Privacy
Plain language: what we keep, why, and how to have it removed.
Last updated October 27, 2026
No patient information
ScamSmarts never asks for protected health information (PHI) or any patient or customer records, and you should not enter any. The practice examples are made up. Training works without it.
What we store
- Account
- Your name and email address, used to sign you in with an emailed link.
- Organization
- Its name and the profile entered at sign-up: industry, team size band, email platform, whether you have cyber insurance, and your EHR or main system name if given.
- Training records
- Assignments, answers, scores, completion dates, certificates and policy acknowledgments for each person. These are the proof of training your organization relies on.
- Public quiz
- Answers stay in your browser. If you ask us to email your score, we keep that address, your score and the topics you missed so we can send it and follow up once.
- Contact requests
- What you send through a contact form: name, email, organization, team size and your message.
- Abuse limits
- Short-lived counters keyed on an IP address or email address, used to stop repeated sends.
We don't sell personal information or use it for advertising.
How long we keep it
- Training records and accounts: while your organization's account is open.
- Sign-in links expire within 15 minutes. Abuse-limit counters only count for up to a day.
- Quiz emails and contact requests: until you ask us to delete them, or two years, whichever comes first.
- Backups age out on our providers' normal rotation.
Who processes it
- Amazon Web Services (SES)
- Sends sign-in links, invitations and the emails you ask for.
- Neon
- Hosts the database.
- Vercel
- Hosts the website and application.
Deletion on request
Ask and we'll delete your personal information. If you're a learner, your organization's owner may also need to agree, because your training record is part of their proof of training. Use the form below and we'll confirm by email when it's done.