Terms of Use

These Terms of Use (“Terms”) govern your use of the website, platform, APIs, browser and email plug-ins, Mail Protection, security analysis tools and other PhiShark products and services offered by PHISHARK TEKNOLOJİ ANONİM ŞİRKETİ (“PhiShark”, “we”) (collectively, the “Services”).

You agree to these Terms by creating an account, checking the relevant acceptance box, placing an order, or using the Services after these Terms have been presented to you.

Statutory rights that must apply to consumers are not affected by these Terms.

1. Parties, compliance and contract documents

When using the Services and purchasing a paid subscription, you must have the legal capacity to perform the relevant transaction in your country.

If you are using the Services on behalf of a company, organization, or other legal entity, you acknowledge and agree that you have the authority to bind that entity to these Terms.

In addition to these Terms, the following documents may apply depending on usage:

• Acceptable Use Policy;
• Global Privacy Statement and KVKK Disclosure Text;
• Information on AI and Cybersecurity Outputs;
• Subscription, Cancellation, Withdrawal and Return Policy;
• Data Processing Addendum (“DPA”), if applicable;
• special conditions applicable to the product or plan; and
• For corporate customers, the order form or separately signed contract.

In case of conflict, the separately signed corporate contract or order form takes precedence in terms of its own subject. In case of a conflict regarding the processing of personal data, the DPA validly entered into force between the parties takes precedence in terms of its own subject.

2. Accounts and authorized users

You must provide accurate and up-to-date information when creating an account.

You are responsible for the security of your password, API key, access token and other authentication information. If you become aware of any unauthorized access or breach of security, you must notify PhiShark without delay.

For accounts created by an organization, the organization is responsible for managing access to the Services by its authorized users (“Authorized Users”) and for taking reasonable measures to ensure that such users comply with these Terms.

Except for cases caused by PhiShark's fault, PhiShark cannot be held responsible for the consequences resulting from the unauthorized use of your account or access information.

The account, subscription or API access may not be sold, rented or re-offered as a standalone service to third parties unless expressly permitted by the applicable plan or written agreement.

3. Right to use the services and terms of use

Subject to your compliance with these Terms and any applicable plan terms, PhiShark grants you a limited, non-exclusive, non-transferable right to access and use the Services for your own legitimate security purposes during the subscription or usage period.

PhiShark is specifically designed for defensive cybersecurity analysis.

In this context, you can analyze suspicious URLs, domain names, e-mails, QR codes, PDFs, files and similar contents that you have lawfully in your possession, have been sent to you or that you can lawfully access, for security purposes.

However, active scanning, penetration testing, vulnerability exploitation, credential testing or similar intrusive operations on third-party systems can only be carried out if you have the necessary authority.

Services;

• for an unlawful purpose;
• In a way that violates the rights of third parties;
• to carry out or facilitate attack, fraud, phishing or malware activities;
• PhiShark with the aim of disrupting the security or availability of systems;
• to gain unauthorized access;
• to resell or make available to third parties in a manner not permitted by the relevant plan; or
• for the purpose of reverse engineering the source code or underlying technology of the Services, except where permitted by applicable law.

you cannot use it.

Detailed usage rules are included in the Acceptable Use Policy.

4. AI and cybersecurity implications

PhiShark; It can produce security scores, classifications, explanations and warnings by utilizing technical security signals, threat intelligence, automatic controls and artificial intelligence-supported systems.

These outputs serve decision support purposes.

PhiShark;

• that all threats will be detected;
• that no false positive or false negative results will occur;
• whether a URL, email or file is definitively safe or harmful;
• that every attack or data loss will be prevented; or
• that the service will replace a human security expert or other security controls.

does not guarantee.

Appropriate human review, independent verification, backup, access control and incident response measures should be applied to significant security decisions.

PhiShark outputs should not be used as the sole basis for decisions of legal or similarly significant consequence about an individual, except where permitted by applicable law and where necessary human review has been provided.

For detailed information, you can refer to the Information on AI and Cyber Security Outcomes.

5. User Content and personal data

You retain your existing rights to the URLs, emails, files, text, data and other content that you submit to the Services or have processed through the Services (“User Content”).

PhiShark acquires no ownership rights in User Content.

By using the Services, PhiShark will only provide User Content to;

• To provide services and perform requested analyses;
• securely host, transmit and process content;
• provide technical support;
• To ensure the security of the Services and the prevention of abuse; and
• fulfill legal obligations

You grant us the right to use, host, reproduce and process it to the extent necessary.

You are responsible for ensuring that you have the necessary right, authority or legal basis to process and transmit the User Content you send to PhiShark.

We recommend that you do not submit passwords, payment card information, identification documents, sensitive personal data or similar sensitive information to the Services that are not required for analysis.

