1. Who we are
Baitwise is a security-awareness training and phishing-simulation platform. It is operated by Odeta Kurti, a natural person based in Tirana, Albania ("Baitwise", "we", "us"). Baitwise is not yet a registered company; when it is, this page will name the company instead.
For the personal data described in section 3, we are the controller under Albania's Law No. 124/2024 "On personal data protection" and, where it applies, the EU General Data Protection Regulation (GDPR). You can reach us about anything in this policy at privacy@baitwise.al.
2. What this policy covers
This policy covers the website baitwise.al, our free tools, the contact and demo form, and the accounts of the people who sign up for or administer a Baitwise workspace.
It does not cover how a company uses Baitwise to train its own employees. In that case the company is the controller and we process the data on its behalf, under our data processing agreement. Section 5 explains what that means if you are one of those employees.
3. The data we collect
- Contact and demo requests: your name, email address, company, company size, country, the topic you chose and your message.
- Account data: your name, work email address and password (stored only as a salted hash, never in readable form), your company name and workspace address.
- Sign-in and security data: the IP address and browser (user agent) of each sign-in session, and IP addresses in short-lived counters we use to block brute-force and abuse attempts.
- Emails you send us, and our replies.
Our free tools (the phishing test, domain check, field guide and "I clicked a link" guide) use what you enter only to show you the result. We don't store it.
To understand how the website is used, we count visits with Umami Cloud, a privacy-friendly analytics service. It uses no cookies and doesn't store your IP address or anything else that identifies you: it records pages viewed, the site you came from, browser, device type and country, plus anonymous events such as "phishing test finished" with the score. It runs only on the public website, never inside the Baitwise console or employee portal, and never receives what you type into our forms or free tools. The site's fonts are served from our own server, and we use no advertising trackers.
4. Why we use it, and on what legal basis
- To answer your request and, if you ask, set up a demo or workspace: steps taken at your request before entering into a contract, or our legitimate interest in replying to people who contact us.
- To provide the service you or your company signed up for, including your account, support and service messages: performance of our contract.
- To keep Baitwise secure, prevent abuse and investigate incidents: our legitimate interest in protecting the service and its users.
- To meet legal obligations, such as accounting and tax rules once billing starts, or a lawful request from an authority: legal obligation.
These bases correspond to Article 6 of Law 124/2024 and Article 6 of the GDPR. We don't use your data for automated decisions that have legal or similarly significant effects on you, and we don't sell it.
5. If your employer uses Baitwise
If your company uses Baitwise to train you, your employer decides what is collected and why, and is the controller. We process the data only on its instructions. Depending on how your company uses Baitwise, this can include:
- your name, work email, role, department and job title;
- the trainings assigned to you, your quiz answers and scores;
- how you responded to simulated phishing messages (reported, ignored, clicked or replied) and how quickly;
- for simulations sent to your real inbox: when the message was delivered and, if the link was opened, the time, IP address and browser of the device that opened it. We use the IP address and browser to recognise email security scanners, so that you aren't blamed for a robot's click.
Your colleagues never see your individual results. To exercise your rights over this data, contact your employer first. If you contact us, we will pass your request on to them and help them answer it.
7. Where your data is stored
Our servers are in a Hetzner data centre in Nuremberg, Germany, within the European Union. Our AI provider, Anthropic, is in the United States; it receives only company-level information (such as a company's name, industry and the tools it uses) and the instructions an administrator types in, never employees' names, email addresses or results.
Where personal data is transferred outside Albania and the European Economic Area, we do so only with the safeguards required by Articles 40 and 41 of Law 124/2024 and Chapter V of the GDPR, such as standard contractual clauses.
8. How long we keep it
- Contact and demo requests: up to 24 months after our last exchange, unless you become a customer.
- Account and workspace data: for as long as the account or workspace exists. When a workspace is closed, we delete its data within 30 days.
- Backups: nightly copies of the database are kept for 14 days and then overwritten, so deleted data disappears from backups within 14 days.
- Data we must keep by law, such as invoices: for the period the law requires.
9. How we protect it
Data is encrypted in transit (HTTPS), passwords are stored only as salted hashes, each company's data is isolated and access is checked on the server for every request, and access to production systems is limited to the operator. Our Trust page describes the safeguards in more detail.
10. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you gave, without affecting processing that happened before.
To exercise these rights, email privacy@baitwise.al. We will answer within one month. We may ask you to confirm your identity first.
11. Complaints
If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to Albania's supervisory authority, the Commissioner for the Right to Information and Personal Data Protection (www.idp.al). If you live in the EU, you can also complain to the data protection authority in your country.
13. Changes to this policy
When we change this policy, we update the date at the top of this page. If a change materially affects how we use your data, we will also tell our customers by email before it takes effect.