Terms of Use

1. Who we are and what these Terms cover

We are Brightside Technologies SA, doing business as Brightside AI (“Brightside,” “we,” “us,” or “our”), a company registered in Switzerland at Route des Flumeaux 46, 1008 Prilly, Vaud. Our VAT number is CHE-313.450.443.TVA.

These Terms of Use (the “Terms”) govern access to and use of:

• our website at https://brside.com and any other site that links to these Terms (the “Site”);
• the Brightside AI security awareness platform, including its administrator and participant applications, integrations and APIs (the “Platform”); and
• any related products, support and professional services we provide,

together, the “Services”.

The Platform helps organisations train their workforce against social-engineering threats. It delivers interactive security awareness courses and runs authorised simulated attacks — including simulated phishing emails and simulated voice calls that use synthetic speech — against the organisation’s own personnel, then reports on the results.

By accessing the Services, creating an Account, or permitting anyone to use the Services on your behalf, you agree to these Terms. If you do not agree, do not use the Services.

You can reach us by email at support@brside.com, by phone at +41 21 539 1499, or by post at Route des Flumeaux 46, 1008 Prilly, Vaud, Switzerland.

2. Business use only

The Services are provided for business use only. They are not offered to consumers, and we do not knowingly make the Services available for personal, family or household purposes.

You must be at least 18 years old to use the Services. If you accept these Terms on behalf of an organisation, you represent that you have authority to bind that organisation, and “you” and “Customer” refer to that organisation.

3. Definitions

“Account” means the Customer’s tenancy on the Platform, including all Administrator and Participant access under it.

“Administrator” means an individual the Customer authorises to configure the Platform, launch Simulations, and view reporting.

“Authorised Partner” means a distributor or reseller that Brightside has authorised in writing to resell the Services.

“Customer Content” means material the Customer or its Administrators upload, supply or configure in the Platform, including target lists, email templates, call scripts, personas, branding, and Voice Samples.

“Customer Data” means personal data relating to Participants that we process on the Customer’s behalf through the Platform.

“Documentation” means the user guidance we make available for the Platform.

“Participant” means an individual — typically a member of the Customer’s workforce — who is enrolled in the Platform by the Customer, receives Simulations, or completes training.

“Partner Order” means the contract between the Customer and an Authorised Partner under which the Customer purchases the Services.

“Preview Feature” means a feature we make available as alpha, beta, preview, pilot or otherwise identified as not generally available.

“Simulation” means an authorised simulated social-engineering exercise run through the Platform against Participants, including simulated phishing emails, Voice Simulations, and combined exercises.

“Simulated Content” means content generated or assembled by the Platform for use in a Simulation, including AI-generated text, personas, synthetic speech, and any output derived from a Voice Sample.

“Subscription Agreement” means a signed order form, quotation, statement of work, or other written agreement between the Customer and Brightside covering the Services.

“Voice Sample” means an audio recording of an identifiable person that the Customer supplies so the Platform can generate a synthetic voice resembling that person.

“Voice Simulation” means a Simulation delivered as a telephone call using a preset or cloned synthetic voice.

4. Relationship to other agreements

These Terms apply to everyone who uses the Services, including under a free trial or proof of concept.

Where a Subscription Agreement exists between you and us, it governs commercial matters — fees, term, seat counts, service levels, and any negotiated variation. If a Subscription Agreement conflicts with these Terms, the Subscription Agreement prevails for the Customer that signed it.

Where you bought the Services through an Authorised Partner, the Partner Order governs commercial matters in place of a Subscription Agreement, and these Terms govern your use of the Services. An Authorised Partner cannot vary these Terms, and cannot give any warranty, service level, indemnity or other commitment on our behalf; if it has, that commitment binds it and not us.

Our processing of Customer Data is governed by our Data Processing Agreement, which we make available on request and which forms part of these Terms once entered into. Our own processing as controller is described in our Privacy Policy.

5. Accounts, Administrators and security

The Customer is responsible for:

• the accuracy of registration and configuration information;
• keeping credentials confidential, and for all activity under its Account;
• the acts and omissions of its Administrators and Participants; and
• notifying us promptly at support@brside.com on discovering any unauthorised access.

We may suspend an Account or any user where we reasonably believe there is a security risk, unlawful use, or a breach of Section 7, 8, 9 or 11. Where practicable, we will notify the Customer first.

6. The Services

Subject to these Terms, we grant the Customer a non-exclusive, non-transferable right, revocable in accordance with Section 16, to access and use the Services during the subscription term, for its own internal security awareness purposes.

Platform capabilities vary by plan, configuration and region, and are set out in the Subscription Agreement and Documentation. Some capabilities depend on operational prerequisites — for example, Voice Simulations require telephone numbers provisioned for the relevant jurisdiction, which we may need to purchase per legal entity and which may require a signed Subscription Agreement first.

