Terms of service

Last updated 9 August 2026

These terms cover your use of PhishTriage — the browser extension, the iOS app, the portal at portal.phishtriage.com, and the services behind them. Using any of them means you accept what follows.

Who you are contracting with

PhishTriage is operated by culfig OÜ, a company registered in Estonia. Contact details are on our contact page.

What PhishTriage does — and what it cannot do

PhishTriage analyses email, web pages and files you ask it about, or that it is configured to watch, and tells you what it thinks. It is a decision aid, not a guarantee.

Specific limits worth stating plainly:

• File protection covers the download paths a browser extension can see. Some downloads cannot be inspected before they are saved, and some cannot be inspected at all.
• Threat intelligence is never complete or instantaneous. A site or file we have not seen may be dangerous.
• The service depends on network availability. When our systems are unreachable, protection is reduced to what your device can do alone.

Your account and your devices

Devices register automatically and pseudonymously; you can link them to an account or an organisation. You are responsible for what happens under your account and for keeping any invite or enrolment codes to yourself. If your device belongs to an organisation that deployed PhishTriage, that organisation's administrator can configure and see activity as described in our privacy policy.

Acceptable use

Don't use PhishTriage to break the law, to attack or overload our systems, to resell or rebrand the service without a written agreement, or to submit content you have no right to submit. Don't attempt to use it to test, refine or develop malware or phishing campaigns against detection.

Plans and payment

The free tier is free, with the limits described where it is offered. Paid plans, when purchased, are billed in advance through our payment provider for the period you choose. Prices are shown before you pay. Statutory consumer rights, including any right of withdrawal you have under EU law, are unaffected by these terms.

You can cancel at any time; cancellation stops future billing and your account returns to the free tier at the end of the paid period. We do not refund partial periods except where the law requires it.

Your content and your data

What we collect, why, how long we keep it and how to delete it is set out in the privacy policy, which forms part of these terms. You keep all rights in the content you submit. We use it to produce your verdicts and to operate the service — not to train general-purpose models for anyone else.

Availability and changes

We aim to keep the service running but do not promise uninterrupted availability. We may change, add or withdraw features. If we make a change that materially reduces what you are paying for, we will tell you, and you may cancel.

Liability

The service is provided as it is. To the extent the law allows, we are not liable for losses arising from a threat PhishTriage failed to detect, from a false alarm, from your reliance on a verdict, or from any interruption of the service. Where liability cannot be excluded, it is limited to the amount you paid us in the twelve months before the claim. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited — including your rights as a consumer.

Ending it

You can stop using PhishTriage at any time and delete your data from the portal. We may suspend or end access if these terms are broken in a way that harms other users or our systems, and we will say why.

Governing law

These terms are governed by Estonian law, and disputes belong to the courts of Estonia. If you are a consumer in the EU, this does not deprive you of the protection of your own country's mandatory law, and you may also use the European Commission's online dispute resolution platform.

Changes to these terms

If we change these terms we will update this page and the date above. For changes that matter to you, we will give notice through the product or by email where we have one.