Privacy Policy
Version: October 6, 2026. Applies to honeybeelogic.com, honeybeetoolkit.com, and all Honeybee Logic products. For existing users, material changes take effect after the notice described in section 12; organizational contract changes take effect only through the applicable agreement.
Honeybee Logic Inc. ("Honeybee Logic," "we," "our," "us") builds AI-powered tools for educators. We are headquartered in Calgary, Alberta, Canada. We currently offer and sell our Services only to customers based in Canada. This Privacy Policy explains what personal information we collect, how we use and share it, and the rights you have. Our public websites may be visited from elsewhere; overseas service-provider processing does not mean we sell outside Canada. References to other jurisdictions' laws apply only where their legal scope is met, not as an announcement of foreign sales.
Plain-language summary: product inputs are intended to be non-personal and non-confidential. We protect the adult account, billing, support, and usage information needed to run the Services; we don't sell personal information or use it for third-party advertising. We don't authorize general-purpose generative-model training on your content; disclosed provider safety processing and provider-specific retention may apply. Organizational core application storage stays in Canada, subject to the specific DPA exceptions. Analytics providers receive limited usage information, not submitted content, and you can turn analytics off without losing access.
1. Who this policy covers — and who is responsible for your data
Individual users. If you use a personal account outside an organizational agreement, Honeybee Logic is responsible for your personal information ("controller," in the language of some privacy laws), and this policy governs.
Users under an organization. If your access is provided under a school authority's or other organization's agreement with us, that organization controls the data and decides why it is collected; we process it on the organization's behalf under our Data Privacy Agreement with them. This applies even if you sign up through a public page or use the same app as individual subscribers. Usage analytics in organizational tools is subject to that agreement, the organization's lawful authorization, and required notices and individual choices. This policy does not amend an existing customer contract. The organization is your first point of contact for requests about its data; you can also use our analytics controls or contact us about analytics.
Website visitors. Our public websites do not require a login. Honeybee Logic is responsible for website information, including usage analytics. Sections 2, 3, 5–13 explain the relevant collection, choices, safeguards, and rights.
2. What we collect
Website visitors. We may collect technical information needed to operate and secure the website, and the usage analytics described below. Merely browsing does not create a customer account.
Usage analytics on public websites and adult teacher tools. Where enabled, we use the analytics services identified on the Subprocessor List to measure visits, sessions, traffic sources, page or screen categories, engagement, and selected feature-use events. Providers receive pseudonymous browser/cookie identifiers, device and browser information, approximate location, and the permitted usage events. These identifiers can be personal information even though we do not attach your name. A provider may receive an IP address when the browser connects to derive approximate location; analytics services must not retain individual IP addresses. Provider-specific collection methods and configurations are disclosed on the list. We do not send analytics providers names, email addresses, account/user IDs, school/customer identifiers, student information, prompts, submitted or generated content, or identifying URLs. We do not link analytics activity to named accounts.
The following additional information applies when you use our products or contact us:
- Account information — name, email address, password (hashed), school or organization name if you provide it, language preference.
- Billing information — for paid individual plans, handled by our payment processor; we do not store full card numbers.
- Content you submit — prompts, lesson plans, materials, and other content you create or upload, including content you submit to AI features. Do not include information identifying a student directly or indirectly — describe learners in general terms only (e.g., "a grade 4 student reading below grade level"). This excludes student names, IDs, contact details, identifiable images or recordings, and student work, grades, report-card comments, health information, or learner profiles linked to an identifiable student. Removing a name is insufficient if other details still identify the learner. Section 10 explains how we handle accidental submissions.
- Usage data — pages viewed, features used, device and browser type, IP address, and similar log data.
- Support communications — emails and messages you send us.
We collect this directly from you, from your organization (when it provisions accounts), and automatically through the Services.
3. How we use it — and our legal bases
We use personal information to:
| Purpose | Legal basis (where one is required, e.g. EEA/UK) |
|---|---|
| Provide, operate, and secure the Services, including generating AI output you request | Performance of a contract |
| Process payments and manage subscriptions | Performance of a contract; legal obligation |
| Respond to support requests | Performance of a contract; legitimate interests |
| Improve our products, using de-identified or aggregated data wherever possible | Legitimate interests |
| Measure website and adult-tool use through usage analytics to understand and improve the Services, not to evaluate individual teachers | Consent, including notice-and-opt-out where applicable law and the circumstances permit it; prior express consent where required |
| Send service notices (renewals, changes to terms, security alerts) | Performance of a contract; legal obligation |
| Send product news, only where you've agreed or the law otherwise allows | Consent; legitimate interests (with opt-out) |
| Comply with law and enforce our terms | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we balance them against your rights; where we rely on consent, you can withdraw it at any time.
4. AI features
Our software products and AI inputs are intended for non-personal, non-confidential content, not sensitive-data processing. Do not enter student information, other personal information, private records, sensitive health or financial information, government identifiers, passwords, or confidential third-party material. Provide necessary adult account, billing, or support information only through the designated channels, not AI inputs. Warnings do not guarantee that accidental prohibited submissions are impossible; section 10 explains how we respond.