We may modify, add to, or discontinue features. Where a change would materially reduce the core functionality the Customer subscribed to, we will give reasonable prior notice.

7. Authorised Simulations — Customer responsibilities

This Section is fundamental. The Platform generates deceptive communications by design. It may only be aimed at people the Customer is entitled to test.

The Customer instructs and authorises us to deliver Simulations to the Participants it enrols. The Customer represents, warrants and undertakes that, for every Simulation it configures or launches:

• a. it has the right and lawful authority to conduct simulated social-engineering exercises against each Participant, and each Participant is a member of its workforce or is otherwise within its lawful testing scope;
• b. it has established a valid legal basis for the associated processing of personal data, and has given Participants any privacy information required by applicable law;
• c. it has completed any consultation, notification, co-determination or approval process required before testing or monitoring personnel — including with works councils, employee representative bodies, or trade unions — in every jurisdiction where Participants are located;
• d. target lists, contact details and telephone numbers it supplies are accurate and relate to Participants it is entitled to contact; and
• e. the Simulation complies with applicable law in each jurisdiction where a Participant is located, including employment, telecommunications, data protection and anti-fraud law.

Participant-facing terms. We publish Employee Terms of Use, which explain the Services to Participants, including the use of synthetic voices and of information drawn from public sources. The Customer must make those terms available to its Participants — for example by linking them from its own security awareness, IT or HR policy pages — before the first Simulation runs.

The Customer must not use the Services to target any person outside its lawful testing scope, including members of the public, customers, suppliers, or employees of another organisation, except where that organisation has itself authorised the testing in writing and the Customer has provided us with evidence of that authorisation on request.

We do not verify the Customer’s authority to test any individual, and we are not responsible for determining whether a Simulation is lawful in a given jurisdiction. That determination rests with the Customer.

8. AI-generated and Simulated Content; voice cloning

The Platform creates Simulated Content, including AI-generated messages, personas and synthetic speech. Where the Customer supplies a Voice Sample, the Platform can generate speech resembling a specific, identifiable person.

Customer warranty. By supplying a Voice Sample, a photograph, a name, or any other material depicting or identifying a person, and by configuring Simulated Content that represents a person, the Customer represents and warrants that it has obtained all rights, permissions and consents necessary for us to process that material and to generate, store and deliver Simulated Content derived from it — including from the person depicted.

Named-individual impersonation. Where Simulated Content is designed to impersonate a specific, identifiable individual — such as an executive whose voice is cloned — the Customer must hold that individual’s documented, informed and freely given consent before the Simulation runs, and must provide it to us on request.

Licence to us. The Customer grants us a non-exclusive, worldwide, royalty-free licence to host, store, process, adapt and generate Simulated Content from Customer Content, solely as necessary to provide and operate the Services for the Customer.

Limits on use. Simulated Content is provided for authorised security training and testing only. The Customer must not use Simulated Content, or any output of the Services:

• to impersonate any person outside an authorised Simulation;
• to obtain money, credentials, or anything of value other than as part of an authorised Simulation whose results are used for training;
• to harass, defame, or discriminate against any person;
• to produce sexual, violent, or otherwise abusive depictions of any person; or
• in any manner prohibited by applicable law.

Nature of the output. Simulated Content is synthetic. It does not represent real statements, opinions or communications of any person it resembles, and it may be inaccurate. We give no warranty that Simulated Content will be indistinguishable from genuine communications, or that any Participant will or will not be deceived by it.

Transparency. We support the Customer’s transparency obligations for AI-generated content, including under the EU AI Act where it applies. The Customer remains responsible for making any disclosure required of it as the deployer of the Simulation, including any post-exercise debrief.

9. Voice Simulations, telephone calls and recording

Voice Simulations place telephone calls to Participants using automated systems and synthetic speech. The Customer acknowledges and agrees that:

• a. calls may originate from telephone numbers local to the Participant’s region and may not identify Brightside as the caller, because doing so would defeat the exercise;
• b. the Platform may record call audio and generate transcripts and automated pass/fail analysis, and recording can be disabled in the Account configuration where the Customer requires it;
• c. the Customer is responsible for ensuring that recording each call is lawful in the jurisdictions of both the Participant and the call origin, including obtaining any consent required by all-party-consent recording laws, and for configuring the Platform accordingly; and
• d. call charges, carrier behaviour, number availability and delivery are subject to third-party telecommunications providers, and we do not warrant that any call will connect.

10. Customer Data, privacy, security and integrations

For Customer Data, the Customer acts as controller and we act as processor. We process Customer Data only on the Customer’s documented instructions, as set out in the Data Processing Agreement.

