WOSP

Privacy Policy

How Honey House Tech handles personal data for WOSP customers, users, and website visitors.

Last updated: September 24, 2026

Draft policy modeled after common B2B SaaS privacy practices. Counsel will review before commercial launch.

This Privacy Policy explains how Honey House Tech ("Honey House", "we", "us") collects, uses, shares, and protects personal data when you visit wosp.app, use WOSP, sign up for an account, contact support, or interact with our billing and onboarding flows (collectively, the "Services").

1. Two roles: controller and processor

When we act as a controller, we decide how and why personal data is processed. That includes account registration, billing, marketing site analytics, support communications, and security of our own systems.

When we act as a processor (service provider), we process Customer Data on behalf of an MSP customer. That data often includes information about our customer's employees and end users in connected Google Workspace tenants. In that case the MSP customer is generally the controller and our processing is governed by the customer's instructions, our Terms of Service, and our Data Processing Addendum.

2. Personal data we collect

Depending on how you interact with us, we may collect:

  • Account and contact data: name, work email, organization name, billing address, phone, and support messages.
  • Billing data: subscription status and payment metadata from our payment processor (we do not store full card numbers).
  • Usage and technical data: IP address, browser type, device identifiers, logs, and product usage events needed to operate and secure the service.
  • Customer Data: Google Workspace directory, configuration, security findings, audit metadata, and credentials supplied to operate WOSP on your behalf. WOSP does not read mailbox message bodies by design.

3. How we use personal data

  • Provide, maintain, secure, and improve the Services.
  • Authenticate users, enforce roles, and prevent abuse.
  • Process payments and send transactional email (receipts, provisioning, security notices).
  • Respond to support requests and vulnerability reports.
  • Comply with law and enforce our agreements.
  • Create aggregated, de-identified statistics that do not identify a customer or person.

We do not sell personal data. We do not use Customer Data for unrelated advertising.

4. Legal bases (where GDPR or similar laws apply)

When we are a controller, we rely on contract performance, legitimate interests (security, product improvement, fraud prevention), consent where required, and legal obligation. When we are a processor, the customer determines the legal basis for Customer Data.

5. How we share data

We share personal data only as needed to operate the Services:

  • Infrastructure and subprocessors such as cloud hosting, email delivery, and payment processing, under contracts that require appropriate safeguards.
  • Google APIs when you connect Workspace tenants, under the permissions you grant.
  • Professional advisers (lawyers, accountants) under confidentiality obligations.
  • Authorities when required by law or to protect rights and safety.
  • Business transfers in connection with a merger, acquisition, or asset sale, with notice where required.

A current subprocessor list is available on request to paying customers.

6. Security and retention

We use administrative, physical, and technical measures designed to protect personal data. See our Security page for a customer-facing summary. No method of transmission or storage is completely secure.

We retain personal data for as long as needed to provide the Services, meet legal obligations, resolve disputes, and enforce agreements. Customer Data is deleted or returned after termination subject to backup cycles and legal holds.

7. International transfers

We may process data in the United States and other countries where we or our subprocessors operate. Where required, we use appropriate transfer mechanisms such as standard contractual clauses.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, and to object to certain processing. If we process your data as a processor, contact your MSP customer first; we will assist them as required by our DPA.

To exercise rights against Honey House as a controller, contact us through Honey House. We may need to verify your identity.

9. Children

The Services are not directed to children under 16. We do not knowingly collect their personal data.

10. Changes

We may update this Policy by posting a revised version and updating the date above. Material changes will be communicated when practicable.

11. Contact

Questions about this Policy: Honey House.