Terms of Service

The website located at www.phishsense.cloud (the “Site”) is a copyrighted work belonging to EVRIZ USA, Inc. (“Company”, “us”, “our”, and “we”). The Service — including all underlying software, platform functionality, and methodologies — is owned by EVRIZ(이브리즈), a sole proprietorship in the Republic of Korea (“EVRIZ Korea”), and operated under a licensing arrangement with EVRIZ USA, Inc. The Service infrastructure — including all servers on which customer data is stored and processed — is operated by EVRIZ Korea. All customer data is stored exclusively on servers located in the Republic of Korea. Certain features of the Site may be subject to additional guidelines, terms, or rules, which will be posted on the Site in connection with such features. All such additional terms, guidelines, and rules are incorporated by reference into these Terms.

These Terms of Service (these “Terms”) set forth the legally binding terms and conditions that govern your use of the Site and the PhishSense phishing simulation and security awareness training platform (the “Service”). By accessing or using the Site or Service, you are accepting these Terms (on behalf of yourself or the entity that you represent), and you represent and warrant that you have the right, authority, and capacity to enter into these Terms. You may not access or use the Site or accept the Terms if you are not at least 18 years old. If you do not agree with all of the provisions of these Terms, do not access and/or use the Site.

1.1 Account Creation

In order to use certain features of the Site and Service, you must register for an account (“Account”) and provide certain information about yourself as prompted by the account registration form. You represent and warrant that: (a) all required registration information you submit is truthful and accurate; (b) you will maintain the accuracy of such information. You may delete your Account at any time by following the instructions on the Site or by contacting support@phishsense.cloud. Company may suspend or terminate your Account in accordance with Section 8.

1.2 Account Responsibilities

You are responsible for maintaining the confidentiality of your Account login information and are fully responsible for all activities that occur under your Account. You agree to immediately notify Company of any unauthorized use, or suspected unauthorized use of your Account or any other breach of security by emailing support@phishsense.cloud. Company cannot and will not be liable for any loss or damage arising from your failure to comply with the above requirements.

2.1 License

Subject to these Terms, Company grants you a non-transferable, non-exclusive, revocable, limited license to access and use the Site and, if you have subscribed to a paid plan, the Service, solely for your organization’s internal security awareness and phishing simulation purposes in accordance with these Terms and any applicable subscription plan.

2.2 Certain Restrictions

The rights granted to you in these Terms are subject to the following restrictions: (a) you shall not license, sell, rent, lease, transfer, assign, distribute, host, or otherwise commercially exploit the Site or Service; (b) you shall not modify, make derivative works of, disassemble, reverse compile or reverse engineer any part of the Site or Service; (c) you shall not access the Site or Service in order to build a similar or competitive website, product, or service; (d) no part of the Site may be copied, reproduced, distributed, republished, downloaded, displayed, posted or transmitted in any form; and (e) you shall not use the Service to send phishing simulation emails to any individuals who have not been expressly authorized by their employing organization.

2.3 Modification

Company reserves the right, at any time, to modify, suspend, or discontinue the Site or Service (in whole or in part) with or without notice to you. You agree that Company will not be liable to you or to any third party for any modification, suspension, or discontinuation of the Site or Service, except as otherwise provided in any applicable SLA.

2.4 Ownership

Excluding any User Content that you may provide, you acknowledge that all the intellectual property rights, including copyrights, patents, trademarks, and trade secrets, in the Site and Service are owned by Company or Company’s licensors (including EVRIZ Korea, which owns the underlying Service software, platform functionality, and methodologies). Neither these Terms nor your access to the Site transfers to you any rights, title or interest in such intellectual property rights, except for the limited access rights in Section 2.1. Company and its licensors reserve all rights not granted in these Terms.

2.5 Feedback

If you provide Company with any feedback or suggestions regarding the Site or Service (“Feedback”), you hereby assign to Company all rights in such Feedback and agree that Company shall have the right to use and fully exploit such Feedback. Company will treat any Feedback you provide as non-confidential and non-proprietary.

3.1 User Content

“User Content” means any and all information and content that a user submits to, or uses with, the Site or Service (e.g., phishing email templates, recipient lists, campaign configurations, branding assets). You are solely responsible for your User Content. You assume all risks associated with use of your User Content. Company is not obligated to backup any User Content, and your User Content may be deleted at any time following account termination without prior notice.

3.2 License to User Content

You hereby grant to Company an irrevocable, nonexclusive, royalty-free and fully paid, worldwide license to reproduce, process, and use your User Content solely for the purpose of providing and improving the Service. Company will not use your User Content for any other purpose without your prior written consent.

