Privacy Policy

InnoFlow LLC, 3833 Powerline Road Suite 201, Fort Lauderdale FL 33309, USA. Contact details and more are in our Legal Notice.

Our representative in the European Union under Art. 27 GDPR: N/V.

When you create an account: your email address, your password as a hash that cannot be reversed, and your billing details: name or company, address and, if you buy as a business, your VAT ID, which we verify. If you buy as a private individual, we compare the country of your address with the country of your payment method, because the tax we charge depends on it. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) and, for tax, our legal obligation (Art. 6(1)(c) GDPR). Without an email address and billing details, we cannot enter into a contract with you.

When you use HeyHoney: what you create, such as courses, pages, posts, appointments and emails. We process the data of your buyers, members and leads on your behalf. Our Data Processing Addendum applies to that.

When you ask Honey: your question, spoken or typed, and the figures from your account that Honey needs for the answer. We do not store recordings of your voice.

When you join a webinar: your name, your registration, your chat messages and, if you turn them on, your camera and microphone. The host is the creator; we provide the technology.

When you report a problem: your message, the page you were on, and technical details such as your browser and the latest error messages, so we can find the bug.

When you buy from a creator: your email address and the purchase itself. Your contract is with the creator, not with us. We provide the technology and store who has access to what, so you can get into your course.

When you just visit the site: our server logs the usual access data, meaning the time, the address requested and your IP address. We need this to run the service and to fend off attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

Security log: we record important events in an account, such as logins and changes to permissions. Without this, we could not tell what happened after an incident.

Only these services, and each one only what it needs for its job. We have a data processing agreement with each of them where they act on our behalf.

A payment providerpayments and payouts

Name or company, email, billing address, for businesses the VAT ID, amount and time, and the country of the payment method. For creators, also the details the law requires to verify the identity of the payout account.
Without a payment provider, there is no payment. We never see card details. They are entered directly with the payment provider and only stored there.

A video networkdelivering videos

The uploaded videos and, during playback, the viewer’s IP address.
A video has to come from somewhere. Playback runs through a link that expires after a few hours, so a course cannot spread by passing on an address.

A live video servicewebinars

Video and audio of everyone who turns on their camera or microphone in a webinar, plus the display names and IP addresses of participants. If the host records, the recording is stored with us afterwards.
Real-time live video needs a worldwide network of relay servers.

An email delivery servicedelivering emails

The recipient address and the content of each email, and for campaigns also whether it was delivered, opened or clicked.
Sign-in links, receipts and notifications have to arrive. We keep a record of whether an email was delivered, so we do not keep resending after a failure.

Speech and AI servicesHoney and the writing assistant

Only when you use Honey or the writing assistant: your spoken question for conversion to text, the question and the figures from your account needed for the answer, the answer text for reading aloud, and for the writing assistant your input and the text of the page.
Specialised services handle understanding, answering and reading aloud. We only send what is needed for that one answer. The microphone is only on when you turn it on. If Honey listens for “Hey Honey”, your device detects the wake word itself; only after that does the recording go to speech recognition.

A hosting providerservers and file storage

Everything on our servers and in our file storage, encrypted in transit and protected by access controls.
The platform has to run somewhere. The provider supplies the machines, and we run them.

A font servicedisplaying fonts

Your IP address, when your browser loads the fonts of this site.
The fonts HeyHoney uses are delivered by their provider.

Platforms you connect yourselfonly if you choose to

If you connect an account on a social platform, a CRM or newsletter tool, or a calendar, whatever you selected for that connection goes there.
You decide what gets connected, and you can disconnect any connection again.

Our payment provider is Stripe. When you set up payments or pay a creator, Stripe receives the personal data you enter and processes it in accordance with the Stripe Privacy Policy. For processing payments, Stripe acts on behalf of the seller. For fraud prevention, identity checks and legal compliance, Stripe acts as an independent controller.

