Honeycomb

The AI Terms state that Honeycomb will use Input and Output to 'improve Honeycomb Intelligence features' and collect 'aggregated, anonymized usage and performance statistics,' but do not explicitly state whether user data trains the underlying AI models themselves. The language is vague on whether aggregated/anonymized data derived from customer inputs feeds model training. No explicit opt-out mechanism is documented for AI training.

“[AI Terms] 'Honeycomb assigns to Customer all our right, title, and interest (if any) in and to Output. Customer grants Honeycomb a worldwide, fully paid-up, royalty-free, and non-exclusive license to use, reproduce, adapt, modify, host, maintain, compile, translate, share and distribute such Input and Output for the purpose of providing Honeycomb Intelligence to Customer, creating and improving Honeycomb Intelligence features, and collecting and using aggregated, anonymized usage and performance statistics.'”

The ToS grants Honeycomb a 'worldwide, fully paid-up, royalty-free, and non-exclusive license' to use Customer Data 'for the purpose of providing and improving the Service' and to 'use such Customer Data (and data derived therefrom) to improve and enhance the Services and for other development, diagnostic and corrective purposes.' The license scope is broad ('improve and enhance') but limited to service improvement, not perpetual or sublicensable beyond service delivery. However, the language permits use 'during and after the term' which suggests some post-termination rights.

“[ToS] 'Customer hereby grants to Honeycomb a worldwide, fully paid-up, royalty-free, and non-exclusive license to use, reproduce, adapt, modify, host, maintain, process, compile, translate, share, display, distribute, and perform the Customer Data (and data derived therefrom) for the purpose of providing and improving the Service (and related systems and technologies) to Customer. Honeycomb will have the right (during and after the term hereof) to (i) use such Customer Data (and data derived therefrom) to improve and enhance the Services.'”

The Subprocessors list shows sharing with AWS, Sendgrid, Census, dbt Labs, Fivetran, Mode Analytics, and Salesforce for specific purposes (cloud services, emails, business intelligence, CRM). The DPA requires written agreements with subprocessors and Honeycomb remains liable for their acts. However, the Privacy Policy mentions sharing with 'service providers' and 'third parties' for analytics and AI services (e.g., OpenAI for Query Assistant) without explicit DPA requirements stated for all third parties. The AI Terms reference 'AI Providers' on the Subprocessor List but do not detail all sharing restrictions.

“[DPA] 'Honeycomb will enter into written agreements with each subprocessor containing reasonable provisions relating to the implementation of technical and organizational measures in compliance with Data Protection Laws. Honeycomb will remain liable for acts and omissions of its subprocessors in connection with the provision of the Service.' [Privacy] 'Certain features and functionality available to users of Honeycomb's Services are provided by third parties, including certain embedded video services, such as YouTube, and certain AI services that power features like Query Assistant, such as OpenAI.'”

The ToS states that after termination, 'Customer will no longer have access to Customer Data through the Service, and we may delete all such Customer Data' but provides no specific retention timeline. The DPA Section 2.5 states 'Upon your written request, Honeycomb will destroy all of Your Data in its possession when you delete your account on the Service' but qualifies this with 'subject to all applicable laws, regulations and Honeycomb's compliance policies.' The Privacy Policy states data is retained 'for as long as is necessary' but does not specify concrete periods. No automatic purge timeline on account termination is documented.

“[ToS] 'After any termination hereof, Customer will no longer have access to Customer Data through the Service, and we may delete all such Customer Data. We accept no liability for such deleted Customer Data.' [DPA] 'Upon your written request, Honeycomb will destroy all of Your Data in its possession when you delete your account on the Service. Notwithstanding the foregoing, any destruction shall be subject to all applicable laws, regulations and Honeycomb's compliance policies.'”

The AI Terms explicitly state: 'Honeycomb assigns to Customer all our right, title, and interest (if any) in and to Output.' The ToS also confirms that 'Customer will own the queries, results, conclusions or other analytics derived from the Service Data by the Service and provided to Customer as output therefrom (collectively, the 'Analysis Data').' This is a clear, explicit assignment of all IP rights in outputs to the customer with no vendor claims to the generated content.

“[AI Terms] 'Honeycomb assigns to Customer all our right, title, and interest (if any) in and to Output.' [ToS] 'Customer will own the queries, results, conclusions or other analytics derived from the Service Data by the Service and provided to Customer as output therefrom (collectively, the 'Analysis Data' and together with Service Data, 'Customer Data').'”

The DPA Section 3 explicitly states that 'Honeycomb will make available to you Honeycomb's most recent SOC 2 Type II audit report, or other report substantially similar thereto, prepared by an independent third-party auditor.' The Privacy Policy confirms Honeycomb's certification to the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework. The DPA also references GDPR, UK GDPR, CCPA, and CPRA compliance. These are explicit, documented compliance certifications.

“[DPA] 'Upon your request, Honeycomb will make available to you Honeycomb's most recent SOC 2 Type II audit report, or other report substantially similar thereto, prepared by an independent third-party auditor on Honeycomb's behalf.' [Privacy] 'Honeycomb has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.'”