When you request an AI feature, permitted inputs and necessary request metadata are sent to third-party AI providers. We use paid commercial APIs directly as well as models accessed through cloud platforms; using a model through a cloud platform and calling its developer directly are different processing routes. Our provider list identifies the applicable services and processing locations.
We do not use your content to train or fine-tune general-purpose generative AI models, or authorize providers to do so. We select commercial services with corresponding restrictions and do not enable voluntary training/data-sharing programs for your content. Providers may process content to secure their services and enforce their policies, including limited human review and models used solely for safety/policy enforcement, as disclosed on the provider list. This is different from using your content to train general-purpose generative models. We may use de-identified, aggregated data to improve our products.
Provider retention varies. Paid APIs do not automatically provide zero retention. Providers may retain inputs and outputs for service operation or abuse monitoring, and longer for flagged safety incidents or legal requirements. Stored files, caches, conversations, and other features have separate lifetimes. The Subprocessor List summarizes provider retention practices and exceptions and links to relevant published provider information; the applicable practices vary by service, feature, and commercial terms. We do not promise one universal provider retention period. We review services and configurations, minimize inputs, and use available reduced-retention controls appropriate to the feature. Organizational processing must also comply with the organization's accepted agreement; updating this policy or the list does not amend it.
AI output can be inaccurate. Review it before use — especially before it reaches a classroom.
5. Sharing
We share personal information only with:
- Service providers (subprocessors) — hosting, payments, email delivery, analytics, and AI providers — bound by contract to protect it and use it only to provide services to us. Our current subprocessor list is available at https://honeybeelogic.com/legal/subprocessors.
- Analytics providers receive only the limited usage information described in section 2, under the applicable service and data-processing terms. We do not permit cross-device identity profiling, advertising personalization, remarketing, or optional use/sharing for unrelated provider products and services; we do not link analytics to advertising accounts or named customer accounts. Provider identities and corresponding settings are maintained on the Subprocessor List.
- Your organization — if your account is provisioned under an organizational agreement, that organization can access data in its accounts.
- Authorities, where the law requires it — and where permitted, we will notify the affected customer or user first.
- A buyer or successor in a merger, acquisition, or sale of our business, under confidentiality obligations and this policy.
We do not sell personal information, and we do not share it for third-party advertising or cross-context behavioural advertising.
Provider changes. The Subprocessor List describes providers we may engage, their services, service locations, and data-handling practices. We may change providers within this policy's existing purposes, data categories, safeguards, and retention limits, subject to the required review, disclosure, notice, and consent, without changing this policy merely to update a name or compatible setting. We retain dated prior list versions. Material changes to our practices remain subject to section 12 and any required consent; an organizational agreement has its own change process. Inclusion in the list does not replace any notice, objection, or consent requirements applicable to a provider's use, reduce an accepted contractual protection, or authorize a new use of personal information.
6. Cookies
Public websites and adult teacher tools. Where analytics is enabled, the services on the Subprocessor List may use analytics cookies or comparable browser identifiers to distinguish browsers and measure visits and usage. These are not necessary to browse or use the tools. Essential cookies or similar storage may be used for security, login, and remembering your preferences. The list describes the actual provider technologies and lifetimes.
Your analytics choice in the software tools. We provide a separate optional analytics choice during onboarding. Optional analytics remains off until you choose "Accept analytics"; accepting the software terms, signing in, dismissing a notice, or continuing without an analytics choice does not enable it. You can reject analytics and still use the tools. Organizational accounts must also satisfy the applicable contractual and legal authorization requirements, and an individual choice cannot override an organization-wide disablement.
On public websites. Where applicable law permits notice-and-opt-out for the information and context involved, we provide clear notice and a reasonable opportunity to decline before relying on that approach. We do not require an “Accept” button in every public-website context. Where prior express consent is required, analytics remains off until you accept. If the applicable requirements or authorization are not established, analytics remains off. A separate analytics refusal is never overridden by acceptance of software terms.
Use Analytics settings on the website or in the tools to turn analytics off or change your choice. Your choice is remembered in that browser; a different browser or device, or clearing its storage, may require you to choose again. Refusing analytics does not affect access to the website or Services. Turning it off stops future optional analytics collection; it does not automatically delete previously collected information. Contact privacy@honeybeelogic.com about deletion requests. We do not use advertising or targeting cookies. Browser controls are an additional option; disabling essential cookies may prevent login.
7. Where your data lives, and international transfers
Where your data is stored depends on how you use our Services:
- Website visitors. Our public website is hosted outside Canada. Website usage analytics may be processed and stored outside Canada in the locations disclosed on the Subprocessor List.