3.3 Acceptable Use Policy (AUP)

Authorized Use Only. The Service is designed exclusively for authorized internal security awareness training and phishing simulation programs. You represent and warrant that: (a) you have obtained all necessary authorizations from your organization; (b) all simulation targets are employees, contractors, or authorized personnel who have been informed that security testing may occur; and (c) you will not use the Service to send unsolicited phishing emails or conduct actual malicious phishing attacks.

Prohibited Activities. You agree not to use the Site or Service to: (i) conduct real phishing attacks or unauthorized fraud; (ii) collect personal data of third parties without authorization; (iii) upload malware, viruses, or harmful software; (iv) violate any applicable law including CAN-SPAM, GDPR, CASL, or data protection laws; (v) interfere with the Service’s integrity or performance; (vi) attempt unauthorized access to the Service; or (vii) generate unlawful, harmful, or objectionable content.

3.4 Enforcement

We reserve the right to review, refuse and/or remove any User Content, and to investigate and take appropriate action if you violate the AUP or these Terms, including removing your User Content, suspending or terminating your Account, and/or reporting you to law enforcement.

3.5 Indemnification

You agree to indemnify and hold Company harmless, including costs and attorneys’ fees, from any claim or demand made by any third party due to or arising out of (a) your use of the Site or Service, (b) your violation of these Terms, (c) your violation of applicable laws, (d) your User Content, or (e) any phishing simulation campaign you conduct using the Service.

4.1 Subscription Plans

Company offers the Service on a subscription basis. Available plans (including Free, Business, and Enterprise tiers) and their applicable fees are described on the Site’s pricing page. Company reserves the right to modify pricing with at least 30 days’ prior notice to active subscribers.

4.2 Payment and Auto-Renewal

Paid subscriptions purchased directly through the Site are billed in advance on an annual basis via Stripe by EVRIZ USA, Inc. By providing a payment method, you authorize Company to charge the applicable subscription fees on a recurring basis. YOUR SUBSCRIPTION WILL AUTOMATICALLY RENEW AT THE END OF EACH ANNUAL BILLING PERIOD UNLESS YOU CANCEL BEFORE THE RENEWAL DATE. You may cancel at any time through your account settings or by contacting support@phishsense.cloud.

Customers who have entered into a separate written agreement with EVRIZ Korea are billed directly by EVRIZ Korea under the terms of that separate agreement, including via invoice or tax invoice (세금계산서) where applicable. Such customers’ payment terms, billing cycle, and cancellation rights are governed by their individual agreement with EVRIZ Korea, and Sections 4.2 through 4.6 of these Terms do not apply to such customers with respect to amounts billed by EVRIZ Korea.

4.3 Refund and Cancellation Policy

You may request a full refund within 14 days of the initial purchase date, provided you have not conducted more than one phishing simulation campaign. Upon cancellation, your access continues until the end of the current annual billing period. No pro-rata refunds are provided for the remaining period after the 14-day window.

4.4 Taxes

All fees charged by EVRIZ USA, Inc. via Stripe are exclusive of applicable taxes. You are responsible for all taxes, levies, duties, or similar governmental assessments including VAT, GST, sales tax, use tax, or withholding tax associated with your Stripe subscription.

For customers billed by EVRIZ Korea, applicable taxes are handled in accordance with the separate agreement with EVRIZ Korea and applicable local tax law.

4.5 Overdue Payments

If any amount is overdue, Company may suspend access to the Service until paid in full. Company reserves the right to charge interest on overdue amounts at the lesser of 1.5% per month or the maximum rate permitted by law.

4.6 AI Credits

Each subscription plan includes a specified number of AI credits, which are consumed when using AI-powered features of the Service (e.g., AI template generation). AI credits are allocated per billing period and do not roll over to the next period. If you exhaust your included AI credits before the end of a billing period, you may purchase additional AI credit packs via the Service, billed as one-time charges through Stripe. Additional credit purchases are non-refundable once consumed.

5.1 Third-Party Links

The Site may contain links to third-party websites and services. Such links are not under the control of Company, and Company is not responsible for any third-party links. Company provides access to these links only as a convenience and does not review, approve, monitor, endorse, warrant, or make any representations with respect to them.

5.2 Release

You hereby release and forever discharge Company from each and every past, present and future dispute, claim, controversy, demand, right, obligation, liability, action and cause of action that has arisen or arises directly or indirectly out of the Site or Service. IF YOU ARE A CALIFORNIA RESIDENT, YOU HEREBY WAIVE CALIFORNIA CIVIL CODE SECTION 1542. IF YOU ARE A RESIDENT OF ANOTHER JURISDICTION THAT HAS A SIMILAR STATUTE, YOU HEREBY WAIVE THAT STATUTE.

