Privacy Policy
Last updated: October 19, 2026
This policy explains what personal data HONED processes, why, where it is stored, how long it is kept and which rights you have. It follows the EU General Data Protection Regulation (GDPR).
1. Who is responsible
HONED is operated by Filip Kustec.
We have two roles:
- Controller for account data: your name, email, sign-in details, usage and the messages you send us.
- Processor for customer data: the files, examples, descriptions and API inputs you give us, and the datasets, models and outputs made from them. We process customer data only on your instructions, under our Data Processing Agreement. If customer data contains personal data of your clients or their customers, you (or your client) are the controller and answer their requests; we help you.
Privacy questions: kustec.filip@icloud.com.
2. Data we collect
- Account data: name, email address, profile photo, sign-in provider, account and session identifiers.
- Customer data: uploaded files (tables, PDFs, JSONL), task descriptions, answers to clarifying questions, corrections, and inputs and outputs of calls to your models.
- Usage data: training runs, evaluations, calls, token counts, costs, credits, API key names and when keys were last used.
- Invite data: your invite code and how many people opened it. If you joined through a friend’s link, your first name, when you joined and when you finished your first training are shown to that friend. We keep only a one-way hash of your email to count each person once.
- Technical and security data: IP address, browser and device information, logs and error reports.
HONED is a free beta with free credits. We do not collect payment card details or charge for use during the beta.
3. Why we use it and the legal basis
- To create your account, run the service, and train and test your models: contract (GDPR Art. 6(1)(b)).
- To secure the service, prevent abuse, fix errors and understand usage: legitimate interests (Art. 6(1)(f)).
- Optional analytics or marketing, if we add them: consent (Art. 6(1)(a)), which you can withdraw at any time.
For customer data, the legal basis is decided by you as controller. We process it only to provide the service to you.
We do not sell personal data and we do not use customer data to train models for other customers or for ourselves.
4. How customer data moves through HONED
- Uploaded files are stored in Cloudflare R2 under EU jurisdiction.
- When a table is read, common identifiers (email addresses, phone numbers, IBANs, card numbers, URLs, tax numbers) are replaced with placeholders. This masking is automatic and catches common formats only. It does not make data anonymous: names, addresses and free text stay as they are.
- To write data, train, evaluate and answer calls, the content (masked where it came from a table) is sent in plain text to Thinking Machines (Tinker) and, through Vercel AI Gateway, to model providers such as Anthropic, OpenAI and Google. These providers are mostly in the USA.
- Datasets, test sets and calls are stored in PlanetScale (Frankfurt) and encrypted with AES-256-GCM.
So files are stored in the EU, but training and evaluation run through the processors listed below, most of them in the USA. We do not claim that data stays in the EU.
5. Subprocessors
| Company | Location | Purpose |
|---|---|---|
| Vercel Inc. | USA (Washington, D.C.) | Hosting, server functions, background jobs and the AI Gateway that routes requests to model providers. |
| Thinking Machines Lab, Inc. (Tinker) | USA | Training your models and running them. Receives training data, test data and the inputs of calls to your model. |
| Anthropic, OpenAI and Google, through Vercel AI Gateway | USA | Asking clarifying questions, writing and labeling training data, and answering the test set so your model can be compared with them. |
| PlanetScale, Inc. | EU (Frankfurt) | Database. Datasets, test sets and calls are stored encrypted with AES-256-GCM. |
| Cloudflare, Inc. (R2) | EU jurisdiction | Storage of uploaded files until they are deleted. |
| Clerk, Inc. | USA | Sign-in, accounts, sessions and email codes. |
We update this list before we add or replace a subprocessor.
6. International transfers
Some subprocessors process data outside the European Economic Area, in the USA. PlanetScale and Cloudflare R2 store data in the EU. For transfers to the USA we rely on:
- Vercel: EU–US Data Privacy Framework (certified).
- Clerk: EU–US Data Privacy Framework (certified).
- Thinking Machines (Tinker): Standard Contractual Clauses in its data processing agreement.
- Anthropic, OpenAI and Google: Requests reach them through Vercel AI Gateway. Google is certified under the EU–US Data Privacy Framework; Anthropic and OpenAI provide Standard Contractual Clauses in their data processing terms.
7. How long we keep data
- Uploaded files: deleted after training or evaluation uses them, and at the latest 7 days after upload, by a daily deletion job.
- Datasets, models, evaluations and calls: until you delete the model or your account.
- Trained model weights stay with Thinking Machines, the training provider. After you delete a model, HONED removes its reference and the model can no longer be called. On written request to kustec.filip@icloud.com, we ask Thinking Machines to delete the weights.
- Usage records: until you delete your account, to show your activity and track provider costs.
- Account data: until you delete your account.
- Logs at our providers: for the limited periods set in their terms.
8. Delete and export
In Settings you can download all your data as a ZIP of JSON files, delete all your data, or delete your account. Deleting your account removes your models, datasets, calls, uploads, API keys and usage records from our database and storage at once. Trained model weights at Thinking Machines are handled as described in section 7.
9. Cookies and browser storage
We use only storage that the service needs. Clerk sets cookies that keep you signed in and protect sessions. We store your light or dark theme choice in local storage, and session storage remembers small interface states. We use no analytics or advertising cookies today. If we add analytics, we ask for your consent first.
10. Security
We use encryption in transit, encryption at rest for datasets and calls, access control per account, hashed storage paths, short-lived signed upload links, and API key rate limits. No system is perfectly secure. Tell us at once if you suspect unauthorized access.
11. Your rights
You have the right to access, correct, delete, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw consent. Write to kustec.filip@icloud.com. We answer within one month and may need to confirm your identity.
You can also complain to a data protection authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec, ip-rs.si).
12. Children
HONED is a business service and is not meant for children.
13. Changes
We update this policy when the service, our providers or the law change. The date above shows the current version.