Honeyfield
Start free trial
Legal

Privacy Policy

Effective: October 19, 2026 · Pursuant to the GDPR

This English version is a convenience translation. In case of any discrepancy, the German version prevails.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Honeyfield GmbH
Strubergasse 26
5020 Salzburg, Austria

Email: hello@honeyfield.at
Phone: +43 676 4600960

2. Overview of data processing

Protecting your personal data is a matter of particular importance to us. We process your data exclusively on the basis of the statutory provisions (GDPR, TKG 2021 (Austrian Telecommunications Act), DSG (Austrian Data Protection Act)). In this privacy policy, we provide you with comprehensive information about the processing of personal data in connection with our website.

3. Hosting

Our website is hosted by Amazon Web Services (Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA). When you visit our website, the hosting provider automatically collects information in so-called server log files, which your browser transmits automatically. This information is:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the retrieved file
  • Referrer URL (previously visited website)
  • Browser and operating system used
  • Host name of the accessing computer

The legal basis for the data processing is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in providing our website securely and efficiently.

AWS is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection for the transfer of personal data to the USA. In addition, AWS operates data centers within the EU (Frankfurt am Main).

4. Contact and forms

If you contact us via the contact form or by email, the data you provide (name, email address, phone number, company, message and, where applicable, project details) will be stored by us for the purpose of processing your inquiry and in case of follow-up questions.

The data processing is based on Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in processing your inquiry).

Your data is stored and processed in our CRM system HubSpot (HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA, EU data center). HubSpot is certified under the EU-US Data Privacy Framework. More information: HubSpot Privacy Policy. We also keep registrations in the portal of the marketing platform in HubSpot; see section 11 for details.

Whitepaper: If you request a whitepaper, we also send you the download link by email via Brevo (Sendinblue SAS, Paris, France; data processing in the EU); the legal basis is Art. 6(1)(b) GDPR. If you also order practical examples by email in the form, you first receive a confirmation email (double opt-in). Only after you confirm do we store your name, email address, company, language and your answer on the number of clients you manage in Brevo and send you up to three follow-up emails; the legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 174 of the Austrian Telecommunications Act 2021). We store the time of your confirmation as proof. You can withdraw your consent at any time via the unsubscribe link in every email or by email to hello@honeyfield.at.

The data will be erased as soon as it is no longer required for the purpose of the processing. For contact inquiries, this is the case when the respective conversation has ended and no statutory retention obligations apply.

5. Cookies and consent management

Our website uses cookies. Cookies are small text files that your web browser stores on your device.

Strictly necessary cookies

These cookies are required for the operation of the website and cannot be deactivated. They include:

  • Cookie consent settings: storage of your privacy preferences (localStorage)

Legal basis: Section 165(3) TKG 2021 (strictly necessary storage) and Art. 6(1)(f) GDPR (legitimate interest).

Analytics cookies

These cookies allow us to evaluate the use of the website statistically and to improve our offering. They are only set with your express consent.

Legal basis: Section 165(3) TKG 2021 and Art. 6(1)(a) GDPR (consent).

Marketing cookies

These cookies are used to show you relevant advertising and to measure the effectiveness of our advertising campaigns. They are only set with your express consent.

Legal basis: Section 165(3) TKG 2021 and Art. 6(1)(a) GDPR (consent).

You can adjust or withdraw your cookie settings at any time via our cookie banner.

6. Web analytics

Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This tool makes it possible to manage website tags via an interface. The Tag Manager itself does not set any cookies and does not collect any personal data. However, it triggers other tags, which in turn may collect data.

Google Analytics

This website uses Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), a web analytics service. Google Analytics uses cookies to enable an analysis of the use of the website.

We have implemented the following data protection measures:

  • IP anonymization: your IP address is truncated within the EU/EEA before being transmitted to Google
  • Google Consent Mode: Google Analytics is only activated after your express consent
  • Data processing agreement concluded with Google

The information generated by the cookie is usually transmitted to a Google server in the USA and stored there. Google is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(a) GDPR (consent).

You can prevent collection by Google Analytics by refusing your consent in the cookie banner. More information: Google Privacy Policy

Microsoft Clarity

We use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to analyze user behavior (e.g. heatmaps and session recordings in aggregated, pseudonymized form) in order to improve our website. Clarity is embedded via Google Tag Manager and only activated after your express consent.