Security. We maintain technical and organisational measures appropriate to the risk, designed to protect Customer Data against unauthorised access, loss, alteration and disclosure. These include access control, encryption of data in transit, logging, and restriction of personnel access on a need-to-know basis. We review these measures periodically and may update them, provided the level of protection is not materially reduced.

Incident notification. If we become aware of a personal data breach affecting Customer Data, we will notify the Customer without undue delay, provide the information reasonably available to us, and cooperate with the Customer in meeting its own notification obligations.

Because Participants’ personal data is processed on the Customer’s behalf, Participants should direct privacy questions and data subject requests to their employer, not to us. We will assist the Customer in responding, as required by the Data Processing Agreement.

Where the Customer connects the Platform to a third-party service — including Slack, Microsoft Teams, an LMS via SCORM, an identity provider, or an HR information system — the Customer authorises us to access and exchange data with that service as needed to provide the Services. The Customer is responsible for its use of, and its agreements with, those third-party services. We are not responsible for their acts, omissions or availability.

11. Acceptable use

The Customer must not, and must not permit anyone to:

• a. use the Services other than for authorised security awareness training and testing;
• b. copy, modify, translate, decompile, disassemble or reverse-engineer any part of the Platform, or attempt to derive its source code, models or prompts, except to the extent this restriction is unenforceable under applicable law;
• c. resell, sublicense, rent, or provide the Services to a third party as a service bureau, except under a written partner or reseller agreement with us;
• d. use the Services to develop a competing product, or to benchmark them for publication without our prior written consent;
• e. probe, scan or test the vulnerability of our systems, or circumvent any technical or security measure, except under a testing programme we have authorised in writing;
• f. introduce malicious code, or use the Services to distribute malware to any person;
• g. use automated means to access the Services other than through documented APIs, or place unreasonable load on the Services; or
• h. remove or obscure any proprietary notice.

12. Trials, proofs of concept and Preview Features

We may make the Services available under a free trial or proof of concept, in each case for the scope, seat count and period we specify. Trials and proofs of concept are provided “as is” and without warranty of any kind, and we may modify or end them at any time.

The 60-day export period in Section 16 applies to trials and proofs of concept as it does to any other Account. Where the Customer does not convert to a paid subscription, we will delete trial configuration and data at the end of that period unless a Subscription Agreement says otherwise.

Preview Features are provided for evaluation, may be incomplete or unstable, may change or be withdrawn without notice, and are excluded from any service level commitment. The Customer’s use of a Preview Feature is at its own risk. Where a Preview Feature conflicts with the rest of these Terms, this Section governs that feature.

13. Fees

Where a Subscription Agreement applies, fees, billing frequency, currency and payment terms are as set out in it. Unless it says otherwise, fees are exclusive of VAT and other applicable taxes, which the Customer must pay. Late payment may accrue interest at the rate permitted by Swiss law, and we may suspend the Services for material non-payment after giving notice and a reasonable opportunity to cure.

Where you bought the Services through an Authorised Partner, fees, billing frequency, currency and payment terms are as set out in the Partner Order and are payable to that Authorised Partner. The Services are not provided without charge in that case, and the paragraph above applies as though the Partner Order were a Subscription Agreement, except that we look to the Authorised Partner and not to you for payment. If an Authorised Partner fails to pay us for your subscription, we will not suspend the Services without first giving you written notice and a reasonable opportunity to pay us directly or otherwise arrange payment, and we will credit any payment you make us against your subscription.

Where neither a Subscription Agreement nor a Partner Order applies — for example a free trial, a proof of concept, or the free courses-only tier — the Services are provided without charge and we may withdraw them at any time.

14. Intellectual property

We and our licensors own the Services, the Platform, the Documentation, our course library, our templates, and all intellectual property in them. Except for the limited right granted in Section 6, no rights are granted to the Customer.

The Customer retains ownership of Customer Content. Aggregated results, reports and analytics we generate for the Customer through the Platform are made available to the Customer for its internal use.

We may use anonymised and aggregated data derived from operation of the Services — data that does not identify the Customer, any Participant, or any individual — to operate, secure, and improve the Services. The Customer instructs us to carry out that anonymisation as part of the Services, and the Data Processing Agreement records this instruction. We will not publish anonymised data in a form that identifies the Customer without its consent.

Feedback. If the Customer gives us suggestions or feedback, we may use them without restriction or obligation.

15. Confidentiality

Each party may receive non-public information of the other that is marked confidential or that a reasonable person would understand to be confidential. The receiving party must protect it with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and advisers who need it and are bound by confidentiality obligations.

These obligations do not apply to information that is or becomes public without breach, was already lawfully known, is independently developed, or is lawfully received from a third party. A party may disclose confidential information where legally compelled, giving the other party reasonable notice where lawful.

