Proof of Value Agreement

Last modified: Thursday 25th September 2025

1. Preamble

This Proof of Value Agreement (“Agreement”) sets forth the terms under which you may use PhishTool during a limited evaluation period (“Trial Period”). By accessing or using PhishTool services during the Trial Period, you agree to be bound by this Agreement, our Terms of Service, and our Privacy Policy.

References to “PhishTool”, “we”, “us” or “our” mean PhishTool Limited, registered in England and Wales (Company Number: 12126730), with registered office at International House, 36–38 Cornhill, London, EC3V 3NG, United Kingdom.

References to “you” or “your” mean the organisation or individual participating in the Proof of Value trial. References to “services” mean the applications, websites, services, and products provided by PhishTool during the Trial Period.

2. Provision of Services

PhishTool grants you a non-exclusive, non-transferable licence to access and use its services free of charge for the Trial Period.

The Trial Period shall not exceed six (6) months, unless extended in writing by PhishTool.

Access may be revoked at any time at PhishTool’s discretion.

3. Purpose and Limitations

• The services are provided for evaluation only and not for production use.
• All rights, title, and interest in and to the services remain the exclusive property of PhishTool.
• You may not resell, commercialise, or disclose performance results of the services to third parties without PhishTool’s prior written consent.

4. File Submission and Processing

By submitting a file during the Trial Period, you confirm that you are the owner or have the lawful right to submit it.

By submitting a file, you instruct PhishTool to process it for:

• Analysis and reporting to you;
• Storage for the duration of the Trial Period;
• Identifying phishing artefacts and indicators;
• Testing and improving PhishTool services.

You retain ownership of submitted files. PhishTool acts as processor and processes data only in accordance with your instructions.

5. Data Protection & GDPR

1. Roles
   • You are the data controller for files and personal data you submit. PhishTool is the data processor.
2. Hosting
   • Services are hosted entirely in the Amazon Web Services (AWS) Dublin region (eu-west-1).
3. Privacy Policy
   • Processing is subject to our Privacy Policy, which forms part of this Agreement.
4. Retention and Deletion
   • Files and personal data will be retained only for the Trial Period. Upon request, or within 30–60 days of the Trial Period ending, PhishTool will delete personal data from active systems.
   • Backup copies will be purged within 30–60 days.
   • Anonymised or aggregated data may be retained for service improvement.
5. Subprocessors
   • PhishTool uses approved subprocessors to provide the services: AWS, Stripe, NatWest, HubSpot, DocuSign.
6. Breach Notification
   • PhishTool will notify you without undue delay if we become aware of a personal data breach affecting trial data.

6. Confidentiality

You acknowledge that the services are proprietary to PhishTool and agree to keep confidential all information about the services, except as required by law or with PhishTool’s written consent.

7. Disclaimers

The services are provided “as is” during the Trial Period. To the maximum extent permitted by law, PhishTool disclaims all warranties, including merchantability, fitness for a particular purpose, and non-infringement.

8. Limitation of Liability

PhishTool shall not be liable for indirect, incidental, special, or consequential damages, including loss of profits, data, or goodwill.

PhishTool’s total aggregate liability under this Agreement shall not exceed £500.

Nothing in this Agreement excludes or limits liability for death, personal injury, fraud, or any liability which cannot be excluded by law.

9. Governing Law

This Agreement is governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction over any dispute arising from this Agreement.