Legal basis: Art. 6(1)(a) GDPR (consent). More information: Microsoft Privacy Statement

7. Marketing and tracking

LinkedIn Insight Tag

We use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) for conversion measurement and retargeting. This tag enables the collection of data about visits to our website, including URL, referrer URL, IP address, device and browser characteristics, and timestamp.

The IP addresses are truncated and pseudonymized within seven days. The remaining pseudonymized data is deleted within 180 days.

Legal basis: Art. 6(1)(a) GDPR (consent). More information: LinkedIn Privacy Policy

8. External services and content

Google Fonts

We use Google Fonts (Google Ireland Limited) for the uniform display of fonts. The fonts are integrated via the Next.js optimization and are self-hosted from the build, so that no connection to Google servers is established when you visit the page.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a uniform presentation). More information: Google Fonts FAQ

YouTube videos

Videos are embedded via youtube-nocookie.com in privacy-enhanced mode and are only loaded after you actively click. When a video is played, your browser transmits data, including your IP address, to YouTube or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6(1)(a) GDPR (consent given by the click). More information: Google Privacy Policy

Social media links

Our website contains links to social networks. These are implemented as simple links and only transmit data to the respective platforms when clicked.

Connected advertising and marketing accounts in the platform (including Meta)

In our application (app.ads.honeyfield.at), you can connect your own accounts with third-party providers, such as Meta (Facebook), Google or LinkedIn, so that our platform can read advertising data and manage campaigns on your behalf. In doing so, we process: your user ID with the respective provider, access tokens (stored encrypted, AWS KMS, region Frankfurt/EU), the IDs of the advertising accounts you have selected, and the campaign and performance data retrieved via the respective interfaces. This data is displayed exclusively to you or to the members of your organization whom you have authorized, is not shared with third parties and is not analyzed across accounts.

For data that we receive via Google APIs (Google Ads, Google Analytics, Search Console, Tag Manager, Business Profile, Data Manager), the following also applies: its use complies with the Google API Services User Data Policy including the Limited Use requirements. This data is used exclusively for the user-facing features of the platform, is not transferred or sold to third parties, is not used for advertising and is not read by humans (except with your consent, for security reasons or where required by law).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Deletion of connection data (Data Deletion Instructions): You can delete any connection yourself at any time: in the application under Settings → Meta Ads → Delete (similarly for other providers). This irrevocably removes the stored access tokens. Alternatively, an email to vernes@honeyfield.at is sufficient; the deletion will then take place within 30 days. In addition, you can revoke the app’s access in your Meta settings (Facebook → Settings → Apps and Websites).

Payment processing (Stripe)

For paid plans, we use Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). When you take out a subscription, we transmit your email address and the name of your organization to Stripe; the billing data (selected plan, number of Workspaces, term, payment status, invoices) is additionally generated there. You enter payment data such as card numbers exclusively on a page hosted by Stripe; it never reaches our systems and is neither processed nor stored by us. A transfer to Stripe, Inc. in the USA cannot be ruled out; Stripe bases such transfers on the Standard Contractual Clauses (SCCs) of the European Commission. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). More information in the Stripe Privacy Policy.

Internal notifications (Slack)

We notify ourselves internally about events in the platform via Slack (Slack Technologies Limited, Dublin, Ireland; part of the Salesforce group). The following is transmitted: for a new registration, your name and email address; when a Workspace is created, its name, the name of your organization and the email address of the person creating it; and for technical warnings, the identifier of the affected Workspace. Contents of your advertising accounts or reports are not transmitted. The purpose is the operation of the Service and prompt support. A transfer to the USA cannot be ruled out; Slack bases such transfers on the Standard Contractual Clauses (SCCs) of the European Commission. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning operations and support process). More information in the Slack Privacy Policy.

9. Google user data in the Honeyfield marketing platform

At your request, our application (portal at app.ads.honeyfield.at and the Honeyfield MCP server) can be connected to your Google account via Google OAuth. The following additionally applies to this connection.