THE SITE AND SERVICE ARE PROVIDED ON AN “AS-IS” AND “AS AVAILABLE” BASIS, AND COMPANY EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES AND CONDITIONS OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ALL WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, ACCURACY, OR NON-INFRINGEMENT. WE MAKE NO WARRANTY THAT THE SERVICE WILL MEET YOUR REQUIREMENTS, WILL BE AVAILABLE ON AN UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE BASIS, OR WILL BE ACCURATE, RELIABLE, COMPLETE, LEGAL, OR SAFE. IF APPLICABLE LAW REQUIRES ANY WARRANTIES WITH RESPECT TO THE SITE OR SERVICE, ALL SUCH WARRANTIES ARE LIMITED IN DURATION TO 90 DAYS FROM THE DATE OF FIRST USE.

Some jurisdictions do not allow the exclusion of implied warranties, so the above exclusion may not apply to you.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL COMPANY BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY LOST PROFITS, LOST DATA, COSTS OF PROCUREMENT OF SUBSTITUTE PRODUCTS, OR ANY INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL OR PUNITIVE DAMAGES ARISING FROM OR RELATING TO THESE TERMS OR YOUR USE OF THE SITE OR SERVICE.

OUR LIABILITY TO YOU FOR ANY DAMAGES WILL AT ALL TIMES BE LIMITED TO THE GREATER OF (A) THE AMOUNTS PAID BY YOU TO COMPANY IN THE TWELVE (12) MONTHS PRIOR TO THE CLAIM OR (B) FIFTY US DOLLARS (USD $50.00). THE EXISTENCE OF MORE THAN ONE CLAIM WILL NOT ENLARGE THIS LIMIT.

Some jurisdictions do not allow the limitation or exclusion of liability for incidental or consequential damages, so the above limitation may not apply to you.

Subject to this Section, these Terms will remain in full force and effect while you use the Site or Service. We may suspend or terminate your rights to use the Site or Service at any time for any reason at our sole discretion, including for any use in violation of these Terms, particularly the Acceptable Use Policy in Section 3.3. Upon termination, your Account and right to access the Site and Service will terminate immediately. Any termination of your Account may involve deletion of your User Content from our live databases. Even after your rights are terminated, Sections 2.2 through 2.5, Section 3 and Sections 4 through 10 will remain in effect.

Company respects the intellectual property of others. If you believe that one of our users is unlawfully infringing a copyright, the following information must be provided to our designated Copyright Agent (pursuant to 17 U.S.C. § 512(c)):

• Your physical or electronic signature
• Identification of the copyrighted work(s) that you claim to have been infringed
• Identification of the material you claim is infringing and that you request us to remove
• Sufficient information to permit us to locate such material
• Your address, telephone number, and e-mail address
• A statement that you have a good faith belief that use of the material is not authorized
• A statement that the information is accurate, and under penalty of perjury, that you are the copyright owner or authorized to act on their behalf

10.1 Changes

These Terms are subject to occasional revision. If we make any substantial changes, we may notify you by sending an e-mail and/or by prominently posting notice of the changes on our Site at least 30 days prior to the effective date. Continued use following notice shall indicate your acknowledgement and agreement to the updated terms.

10.2 Dispute Resolution and Arbitration Agreement

10.2(a) Applicability. You agree that any dispute between you and Company will be resolved by binding arbitration, except that (1) you and Company may assert individualized claims in small claims court; and (2) either party may seek equitable relief for infringement of intellectual property rights.

10.2(b) Informal Dispute Resolution. Before arbitration, the parties agree to meet and confer telephonically or via videoconference within 45 days of notice. Notice to Company: support@phishsense.cloud or 1301 N Broadway STE 93948, Los Angeles, CA 90012.

10.2(c) Arbitration Rules. Disputes under $250,000 shall be subject to JAMS’ Streamlined Arbitration Rules; all other disputes to JAMS’ Comprehensive Arbitration Rules. The arbitration will be conducted in the county where you reside, or, at Company’s election, via videoconference. Notwithstanding the foregoing, this Section 10.2 does not apply to users whose primary service agreement is with EVRIZ Korea, or to users in jurisdictions where mandatory local law prohibits binding pre-dispute arbitration.

10.2(d) Waiver of Jury Trial. YOU AND COMPANY HEREBY WAIVE ANY CONSTITUTIONAL AND STATUTORY RIGHTS TO SUE IN COURT AND HAVE A TRIAL IN FRONT OF A JUDGE OR A JURY.

10.2(e) Waiver of Class Action. YOU AND COMPANY AGREE THAT EACH MAY BRING CLAIMS ONLY ON AN INDIVIDUAL BASIS AND NOT ON A CLASS, REPRESENTATIVE, OR COLLECTIVE BASIS.

