Privacy notice

Effective October 12, 2026

Contents

1. Who we are
2. Our two roles
3. What we collect
4. Signup checks for our customers
5. How we use data and why
6. Cookies
7. Who we share data with
8. How long we keep data
9. Your rights
10. Security
11. International transfers
12. Children
13. Changes to this notice
14. Contact us

1. Who we are

honeyp.ai is operated by Honeyp AI, Inc., a Delaware corporation in the United States ("honeyp.ai", "we", "us"). This notice explains how we handle personal data on our website, in our dashboards, and in the honeyp.ai service.

2. Our two roles

For our own visitors, applicants and customers, we decide how your data is used. Under the GDPR that makes us the controller.

For people who sign up to our customers' products, we check those signups on our customers' behalf and follow their instructions. Under the GDPR that makes us a processor; US state laws call this a service provider or processor. The company whose product you signed up to is responsible for that data and its own privacy notice applies. If you contact us about it, we pass your request to every customer that holds data about you. Our customers' obligations and ours for this data are set out in our Data Processing Agreement.

3. What we collect

Information you give us

• Early-access applications and enterprise enquiries: your work email, name, company, website, and your answers to the form (for example signup volume, the kinds of abuse you see, and your notes).
• Customer accounts: company name and website, the email addresses of you and your team members, your plan, and usage counts. We also note the website and work-email domains linked to each account, including the websites where our snippet runs, so each company gets one free trial.
• Billing: billing contact and subscription details. Payments are handled by Paddle, our reseller and merchant of record, which collects your payment and tax details itself; we never see or store your full card number.
• Support: the tickets and messages you send us and who sent them.
• Free abuse audits: the report we produce and, if you book a walkthrough, your email and company. Your browser turns your users' emails into one-way fingerprints and shortens IP addresses before uploading; we never receive the raw export, and the report contains only totals, email domains, network prefixes and masked examples. We never use it to train models or to check other companies' signups.
• Problem reports: if you use "Report a problem" on our status page, your email, the part of the service you chose and your message, so we can look into it and reply.
• Bot checks on our own forms: honeyp.ai checks submissions to our audit, early-access, demo and problem-report forms the same way it checks signups for customers (see section 4), to keep out automated abuse.
• Privacy requests: the email address the request is about, the type of request, any details you give us, and how we resolved it.

Information collected automatically

• Sign-in records: one-time sign-in links and codes and session records, stored only as hashes.
• Notifications: if you turn on notifications in our app, the address your device's push service gives us and the alerts you chose, until you turn them off or leave the account.
• Abuse prevention: a shortened form of your IP address (the first three parts only) when you use our self-serve signup, kept for one day to limit repeated attempts.
• Server logs: our hosting provider records standard request logs, including IP addresses, to run and protect the service.

We don't use analytics trackers, advertising pixels, or third-party scripts on our website.

4. Signup checks for our customers

When a company uses honeyp.ai and you sign up to its product, the company sends us information about that signup and we return a decision and score. We store only:

• the account ID the company gives us;
• a keyed hash of your email address (not the email itself) and its domain, and, if the address ends in a number (like jsmith4810), a keyed hash of its name-and-number pattern, used to spot generated series;
• your IP address shortened to its first three parts, and the general browser type. Before it's shortened, we look up which network it belongs to (for example a home internet provider, a hosting company or an anonymising network) and whether that network or address appears on public lists of networks and addresses known for spam or abuse; the full address is never stored;
• whether your email address appears on a public list of addresses recently reported for spam. We download those lists and compare on our own servers, so your details are never sent to anyone else to check;
• your device's time zone name (such as Europe/Berlin), compared with the network's country;
• for the email address's domain (never the address itself), whether it can receive mail and when it was registered, from public DNS and domain registration records;
• if the company sends them, short names of steps you took after signing up (such as "first_project") and when, used to spot accounts that all follow the same script;
• summary signals from the signup page, such as counts and yes/no flags (never your keystrokes or what you type);
• a keyed hash of your device's configuration (such as screen size, graphics and time zone, combined into a one-way code on your device) or of the app's device identifier, used only to spot one device opening many accounts with the same company. Nothing is stored on your device, and the code can't be matched across companies;
• the decision, score and reason codes, with timestamps;
• the numbers behind the decision, such as each signal's weight and the shape of the email address (its length and how many digits it has, never the address itself);
• what the company later tells us happened to the account, if it chooses to, such as whether it became a paying customer, was refunded or was banned.

We use the last two only to make that company's own checks more accurate, for example by suggesting better settings that a person at the company approves. We don't use one company's data to check signups for another.