To the extent that we process personal data on your behalf in this context, we do so on the basis of the data processing agreement pursuant to Art. 28 GDPR. It also names the sub-processors used and the deletion periods, and it is concluded upon registration in the portal.

Which Google user data we retrieve

Depending on the permissions you grant on the Google consent screen, the application accesses the following data:

  • Google Ads (scope adwords): campaign, ad, keyword, budget and performance data of your advertising accounts as well as changes to them, but only on your express instruction.
  • Google Analytics 4 (scopes analytics.readonly, analytics.edit): report data (visitors, sources, conversions) and property configuration (e.g. key events, data streams, links).
  • Google Search Console (scope webmasters): search performance data (search queries, clicks, positions) and sitemaps of your verified websites.
  • Google Tag Manager (scopes tagmanager.readonly, tagmanager.edit.containers, tagmanager.edit.containerversions, tagmanager.publish): container configuration (tags, triggers, variables) as well as creating and publishing container versions on your instruction.
  • Google Business Profile (scope business.manage): business profile data (opening hours, categories, posts, photos) and reviews, including your replies to them.
  • Google Data Manager (scope datamanager): transmission of customer lists for Customer Match audiences and of conversion data to Google Ads that you provide yourself. Contact data is normalized and hashed with SHA-256 before transmission; Google receives only the hashed values.

How we use Google user data

The retrieved data is used exclusively to provide the features you request: the application answers your questions in the AI assistant you have connected (e.g. Claude or ChatGPT) and carries out changes that you expressly instruct or approve. We do not use Google user data for our own advertising purposes, do not sell it, do not pass it on to third parties (except to the processors required for providing the Service, in particular Amazon Web Services, region eu-central-1/Frankfurt) and do not use it to train AI/ML models.

We permanently store only what the connection requires: the OAuth refresh token (encrypted with AWS KMS, EU region), the email address of the connected Google account, the granted permissions (scopes) and the IDs of the accounts, properties and locations you assign to a Workspace. In addition, we keep two logs: a usage log without content data (tool name, organization and Workspace, time, duration, success/failure and, in the event of failures, a short technical error code without message text) and a change journal. The change journal keeps a traceable record of which changes were made to your advertising accounts, website content or profiles; for this purpose, it stores the tool name, the parameters passed, the email address of the person acting and notes your AI assistant adds about a change. Parameters whose names indicate tokens, secrets, passwords or API keys are removed before storage. Bulk data such as customer lists, conversion data, leads, Tag Manager parameters and uploaded files is never stored by content, at most by its extent (number of entries or field names). If the parameters as a whole exceed a size limit, only their names are stored, not their values. The change journal serves the same function as the notes feature in Google Ads and is a prerequisite for you to be able to attribute changes later. The usage log and the change journal are both deleted automatically after 24 months. Retrieved Google data is passed through to answer your request and is not stored permanently by us.

Honeyfield’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke the connection at any time: in the portal (delete connection) or at myaccount.google.com/permissions. If you delete the connection in the portal, the stored refresh token is deleted from our database. Revoking access at Google makes the token unusable immediately; we delete it from our database as soon as you delete the connection in the portal or ask us to by email at hello@honeyfield.at.

10. Honeyfield Connector (WordPress plugin)

Customers can optionally install our plugin “Honeyfield Connector” on their own WordPress website. It provides a signed interface through which the platform can read content and, after approval, change it. The plugin does not send any data on its own initiative; it only responds to signed requests. Without a stored connection key, it is completely inactive.

Once the connection key has been entered, all modules are active. The operator of the website can switch off each module individually in the plugin settings:

  • Content: read page builder content (Elementor, Bricks) and change individual texts.
  • SEO: read and change metadata (Yoast SEO, Rank Math).
  • Tracking: embedding of a Google Tag Manager container in the page header. The container itself does not set any cookies; which services it triggers is determined by the operator in its configuration. Google Analytics 4 and the Meta Pixel deliberately cannot be embedded directly via this module. Before the container, Google Consent Mode v2 signals are set to the “denied” state so that tags are not triggered in an undefined state. Loading the container script nevertheless transmits the IP address, browser identifier and the page visited to Google. The operator of the website is responsible for the legal basis of these transfers, for obtaining consent and for informing website visitors in accordance with data protection law. Anyone who wants to ensure that no connection to Google whatsoever is established before consent must have the script blocked by their consent solution instead of embedding it via this module.
  • Website diagnostics:transmits technical configuration data of the website to the platform: WordPress, PHP and database version, active theme, the number of active plugins and their classification into categories (caching, consent management, SEO, tracking, and plugins that block write access), as well as the tracking IDs found in the source code of the homepage. A complete list of the installed plugins is not transmitted. This information serves troubleshooting and the assessment of the website; no personal data of website visitors is collected in the process.