- School and organizational customers. Customer Data at rest stays in Canada — databases, file storage, backups, and operational logs containing personal information — subject to the specific exceptions in the applicable Data Privacy Agreement. This commitment is not tied to a particular cloud vendor. Its AI exception and, where expressly accepted, its separate usage-analytics exception permit only the described information to be processed abroad. Analytics providers never receive submitted content or student records.
- Individual users (for example, personal accounts on our self-serve products). Your data is hosted primarily in Canada, but may be processed or stored by us or our service providers in other countries disclosed on the Subprocessor List.
Canada holds an adequacy ruling from the European Commission for data protected under PIPEDA, which supports transfers from the EEA/UK.
Some service providers may process limited data (for example, payments, AI requests, or authorized usage analytics) in other countries where local laws may allow government access. The Subprocessor List identifies processing locations and purposes. The Privacy Officer at privacy@honeybeelogic.com can answer questions about our overseas-provider policies and practices. We use applicable contractual protections and put any additional safeguards required by applicable law in place before the transfer.
8. Retention
We keep personal information only as long as needed for the purposes above. For individual accounts: your content is available for export for 60 days after your account closes, then deleted from live systems, with backups rotating out within approximately 90 further days. Organizational data follows the Data Privacy Agreement with the organization. We may keep limited records (e.g., invoices) longer where tax or other law requires.
Those application deletion periods do not set the lifetime of AI-provider copies retained for the disclosed processing in section 4. Provider safety logs, legal holds, and stored-feature data follow the applicable service terms, subject to your accepted agreement; our provider list summarizes these practices and links to relevant published information. We use applicable deletion controls and assist with requests, but do not promise immediate deletion of every provider copy.
Identifiable or pseudonymous user-level and event-level analytics is retained for no more than 14 months, without resetting retention on new activity. Analytics browser identifiers expire within two years, subject to browser limits and renewal; our analytics controls remove applicable identifiers when you turn analytics off. These are our baseline limits, not commitments to a particular provider setting; the Subprocessor List states the actual configurations and lifetimes. Non-identifying aggregate reports may remain longer while useful for service measurement. Analytics retention remains separate from the content export/deletion timetable above.
9. Your rights
Depending on the law that applies to you, you may have the right to: access your personal information; correct it; delete it; export it (portability); object to or restrict certain processing; withdraw consent; and not be discriminated against for exercising these rights. Relevant laws include Canada's PIPEDA, Alberta/BC PIPA, and Quebec's private-sector privacy Act as amended by Law 25; EU/UK GDPR and US state privacy laws (including the California Consumer Privacy Act, as amended) apply where their legal scope is met. We do not treat every jurisdiction's rules as automatically applicable to every user.
To exercise them: individual users, contact us at privacy@honeybeelogic.com or use your account settings; organizational users, contact your organization first (we will help it respond). We respond within the time your law requires (30 days in most places, 45 under some US state laws). If we decline a request, we will explain why, and you may appeal by replying to our decision. You can also complain to your privacy regulator — for example, the Office of the Privacy Commissioner of Canada, your provincial commissioner, your EEA/UK supervisory authority, or your state attorney general.
We do not use personal information for automated decisions that produce legal or similarly significant effects about you.
10. Adult users, children, and student information
Our websites and products are intended for adults; individual account holders must be at least 18 or the age of majority where they live. Organizational accounts are for adult staff and other authorized adult personnel, not students. We do not provide student accounts, student access, or services involving identifiable student information, whether the student is a child or an adult. We do not knowingly collect or use such information to provide the Services. An organizational agreement, DPA, school consent, ordinary Order, or processing instruction does not authorize it. Adult account, billing, support, and permitted usage information remain personal information protected by this policy and applicable law.
Accidental submissions remain protected. If you believe student-identifying information or other prohibited personal, sensitive, or confidential content has been submitted, contact privacy@honeybeelogic.com. When we become aware of it, we restrict access and stop further use or onward disclosure except as necessary to contain the issue or comply with law. For organizational submissions, we promptly notify the organization and cooperate in secure deletion under the applicable DPA; for direct submissions, we arrange secure deletion, subject in each case to legally required retention and disclosed provider safety-retention limitations. Applicable safeguards, privacy rights, and breach-notification duties continue to apply. Accidental receipt does not authorize excluded services.
Optional usage analytics is not enabled on sensitive-content screens, and student information is not included in analytics events. Any student-facing screen is excluded from analytics as a defensive control, not as permission to offer student-facing services.
11. Security
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data — including encryption in transit, access controls, and least-privilege practices. No system is perfectly secure; if a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
12. Changes
We may update this policy. For material changes we will give notice (by email or in-product) at least 30 days before they take effect, and we will keep prior versions available on request. The "Version" date at the top tells you when it last changed.
13. Contact
Privacy Officer, Honeybee Logic Inc. Our Chief Executive Officer serves as our privacy officer — the person accountable for our personal-information practices and, for Quebec users, the person in charge of the protection of personal information. We will provide the officer's name on request. Calgary, Alberta, Canada Email: privacy@honeybeelogic.com (mailing address provided on request)