10.2(f) 30-Day Right to Opt Out. You have the right to opt out of this Arbitration Agreement by sending written notice to support@phishsense.cloud or to 1301 N Broadway STE 93948, Los Angeles, CA 90012 within 30 days.

10.3 Export

The Site and Service may be subject to U.S. export control laws. You agree not to export, reexport, or transfer any U.S. technical data acquired from Company in violation of United States export laws or regulations.

10.4 Disclosures

Company is a Delaware C-Corporation. Registered office address is on file with the Delaware Division of Corporations. Principal mailing address: 1301 N Broadway STE 93948, Los Angeles, California 90012.

Service infrastructure is provided by EVRIZ Korea, a sole proprietorship located in the Republic of Korea. For inquiries related to agreements with EVRIZ Korea or data matters for users in the Republic of Korea, contact: contact@evriz.co.kr

10.5 Electronic Communications

You consent to receive communications from Company in electronic form and agree that all such communications satisfy any legal requirement that they be in writing.

10.6 Entire Terms

These Terms constitute the entire agreement between you and us regarding the use of the Site and Service, except where a separate written agreement with EVRIZ Korea applies pursuant to Section 11.2(b). If any provision is held invalid or unenforceable, the other provisions will remain unimpaired. These Terms may not be assigned by you without Company’s prior written consent.

10.7 Governing Law

These Terms will be governed by the laws of the State of Delaware, United States, without regard to its conflict of law provisions, except as governed by the Federal Arbitration Act pursuant to Section 10.2.

Notwithstanding the foregoing, where mandatory provisions of applicable local law cannot be contractually waived, such provisions shall apply. Users in the Republic of Korea are subject to mandatory provisions of Korean law, including the Personal Information Protection Act (개인정보보호법) and the Act on Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률).

10.8 Copyright / Trademark Information

Copyright © 2026 EVRIZ USA, Inc. All rights reserved. The Site (www.phishsense.cloud) and its design are copyrighted works of EVRIZ USA, Inc. The Service, including all underlying software, platform functionality, and methodologies, is the intellectual property of EVRIZ Korea (이브리즈), Republic of Korea, licensed to EVRIZ USA, Inc. for operation of the Site. All trademarks, logos, and service marks displayed on the Site are the property of their respective owners. You are not permitted to use these Marks without prior written consent.

11.1 Service Infrastructure

The Service is operated by EVRIZ USA, Inc. under the PhishSense brand. All server infrastructure on which the Service runs and on which customer data is stored is owned and operated by EVRIZ Korea, a sole proprietorship in the Republic of Korea. EVRIZ USA, Inc. does not independently store, host, or maintain personnel-level access to customer data. EVRIZ Korea acts as the infrastructure operator and primary data controller of customer data. EVRIZ USA, Inc. operates the PhishSense brand and website under a licensing arrangement with EVRIZ Korea and does not independently control customer data.

11.2 Dual Billing Channels

The Service is available through two billing channels:

(a) Direct Subscription (Stripe): Customers who subscribe directly through the Site enter into an agreement with EVRIZ USA, Inc. and are billed via Stripe. These Terms apply in full to such customers.

(b) Invoice Agreement: Customers who enter into a separate written agreement with EVRIZ Korea are billed directly by EVRIZ Korea via invoice or tax invoice (세금계산서). Such customers are subject to the terms of their separate agreement with EVRIZ Korea, which supplements and, in the event of conflict regarding billing and governing law, supersedes these Terms.

Customers may use both channels simultaneously. In such cases, each channel is governed independently by its respective terms.

11.3 Data Storage

Regardless of billing channel, all customer data — including User Content, account information, and campaign data — is stored exclusively on servers located in the Republic of Korea, operated by EVRIZ Korea. No customer data is transferred outside of the Republic of Korea in connection with the Service.

11.4 Users in the Republic of Korea

For users located in or operating from the Republic of Korea, the following additional terms apply:

(a) Data Protection: Your personal information is processed in accordance with the Korean Personal Information Protection Act (PIPA / 개인정보보호법). EVRIZ Korea is the primary data controller and infrastructure operator responsible for your data.

(b) Rights under PIPA: You may request access, correction, deletion, or suspension of processing of your personal information by contacting EVRIZ Korea at contact@evriz.co.kr

(c) Dispute Resolution: Notwithstanding Section 10.2, users in the Republic of Korea who have contracted with EVRIZ Korea may resolve disputes through Korean courts or alternative dispute resolution bodies, including the Korea Fair Trade Commission (공정거래위원회) or the Personal Information Protection Commission (개인정보보호위원회).

(d) Consumer Protection: Mandatory provisions of the Korean Act on Consumer Protection in Electronic Commerce apply regardless of Section 10.7.