We list the specific companies in our record of processing activities and will name them if you ask us at the address in our Legal Notice.

We do not sell personal information. We do not pass data to ad networks, apart from the ad measurement described below, which only runs with your consent. We only hand data to authorities when the law requires us to.

HeyHoney itself is a company based in the United States. What you give us from the EU or the UK for our contract with you is therefore also processed there. The basis for this is the performance of that contract (Art. 6(1)(b) and Art. 49(1)(b) GDPR, and the same provisions of the UK GDPR); there are no Standard Contractual Clauses for this transfer.

Some of these providers are based outside the European Union, mainly in the United States. Where data from the EU goes there, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified providers, or on the European Commission’s Standard Contractual Clauses.

We advertise HeyHoney, among other places on Meta (Facebook and Instagram), and would like to measure whether those ads work. This only happens if you allowed it in the banner. In that case, your browser loads the Meta Pixel: Meta learns that you are visiting our site (with your IP address and the page you visited) and sets its own cookies. If you then sign up, we also send Meta your email address as a checksum, meaning mathematically shortened and not in plain text, so the ad can be matched to the sign-up.

If you say no, or nothing at all, none of this loads: no script and no cookie from Meta. You can change your answer here at any time:

The legal basis is your consent (Art. 6(1)(a) GDPR). Meta also processes data in the United States; the transfer relies on the provider’s safeguards recognised by the European Commission.

HeyHoney’s cookies are either strictly necessary or store your answer to the banner. Most carry the prefix __Host- or __Secure-, which means they are only sent over HTTPS, and those with __Host- only apply to exactly this address. The language cookie is also sent over HTTPS only. For strictly necessary cookies, the legal basis is the EU rule that allows storage strictly needed for a service you asked for (Art. 5(3) of the ePrivacy Directive); for ad measurement, it is your consent.

__Host-hh_session

Keeps you signed in while you work.

__Host-hh_customer_session

Keeps a buyer signed in with a creator, with a separate cookie for each creator.

__Host-hh_mfa_enrollment

Guides you through setting up two-factor protection.

__Host-hh_buyer_mfa_enrollment_…, __Host-hh_buyer_mfa_challenge_…

The same for buyers who sign in with two-factor protection.

__Host-hh_signup

Remembers the plan you picked while you sign up, until you finish.

__Host-hh_purchase_return_…

Brings you back to the right place after you pay.

__Host-hh_funnel_besucher

A random ID so a funnel can count visits without knowing who you are. 30 days.

__Secure-hh_lead

After you sign up through a form: your name and email, sealed, so the thank-you page can greet you. 30 days.

__Host-hh_rueckweg

Only for HeyHoney staff: the way back out of an account view.

__Host-hh_zustimmung

Remembers your answer to the ad measurement question, yes or no, for 180 days. After that, we ask again.

__Secure-hh_creator_zustimmung

The same on a creator’s page, for that creator’s own ad measurement, 180 days.

hh_sprache

Remembers the language you picked, German or English. One year.

We do not currently read Do Not Track or Global Privacy Control signals from your browser. On our own pages, this changes nothing in practice: the ad measurement stays off until you say yes in the banner, whatever your browser sends.

Your browser also remembers a few settings locally, such as whether Honey should listen for “Hey Honey”, which panels are open in the editor, or the draft of a post. This stays in your browser and never reaches us.

On a creator’s page, the creator can add their own ad measurement, for example from Meta, Google, TikTok or Microsoft. That too only loads if you say yes in the banner there; the creator’s own privacy policy has the details.

If you connect an account on Instagram, Facebook, TikTok or YouTube in Publisher, we store your account’s ID on the platform, its name, the account handle, the address of the profile picture, the permissions granted, and the platform’s access tokens. The access tokens are stored encrypted and are only used to publish posts you have approved.