We don't receive your name, your raw email address or your full IP address. The company decides what to do with our result, for example how many free credits to give you or whether to ask for an extra check. If you think a decision was wrong, contact that company and ask for a review. The company chooses how long we keep these records (up to 90 days on Trial and Starter, 180 on Growth and 365 on Enterprise; 30 days by default, and at most 90 for services used by children), after which we delete them automatically.

Asking for a review. If a company limited your account and you use our review form, we send your email and message to that company and don't keep a copy. We only record that the check was appealed, for 90 days.

Our live demo. If you try the demo at honeyp.ai/demo, we check that signup the same way and keep the same data for 7 days. The demo account itself (email and a hashed password) is kept in memory for at most 24 hours and never emailed.

5. How we use data and why

We only email you about your account, your application, your requests, and service updates. We won't add you to marketing emails without your consent, and every marketing email will have an unsubscribe link.

6. Cookies

We use only cookies that are strictly necessary to keep you signed in:

• hp_session: keeps customers signed in to the dashboard, for up to 7 days.
• hp_staff: keeps honeyp.ai staff signed in to our internal tools, for up to 12 hours.

We don't use analytics, advertising or cross-site tracking cookies, so there's nothing to opt out of.

7. Who we share data with

We don't sell personal data, "share" it for cross-context behavioral advertising, or give it to data brokers. We disclose it only to:

• Service providers that run honeyp.ai for us, under contracts that limit them to providing their service:
  • Render (application hosting and database, United States)
  • Resend (sending emails such as sign-in links and notifications, United States)
  • Your device's push service (Apple, Google, Mozilla or Microsoft), only if you turn on notifications; messages are end-to-end encrypted, so the service can't read them
  • DreamHost (our company mailboxes, United States)
  • Paddle (our reseller and merchant of record: payments, tax, receipts and invoices when you buy a paid plan; Paddle is responsible for the payment details it collects, under its own privacy notice)
  • Task-tracking tools such as Jira or Asana, if we use them to track support and applications internally
• The customer you signed up with, for signup checks we perform on its behalf.
• Authorities or other parties when the law requires it, or to protect our rights, users or the public.
• A buyer or successor if our business is sold or merged, under this notice's protections.

8. How long we keep data

Customers can ask us to delete their account and all its data at any time, from the dashboard's Privacy tab; we confirm with the account owner and delete it.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy in a portable format;
• correct inaccurate data;
• delete your data;
• object to or restrict how we use it, and withdraw consent where we rely on it;
• opt out of the sale or sharing of personal data, targeted advertising, and profiling (we don't do any of these, but you can still ask us to confirm it);
• appeal our decision on your request.

These rights come from laws including the EU and UK GDPR and US state privacy laws such as those of California, Colorado, Connecticut, Texas and Virginia. We offer them to everyone, wherever you live.

How to make a request

Use honeyp.ai/privacy/request or email privacy@honeyp.ai. We'll send a confirmation link to the email address the request is about, so only you can make it. We reply within 30 days of confirmation. Requests are free, and we won't treat you differently for making one. You can use an authorized agent; we may ask them for proof that you authorized them.

If we decline your request, you can appeal by choosing "Appeal" on the request page or replying to our email. We answer appeals within 45 days. If you're still unhappy, you can contact your state attorney general or, in the EU or UK, your data protection authority.

10. Security

We use encryption in transit (HTTPS), hash API keys, sign-in links, sessions and end-user emails, shorten IP addresses, encrypt the credentials customers give us for their tools, and keep an audit log of staff actions, including when staff open a customer's account. Access to our internal tools is limited to staff, who sign in with a passkey as well as their email. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the authorities as the law requires.

11. International transfers

We're based in the United States and store data there. If you're in the EU, UK or another region with transfer rules, your data is transferred to the US. We rely on our service providers' data processing terms, including the European Commission's standard contractual clauses where required.

12. Children

honeyp.ai is a service for businesses and isn't meant for anyone under 18. We don't knowingly collect children's personal data for ourselves. If you think a child has given us personal data, email privacy@honeyp.ai and we'll delete it.

Customers can check a child's account through the adult it belongs to. Then we receive nothing about the child: only the adult's account ID and the time the child account was added.

Some of our customers' services are used by children. When a customer tells us so, we use their signup checks only to protect that customer's own signups: we never combine them with other customers' data or use them to train or tune anything else, and we keep them for at most 90 days. The customer remains responsible for any parental consent their service needs.

13. Changes to this notice

We'll update the date at the top when this notice changes. If a change is significant, we'll tell customers by email before it takes effect.

14. Contact us

Honeyp AI, Inc. (honeyp.ai)
8 The Green, STE A, Dover, DE 19901, United States
Privacy: privacy@honeyp.ai
Everything else: support@honeyp.ai