16. Term, suspension and termination

These Terms apply from first use of the Services until the Account is closed or the subscription term ends.

Either party may terminate for material breach that remains uncured 30 days after written notice. We may suspend or terminate access immediately where continued access presents a security, legal or reputational risk, or where Section 7 or Section 8 has been breached.

On termination, the Customer’s right to use the Services ends. We will make Customer Data available for export for 60 days after termination, after which we will delete it in accordance with the Data Processing Agreement, except where we must retain it by law.

Sections 8 (limits on use, warranties and the licence granted to us), 14, 15, 17, 18, 19, 21 and 22 survive termination.

17. Warranties and disclaimers

We warrant that we will provide the Services with reasonable skill and care.

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT SIMULATIONS WILL BE DELIVERED TO EVERY PARTICIPANT, OR THAT USE OF THE SERVICES WILL PREVENT ANY SECURITY INCIDENT, PHISHING COMPROMISE, FRAUD OR LOSS. THE SERVICES REDUCE HUMAN RISK; THEY DO NOT ELIMINATE IT.

Automated scoring, pass/fail analysis and risk indicators are generated in part by artificial intelligence and may be inaccurate. The Customer must not rely on them as the sole basis for any disciplinary, employment or other decision materially affecting an individual.

18. Limitation of liability

NEITHER PARTY IS LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, OR BUSINESS INTERRUPTION, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED OF THE POSSIBILITY.

OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS AND THE SERVICES WILL NOT EXCEED THE FEES PAID FOR THE SERVICES IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. FEES THE CUSTOMER PAID AN AUTHORISED PARTNER FOR THE SERVICES COUNT AS FEES PAID FOR THIS PURPOSE. WHERE THE SERVICES WERE PROVIDED WITHOUT CHARGE, AND THE CUSTOMER HAS PAID NEITHER US NOR AN AUTHORISED PARTNER, OUR TOTAL AGGREGATE LIABILITY WILL NOT EXCEED CHF 1,000.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under Swiss law, including liability for death or personal injury caused by negligence, for unlawful intent, or for gross negligence.

The limitations in this Section do not apply to the Customer’s obligations under Section 19, or to the Customer’s breach of Section 7, Section 8 or Section 11.

19. Indemnification

The Customer will defend, indemnify and hold harmless Brightside, its affiliates, and their officers, employees and agents against any third-party claim, and any resulting loss, damage, liability, fine, settlement or reasonable legal cost, arising out of or relating to:

• a. the Customer’s breach of Section 7 (Authorised Simulations), including any claim by a Participant or a regulator that a Simulation was conducted without a valid legal basis or without required employee-representation consultation;
• b. the Customer’s breach of Section 8, including any claim by a person whose voice, image, name or likeness was used in Simulated Content without the required rights, permissions or consents;
• c. the Customer’s breach of Section 9(c) relating to call recording; or
• d. the Customer’s Customer Content, or its use of the Services in breach of these Terms or applicable law.

We will notify the Customer of the claim, give it control of the defence (except that it may not settle in a way that imposes an obligation on us without our consent), and provide reasonable cooperation at the Customer’s expense.

20. Changes to these Terms

We may update these Terms. We will post the updated version with a new “Last updated” date, and where a change is material we will give reasonable notice — by email to Account Administrators or by notice in the Platform — before it takes effect. Continued use of the Services after the effective date constitutes acceptance. Where the Customer has a Subscription Agreement, changes take effect at its next renewal unless the change is required by law.

21. Governing law and jurisdiction

These Terms, and any dispute arising out of or in connection with them, are governed by the substantive laws of Switzerland, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods.

The parties submit to the exclusive jurisdiction of the ordinary courts of the Canton of Vaud, Switzerland, subject to any mandatory place of jurisdiction.

Before commencing proceedings, the parties will attempt in good faith to resolve any dispute through discussion between senior representatives for 30 days after written notice of the dispute.

22. General

Assignment. The Customer may not assign these Terms without our prior written consent, except to a successor of its business. We may assign to an affiliate or in connection with a merger or sale of assets.

Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control.

Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary, and the remainder stays in force.

No waiver. Failure to enforce a provision is not a waiver of it.

Entire agreement. These Terms, together with any Subscription Agreement, the Data Processing Agreement and the Privacy Policy, are the entire agreement between the parties on this subject and supersede prior discussions.

Notices. Notices to us go to support@brside.com and to Route des Flumeaux 46, 1008 Prilly, Vaud, Switzerland. Notices to the Customer go to the Account’s registered contact address.

Language. These Terms are drawn up in English. Any translation is for convenience, and the English version governs.

23. Contact

Questions about these Terms: