Privacy Policy

Last updated: September 11, 2026

1. Introduction

SafeOrFake ("we", "us", "our") operates the safeorfake.com website and the SafeOrFake email security service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

2.1 Email Analysis Data

When you forward an email to our analysis address (check@safeorfake.com), we process the following data to provide threat analysis:

  • Email headers (sender, recipient, routing information)
  • Email subject line and body content
  • URLs and links contained in the email
  • Attachment metadata (file names, types, sizes)

As soon as your report is delivered, the forwarded message is destroyed on our mail server and its contents are redacted from our records: the sender's address, the subject line, the body, the links, the headers and the attachment list. What remains is campaign evidence that identifies nobody — the date we received it, the risk level, the SPF, DKIM and DMARC results, the address the message was addressed to (normally our own analysis mailbox) and an irreversible fingerprint of its structure. If a report cannot be delivered, the same redaction runs automatically after 7 days. The remaining record is permanently deleted after 90 days.

2.2 Account / Registration Data

When you create an account, personal data (name and email address) is collected through our identity provider (Keycloak). Account and contact records are then synced to our CRM system (Hub) to manage your organization's access and notifications.

  • Name
  • Email address

2.3 Analytics Data

We use Umami, a privacy-focused analytics platform, to collect anonymous usage statistics. Umami does not use cookies, does not track users across websites, and does not collect any personally identifiable information. We collect aggregate data such as page views, referrer sources, and browser type.

2.4 Data About Other People Contained in a Reported Email

A message forwarded to us almost always contains personal data about people who never contacted us: the apparent sender, addresses quoted in the body, and anyone named in the original message. We process it to identify phishing and to protect the people and the brands being impersonated. Our legitimate interest in doing so is what permits this, under Article 6(1)(f) GDPR and Recital 49, which names network and information security as such an interest.

We cannot notify those people individually. Sender addresses in phishing messages are routinely forged, we hold no reliable way to reach the real person behind one, and writing to an address harvested from a phishing lure would itself be a fresh and unwanted use of their data. We therefore rely on Article 14(5)(b) GDPR, which allows this where individual notice is impossible or would require disproportionate effort, on the condition that the information is made public instead. This section is that publication.

This data is short-lived. It is redacted exactly as described in section 2.1, as soon as the report is delivered and in every case within the window stated there. If you believe a message we analysed contains your personal data, write to us and we will act on your request: contact@safeorfake.com .

3. How We Use Your Information

  • To analyze emails for phishing threats and deliver results to you
  • To detect and track phishing campaigns targeting specific brands
  • To alert companies when their brand is being impersonated
  • To respond to your inquiries and contact requests
  • To improve our service and detection capabilities

3.1 Legal Bases for Processing

  • Performance of a contract (Article 6(1)(b) GDPR) — analysing the message you forward to us, sending you the result, and running your account if you have one.
  • Legitimate interests (Article 6(1)(f) GDPR) — detecting and tracking phishing campaigns, warning the brands being impersonated, and keeping the service itself secure. Recital 49 GDPR recognises network and information security as a legitimate interest.

4. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We may share anonymized, aggregated campaign data with impersonated brands to help them protect their customers.

Our application, its database and its mail server run on infrastructure we rent from Infomaniak, in Switzerland. Switzerland is recognised by the European Commission as offering an adequate level of data protection, so storing your data there is not a transfer requiring additional safeguards.

Several parts of the service — our mail server (Stalwart), our identity provider (Keycloak), our AI gateway (LiteLLM), our CRM (Hub) and our analytics (Umami) — are software we run ourselves on that same infrastructure. They are not separate companies, and using them sends your data nowhere else.

The following third parties receive personal data on our behalf:

  • Infomaniak (Switzerland) — hosts the application, its database and its mail server. Everything described in this policy is stored on infrastructure it operates.
  • Mistral AI (France) — provides the AI model that analyses a reported message. The content of the message is sent to it through our own gateway. It is established in the European Union, so this is not a transfer of personal data outside the European Economic Area.
  • Mailgun (European Union) — delivers our outgoing email. It therefore receives your address and the full text of the report we send you.
  • Sentry (European Union) — collects technical error reports so we can fix faults. It receives diagnostic data and, if you are signed in, your account identifier — never your name, your email address or your IP address.

5. Data Retention

  • Email analysis data: Redacted as soon as your report is delivered — see section 2.1 — and after 7 days at the latest if the report could not be delivered. The redacted record is permanently deleted after 90 days.
  • Campaign A campaign groups messages that share a structural fingerprint. The descriptions of the sender and the subject that our analysis produces are deleted 30 days after the last message joined the campaign. The campaign itself is kept: it identifies nobody, and the reports we publish to impersonated brands link to it.
  • Takedown records: Where we work a takedown case with a brand, the names and email addresses of the people involved are removed 365 days after the case is closed. The record of what was done is kept.
  • AI usage records: A cost ledger holding a sender domain, a decision and a price — no message content, no addresses. Deleted after 395 days.
  • Account / registration data: Retained until you request deletion or the business relationship ends.
  • Analytics data: Anonymous aggregate data retained indefinitely.

Cookies

This site uses one strictly-necessary session cookie named _safeorfake_key. It keeps you signed in and remembers your language preference. No tracking or advertising cookies are used. Our analytics solution (Umami) is cookieless and does not track you across websites.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Data portability
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at contact@safeorfake.com .

7. Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (TLS), secure database storage, and access controls. However, no method of electronic transmission or storage is 100% secure.

8. Contact

For any questions about this Privacy Policy, contact us at: contact@safeorfake.com