PhiShark may use aggregated or anonymized service and security statistics that do not directly identify the user to evaluate and improve the security, performance and effectiveness of the Services.

Personal data is processed in accordance with the Global Privacy Statement, KVKK Information Text and, to the extent applicable, the DPA in force between the parties.

6. Third-party services and integrations

The Services may integrate with Google, Microsoft, payment providers, cloud infrastructure or other third-party services.

Enabling a third-party integration may mean that you instruct PhiShark to share with or retrieve from that service data necessary for the relevant integration to work.

Third-party services may also apply their own terms of use and privacy policies. PhiShark is not responsible for any interruption, change or termination of third party services beyond its control; However, mandatory consumer rights are reserved.

7. Fees, credits and payments

The price, currency, taxes, billing period, usage/credit limits and other business terms of paid plans are displayed on the checkout screen, pricing page or relevant order form.

In credit-based plans, the amount of loans, the transactions in which they will be used and the renewal period are subject to the relevant plan description. Unless expressly stated otherwise, credits have no cash value and cannot be transferred to another account.

The unused portion of credits will be carried over to the next period only if the relevant plan clearly provides for this.

Payments may be made through third-party payment or billing providers.

If Dodo Payments or another organization is listed as “Merchant of Record” during checkout, the relevant provider's buyer conditions may also apply to the payment and purchase process. This does not eliminate the application of these Terms with respect to your access and use of the PhiShark Services.

In the event of payment method rejection or non-payment of a fee due, PhiShark may limit or suspend access to paid features upon reasonable notice. Urgent cases of fraud or security risk are reserved.

8. Subscription, renewal, termination and withdrawal

The subscription duration, payment period and renewal method are clearly displayed on the checkout or order form.

Corporate and commercial users

Commercial or corporate subscriptions can be renewed under the specified conditions if automatic renewal is stipulated in the checkout, order form or separate contract.

Subscription period, termination and renewal provisions in corporate order forms take precedence.

Consumers in Turkey

The mandatory rights of users who are considered consumers within the scope of the Consumer Protection Law No. 6502 are reserved.

Fixed-term consumer subscriptions are not automatically renewed for the same period unless the consumer's separate request or approval is received before the contract period ends.

Consumer subscriptions charged for an indefinite period or periodically may continue under the conditions announced at checkout and may be terminated by the consumer in accordance with the legislation.

The consumer may terminate his/her subscription through the account or other permanent data storage channels offered, without being subjected to a more severe method than the method used to establish the contract.

Termination requests of consumers in Turkey are fulfilled within seven days at the latest as required by applicable legislation.

In case of termination, amounts corresponding to services previously paid by the consumer but not yet provided will be refunded within fifteen days from the date of termination in accordance with the applicable legislation.

Consumers' 14-day right of withdrawal and applicable legal exceptions regarding distance contracts are reserved. An exception limiting the right of withdrawal applies only to the extent that the information and consent conditions stipulated in the legislation are met.

For detailed provisions, you can refer to the Subscription, Cancellation, Withdrawal and Refund Policy.

If consumers outside Türkiye have inalienable consumer rights in their country of residence, these rights are also reserved.

9. Availability of services and changes

PhiShark May continue to improve the Services and make changes to features for maintenance, security, legal compliance, technical development or capacity reasons.

A specific uptime is not guaranteed unless a separate service level (“SLA”) is promised in writing.

Planned maintenance work is carried out to reduce service interruption as much as possible.

If a change is made to the basic functions of a paid plan that significantly adversely affects the user, PhiShark will notify you in a reasonable amount of time, unless immediate changes are required for security or legal obligations.

In fixed-term consumer contracts, the nature, scope or fee of the service cannot be changed unilaterally to the detriment of the consumer or contrary to mandatory legislation.

Beta, trial and free features are subject to change or discontinuation unless expressly stated otherwise.

10. Suspension and termination

PhiShark;

• material breach of these Terms or the Acceptable Use Policy;
• unlawful use;
• security or misuse risk;
• Serious risk to PhiShark, other users or third parties;
• legal or regulatory obligation; or
• non-payment of overdue wages

may limit or suspend access to the Services to the extent reasonably necessary.

If the nature of the situation permits, PhiShark will provide advance notice and reasonable remedy for remediable violations.

In cases of urgent security risk, fraud or legal obligation, access may be limited without prior notice.

Upon termination of the agreement or account, your right to use the Services ends. Deletion and storage of User Content is subject to the Data Retention and Deletion Policy, applicable data protection legislation and the DPA, if applicable.

Intellectual property, confidentiality, payment, liability and dispute provisions, which by their nature must also be applied after termination, remain in force.

11. Intellectual property rights

PhiShark and its licensors; It owns the services, software, API, algorithms, models, design, documentation, brand, logo and all related intellectual property rights.

These Terms do not grant you any ownership rights in the PhiShark intellectual property other than the limited right to use it expressly granted.

If you provide suggestions or feedback regarding the Services, PhiShark may use this feedback free of charge to improve the Services, provided that it does not use your confidential information or personal data unlawfully.

Third-party or open source software used in the Services may be subject to its own license terms.

12. Warranties and disclaimers

PhiShark uses reasonable commercial and technical efforts to provide the Services in a secure and functional manner.

However, due to the nature of cyber security services, PhiShark;

• The Services will always be uninterrupted or error-free;
• all security vulnerabilities, phishing attempts or attacks will be detected;
• that the results will be complete or error-free in all cases; or
• The services will meet all security needs in a particular user environment.

does not guarantee.

For commercial users, the Services are provided as is, to the extent permitted by law, except for warranties which are also expressly agreed in writing.

This section does not eliminate or limit the rights that consumers have under defective service or other mandatory legislation.

13. B2B limits of liability and third party claims

This section applies only to users who use the Services for commercial or professional purposes and who are not consumers.

To the extent permitted by law, neither party will be liable to the other party for any indirect or consequential damage, loss of profits or revenue, loss of business opportunity or loss of reputation.

PhiShark's total liability arising under these Terms or the relevant Service is limited to the total fees paid or payable to PhiShark for the relevant Service in the 12 months before the first event giving rise to liability.

For Free Services, this total limit is the Turkish Lira equivalent of 100 EUR on the date of the event.

These limitations;

• intent or gross negligence;
• liability for death or personal injury that cannot be legally limited;
• fraud or intentional misrepresentation;
• data protection or confidentiality obligations that cannot be legally limited; or
• Other liabilities that cannot be limited under mandatory law

It does not apply in terms of

The commercial user covers reasonable and documented damages incurred by PhiShark, to the extent of its own fault and liability, in respect of third party claims arising directly from unlawful User Content, lack of the necessary right or authority over such content, or use of the Services in violation of these Terms or the Acceptable Use Policy.

14. Consumer rights

Nothing in these Terms can be interpreted as eliminating or limiting the rights of consumers under Law No. 6502, relevant regulations or other applicable mandatory legislation.

Especially consumers;

• pre-contract information;
• withdrawal;
• terminate the subscription;
• optional rights regarding defective service;
• refunds required by law; and
• Application to consumer arbitration committee or consumer court

rights reserved.

In case of conflict between these Terms and mandatory consumer legislation, mandatory legislation shall apply.

15. Applicable law and disputes

These Terms are governed by Turkish law, without prejudice to its conflict of law rules.

Regarding non-consumer users, Istanbul Anatolian Courts and Enforcement Offices have exclusive jurisdiction in cases where Turkish law allows jurisdiction agreements and especially in relationships where the parties are merchants.

In cases where this jurisdiction provision is not implemented, the jurisdiction of the legally competent courts and authorities is reserved.

Consumers may apply to consumer arbitration committees, consumer courts and other competent authorities in accordance with mandatory legislation.

Indispensable judicial remedies and consumer protections in the country where consumers reside outside Türkiye are reserved.

16. Amendments and general provisions

PhiShark may update these Terms due to regulatory, security requirements, product changes, or changes in business practices.

Before material changes take effect, reasonable notice will be given via the website, account or email, depending on the nature of the situation.

As a rule, changes are applied prospectively. Mandatory limitations regarding unilateral changes of consumer contracts to the detriment of the consumer are reserved. In case of changes that require legal re-approval or approval, the necessary approval is obtained.

If unforeseen events beyond the reasonable control of the parties prevent the performance of obligations, the affected party will not be held responsible to the extent that the obstacle continues, without prejudice to mandatory law.

The invalidity or unenforceability of a provision does not affect the validity of the other provisions.

Failure to exercise a right does not mean that that right is waived.

PhiShark may transfer this agreement within the scope of company merger, restructuring or transfer of the relevant business line; Consumers' mandatory rights and existing contractual protections cannot therefore be diminished.

These Terms and the applicable documents referenced herein constitute the agreement between the parties regarding the use of the Services, to the extent there is no separate signed agreement.

17. Company information and contact

PHISHARK TEKNOLOJİ ANONİM ŞİRKETİ

Cevizli Mah. Zuhal Cad. Ritim Istanbul Sitesi A5 Blok No:46E İç Kapı No:179 Maltepe/İstanbul

Tax Office / Tax Number: Kartal V.D. – 729 137 4297 MERSIS: 0729137429700001

Service and contract requests: [email protected] Privacy requests: [email protected]