. The contract defines the scope of processing and the rules for deleting organization data.
5. Purposes and legal bases for processing
- Providing the service you ordered and taking steps before entering into a contract. Article 6(1)(b) GDPR applies when you are a party to the contract. This includes making product features available and carrying out an analysis you request.
- Contact with business representatives, organization account administration, service security, diagnostics and the pursuit or defense of legal claims. Article 6(1)(f) GDPR applies. Our legitimate interests are maintaining business relationships, operating our services and protecting against abuse.
- Compliance with legal obligations, including accounting obligations. Article 6(1)(c) GDPR applies to the extent required by law.
- Processing based on consent. Article 6(1)(a) GDPR applies where we ask for your consent. You may withdraw it without affecting the lawfulness of processing carried out before withdrawal.
A permission granted in Android enables a specific device feature. It does not constitute consent to use data for any purpose. Aggregate statistics that cannot identify an individual are not personal data.
6. Recipients and data locations
Our authorized personnel and providers of cloud infrastructure, hosting, email, authentication and security support services may access the data. Where necessary, we also share data with providers of accounting or legal advisory services and with authorities entitled to receive it by law.
The service’s primary computing infrastructure and database run in Google Cloud in the europe-west1 region in Belgium. However, analysis may use Google Vision for text and logo recognition and Google Web Risk to assess URL reputation. Google Vision uses a global endpoint. We do not represent that the entire analysis takes place exclusively within the European Union.
If processing by a provider involves transferring data outside the European Economic Area, the appropriate transfer basis applies. This may be a European Commission adequacy decision or safeguards such as standard contractual clauses. Contact us for information about the safeguards applicable to a particular service and how to obtain a copy.
DNS providers, the QR module provider and the websites you visit may act as separate controllers. Their own privacy policies govern their processing.
7. Retention periods
- Local network threat history
- Event details are automatically deleted after 30 days.
- Settings and local allowlists and blocklists
- Until you change or delete them. Clearing the app’s data or uninstalling it removes its local data.
- Content used for cloud analysis
- For the time needed to perform the analysis and prepare the result. We keep no server-side archive of page contents or screenshots. Technical request metadata may remain in logs.
- Shared detection register
- Entries containing the domain, available URL and assessment have a 30-day retention period. The retention mechanism may complete deletion after a technical delay. The local queue awaiting a connection is limited to 30 days.
- App statistics
- We retain acknowledgments of received counter batches for 35 days. Aggregate daily totals without user identifiers may be retained longer to evaluate how protection is working.
- Voluntary diagnostic reports
- Scheduled for automatic deletion after 90 days. The retention mechanism may complete deletion after a technical delay.
- Standard cloud service logs
- 30 days. This period does not apply to accounts, billing or a separate audit history.
- Accounts, organizations, historical API usage and audit history
- For the duration of the account or contract, then to the extent needed for billing, security, legal obligations or legal claims. These data have no single automatic deletion deadline. We determine the scope and timing of deletion after the relationship ends in accordance with the contract, the customer’s request and applicable law.
- Correspondence and business documents
- Until the matter or relationship ends, then only for the period required by law or needed to establish, pursue or defend legal claims, taking account of the relevant limitation period.
9. Your rights
Under the conditions set out in the GDPR, you can request access to your data and a copy, rectification, erasure or restriction of processing. In the circumstances provided for by law, you also have the right to data portability and to object to processing based on legitimate interests.
Send your request to contact@antiphishingtechnologies.com. We may ask for information needed to verify your identity. You can delete data stored only on your phone in the app or in Android settings. We have no remote access to the local history.
If we process data on behalf of your organization, contact that organization to exercise your rights. We assist the customer in handling requests within the scope of our role.
You may lodge a complaint with the President of the Polish Personal Data Protection Office. For information about the supervisory authority and how to contact it, visit the Personal Data Protection Office website.
We assess phishing risk to protect against threats. We do not use this assessment to make decisions about individuals that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR.
10. Security and changes to this policy
We use encryption in transit, access controls, MFA in ESC and roles within organizations. We limit the scope of the data transmitted. System backup of the Android app’s data is disabled.
We update this policy when our processing practices or the scope of services changes. We publish the new version on this page with its effective date. We inform you of changes that require additional notice or consent before starting the new processing.
Contact us about privacy