Privacy notice
Last updated: 30 September 2026
In short: we collect as little as possible. Your details from the demo form are used only to reply to you. The game stores play results linked to your company's access code. Only if your company turns on training records do we also store your work email, so it can document who completed its training. No ads, no tracking, no analytics, and we never sell data.
WHO IS RESPONSIBLE
Scammerson is run by Kostiantyn Khorozov, a private individual based in Switzerland. For anything about your data, write to privacy@scammerson.com.
WHAT WE COLLECT
| Where | What | Why |
|---|---|---|
| Demo request form | Name, work email, company, team size, your message | To reply to your request and arrange a demo or pilot |
| The game | Which case was played, how far the player got, peak suspicion, the choices made, and the company access code. No names, no emails. | To show your company how its team did, and to improve the cases |
| Knowledge checks | Your answers to the short "Spot the flag" checks before and after a case, the score, time spent, and the company access code | To show your company what its team already knew and what it learned |
| Training records (only if your company turns them on) | The work email you enter before the checks, linked to your plays and check results | So your employer can document that you completed the training, for example for compliance or internal audit |
| Access cookie | One cookie that remembers your access code for 90 days | So you don't have to type the code every time. Strictly necessary, set only after you enter a code. |
| Your browser | Your sound on/off setting and, if you entered it, your work email, stored only on your device | To remember whether you muted the game |
| Server logs | IP address, time and page requested, kept by our hosting provider for a short time | To keep the site running and protect it from abuse |
We don't use analytics, advertising or social media trackers.
LEGAL BASIS
We process demo requests because you asked us to contact you (steps before a possible contract, and our legitimate interest in answering you). Game results and logs are processed on the basis of our legitimate interest in providing a secure service and, for companies, to fulfil our agreement with them. Where Swiss law applies, we follow the Federal Act on Data Protection (nFADP); where EU law applies, the GDPR.
WHO ELSE HANDLES THE DATA
- Railway hosts the website and its database. Their servers for Scammerson are in the European Union (Netherlands), under the provider's data processing terms.
- Namecheap provides our domain and email, so messages you send us are stored in our mailbox with them.
We share nothing with anyone else, except where the law requires it. Company reports show results per access code. If a company turned on training records, it receives its own employees' records, and nobody else does.
HOW LONG WE KEEP IT
- Demo requests: up to 24 months after our last contact, then deleted.
- Game results: up to 24 months, or until the company asks us to delete them.
- Access cookie: 90 days, or until you clear it.
YOUR RIGHTS
You can ask us to show you the data we hold about you, correct it, delete it, or stop using it. Write to privacy@scammerson.com and we will answer within 30 days. If you think we got something wrong, you can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the data protection authority in your EU country.
CHANGES
If we change how we handle data, we update this page and the date at the top.