The connection is HMAC-signed with a secret key; the key itself is no longer transmitted after setup. The modules can be switched off individually at any time. After the tracking module has been switched off, the codes are no longer output; pages that have already been cached may still contain them until the website’s page cache has been refreshed. The stored IDs remain saved so that the module can be reactivated without having to enter them again.

11. Customer account: product updates (Brevo) and customer care (HubSpot)

When you register in the portal of our marketing platform, we also process your account data to look after your account and (only with your consent) to send product updates by email. In addition to your contact details, we transfer the following information on your usage: registration date, whether your email address is confirmed, whether a data source is connected, date of the first tool call and number of tool calls in the last 30 days, number of workspaces, plan, end of the trial, subscription status, language and your consent to product updates. The content of your requests and data from connected accounts (e.g. Google Ads, Analytics) are not transferred. We transfer the owners of a customer account, not invited team members.

Brevo (email delivery): For product updates, tips and notes on setting up your account (onboarding) we use Brevo (Sendinblue SAS, Paris, France; data processing in the EU). Only accounts with a confirmed email address are stored there: email address, name of the agency or company and the usage information listed above. You only receive product updates and tips if you consented during registration or in the portal settings and confirmed your email address (double opt-in); the legal basis is Art. 6(1)(a) GDPR in conjunction with Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021). We send notes on setting up and using your account on the basis of Art. 6(1)(b) GDPR (performance of a contract). You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every email, in the portal settings under “Profile” or by email to hello@honeyfield.at. We store an unsubscription so that it is respected permanently. More information: Brevo Privacy Policy

HubSpot (customer care and sales): We also keep portal registrations in our CRM system HubSpot (provider details in section 4): name, email address, company, the internal ID of your portal account and the usage information listed above. The purpose is to look after existing customers, for example helping with the setup or pointing out a suitable plan. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in caring for our customers and developing the business relationship. You can object to this processing at any time by email to hello@honeyfield.at.

The information is updated daily. After your customer account has been deleted, we also delete the data at Brevo and HubSpot unless statutory retention obligations apply.

12. Your rights

You have the following rights vis-à-vis us with regard to your personal data:

  • Right of access (Art. 15 GDPR): you can request access to your personal data processed by us.
  • Right to rectification (Art. 16 GDPR): you can request the rectification of inaccurate personal data or the completion of your personal data.
  • Right to erasure (Art. 17 GDPR): you can request the erasure of your personal data, provided that no statutory retention obligations prevent this.
  • Right to restriction (Art. 18 GDPR): you can request the restriction of processing of your personal data.
  • Right to data portability (Art. 20 GDPR): you can request that we transmit your data to you in a structured, commonly used and machine-readable format.
  • Right to object (Art. 21 GDPR): you can object to the processing of your personal data at any time, provided that the processing is based on Art. 6(1)(f) GDPR.
  • Right to withdraw consent (Art. 7(3) GDPR): you can withdraw your consent at any time once given. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

To exercise your rights, please contact: hello@honeyfield.at

13. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR, Section 24 DSG). In Austria, this is:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42
1030 Wien
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

14. Data security

We use technical and organizational security measures to protect your data against manipulation, loss, destruction or access by unauthorized persons. In particular, data transmission on our website is encrypted via TLS/SSL (recognizable by the lock symbol in your browser’s address bar).

15. Validity and amendment of this privacy policy

This privacy policy is currently valid (as of: October 2026). Due to the further development of our website and offerings or due to changes in statutory requirements, it may become necessary to amend this privacy policy. You will always find the current version on this page.

Contact for data protection inquiries:

Honeyfield GmbH
Strubergasse 26, 5020 Salzburg
Email: hello@honeyfield.at