Smish-Aware is designed to limit information to the authorised security-awareness purpose and to make aggregate insight the normal reporting experience.
The awareness purpose shapes how information is collected, interpreted, accessed and reported.
The platform is designed to use the information needed to operate an authorised simulation and provide awareness education. Campaign interaction data supports awareness reporting; it is not presented as forensic evidence.
Access to operational information is designed around authorised users and legitimate awareness purposes. Aggregate reporting is the default for broader campaign insight.
Aggregate reporting protects small groups by suppressing applicable results rather than presenting fabricated zero values.
Data collection and retention are designed to remain proportionate to the authorised awareness purpose, with lifecycle governance treated as part of the platform's privacy design.
Smish-Aware is designed to help authorised teams understand awareness outcomes without turning individual behaviour into a permanent employee risk label.
Security-awareness data has context. A send, click or other platform interaction describes an observed event; it should not automatically become a judgement about the person behind it.
This page describes privacy principles in the application. It is not a legal privacy notice or a substitute for an organisation's approved privacy policy. External services, backups and infrastructure have their own governance requirements; this page does not make third-party deletion claims.
Build practical awareness around authorised simulations, proportionate information use and reporting designed around learning.