For your posts, we store the uploaded media, your texts and settings for each account, the schedule, and the result for each account, meaning the post’s ID and link on the platform. To publish, we pass media and text to the platform you chose, and that platform’s own terms apply there. Uploaded media stays in your media library until you delete it.

We do not read messages, comments or statistics through these connections.

Disconnecting and deletion. You can disconnect any connection in the channels section of your account. The access tokens are deleted right away and, where the platform offers it, we also withdraw the permission there. If you remove HeyHoney in the platform’s settings, the platform tells us and we delete the access as well. If you request deletion of your data through Facebook or Instagram, we also remove your account’s ID, name and picture, and show you the status on a confirmation page. Posts that are already published stay on the platform until you delete them there. For anything else, you can reach us using the details under “Who is responsible”.

Your account and everything that belongs to it, for as long as you are a customer. After that, we delete what we are not required to keep.

We keep invoices and tax records for ten years, because tax record-keeping rules require it, including the rules for VAT in the EU. This also applies if you delete your account: we may then no longer use these records for anything else, but we may not throw them away either.

Server access logs are overwritten after a short time.

Data is only transmitted encrypted. Passwords are only stored as a hash that cannot be reversed. Accounts use two-factor sign-in, which is mandatory for HeyHoney staff. The database itself keeps each customer’s data separate from every other customer’s. Access tokens for connected platforms are stored encrypted, paid videos and files are only available through time-limited links, and we log security-relevant events. The full list is in section 5 of our Data Processing Addendum. No system is perfectly secure; these are the measures we have in place.

You can ask for access to everything we have stored about you, and you can ask us to correct anything that is wrong. You can ask us to delete your data, unless we are required to keep it, and to restrict how we process it. You can get your data in a common format to take it with you. And you can object to processing that we base on a legitimate interest. In the EU and the UK, these are your rights under the GDPR.

An email to the address in our Legal Notice is enough. We do not need any particular form. Wherever you live, you can use these rights with us in the same way.

You can withdraw any consent at any time, for the future and without giving a reason.

If our answer is not enough for you, you can complain to any data protection supervisory authority in the EU, in particular in the country where you live or work. In the UK, that is the Information Commissioner’s Office.

Some US states, such as California under the CCPA as amended by the CPRA, give their residents specific privacy rights. This section is our notice for them.

What we collect, in the categories these laws use, as described in detail above: identifiers (name, email address, IP address, account IDs and a random visitor ID); customer records (billing details, business tax ID); commercial information (your plan, purchases and payments); internet activity (server access logs, error reports, funnel visits); audio and video (only if you turn on your camera or microphone in a webinar, or ask Honey by voice); and the content you create. Sensitive personal information: your sign-in details, which we only use to let you sign in.

Where it comes from: from you, from your browser or device, from the creator you buy from, and from platforms you connect yourself. What we use it for and who receives it is described in the sections above. How long we keep it is described under “How long we keep data”.

Your rights: you can ask us what personal information we have about you and to get a copy of it, to correct it, and to delete it, unless we are required to keep it, such as invoices for tax purposes. We will not treat you differently for using these rights.

We do not sell personal information. The only ad measurement on our own pages is Meta’s, described above, and it only runs if you say yes in the banner. Under California law, this kind of measurement can count as “sharing” personal information for cross-context behavioral advertising. If you never say yes, it never happens, and you can take back your yes at any time with the button in the ad measurement section.

To use these rights, email us at the address in our Legal Notice. If our answer does not satisfy you, write to us again and tell us why.

HeyHoney accounts are only for people who are at least 18 years old. Our own pages are not directed at children, and we do not knowingly collect personal information from children under 16, including children under 13. If you believe a child has given us personal information, write to us and we will delete it, unless we are required to keep it. Who an offer on a creator’s page is meant for is decided by that creator.

There are none. We do not score you, and no program here turns anyone down.

When we change this policy, we update the date at the top of this page.

You can reach us at info@heyhoney.io. Our full details are in our Legal Notice.