Privacy policy
Last updated: September 2026
This policy explains what data nophi.sh (NXT Initiative SAS, "we") collects, why, how long we keep it and how to exercise your rights. It covers the nophi.sh website and the app.nophi.sh application.
1. Data collected
We collect: first and last name, work email address, company and job title of platform users and of the employees you import; IP address; platform usage data (simulation results, training progress). Passwords typed into the fake login pages used in simulations are not stored.
2. Why we process data
Your data is used to provide the phishing simulation and training service, to produce reports (dashboard, PDF report, CSV export), for security and support, and to communicate about your account. On the nophi.sh website we also measure traffic and, with your consent, how the site is used (see section 7).
3. Legal basis
Processing is based on performance of the contract (service delivery), our legitimate interest (security, service improvement, cookieless traffic measurement) and your consent (marketing communications, website usage analytics with PostHog). For the employees being tested, your company is the data controller and we act as processor. Processing usually rests on the company's legitimate interest in training its staff.
4. Data retention
Your data is kept for the duration of your subscription, then 30 days after termination, and then deleted. Billing data is kept for 10 years as required by law. Your cookie choice is kept for 6 months.
5. Your rights
Under GDPR, you have the following rights: access, rectification, erasure, portability, restriction of processing and objection. To exercise these rights, contact us at contact@nophi.sh.
6. Hosting, processors and security
The platform and its data are hosted in France by Nextmap, a French operator that runs its own network (AS35426). Payments are handled by Mollie. We apply appropriate technical and organisational measures to protect your data. The full list of processors is in the data processing agreement (DPA), available on request at contact@nophi.sh.
7. Cookies and analytics
We use two measurement tools on the nophi.sh website. Umami counts visits (pages viewed, where visitors come from) without cookies and without following you across sites. Under CNIL guidance this kind of audience measurement does not require consent. It applies to every visitor. PostHog measures how the site is used and records browsing sessions (replay), with form fields masked. PostHog only runs if you click "Accept" in the cookie banner. It then sets a cookie shared by the website and the app.nophi.sh application. We host PostHog on our own servers at Nextmap. Your choice (accept or refuse) is stored for 6 months in the nophish_consent cookie, valid on nophi.sh and its subdomains. You can change your mind at any time with the "Cookie settings" link at the bottom of every page. The app.nophi.sh application also uses cookies that are strictly necessary to keep you signed in. They do not require consent.
8. Contact
For any questions regarding the protection of your data, contact us at contact@nophi.sh.