Privacy policy
Last updated 20 October 2026. This policy covers three groups of people: account holders and subscribers, visitors to honeylabs.net, and the parties whose traffic reaches our sensors. Questions go to info@honeylabs.net, and we reply in English or Dutch.
Summary
If you sign in, we hold your email address, your keys, your plan and a record of what you looked up and called, so we can run your account, count your quota and stop abuse. Stripe handles payment and we never see your card. We record page views on honeylabs.net ourselves, without third-party analytics or advertising, and we do not sell personal data.
If your address sent unsolicited traffic to one of our sensors, we record and publish what it sent, because that helps network defenders. Section 4 explains the basis for that and how to object. You can export or delete your account from the dashboard, and you can complain to the Dutch data protection authority.
1. Controller and contact
The controller is HoneyLabs (Honeylabs.net), registered with the Netherlands Chamber of Commerce (KVK) under number 42146845. Privacy requests and questions go to info@honeylabs.net. Account and billing support is at support@honeylabs.net. We have not appointed a data protection officer, because the GDPR does not require one for this processing (article 37).
2. Account holders and subscribers
Your account
We hold the email address you sign in with, your plan, your API keys (hashed, so we cannot recover one for you), browser sessions and sign-in links (both hashed), the MCP clients you have connected, and the settings you choose: saved queries, watchlists, alert subscriptions, feed tokens and a Slack webhook if you add one. We need these to provide the service you signed up for, which is the legal basis (article 6(1)(b) GDPR). An email address is required to have an account; without one we cannot send a sign-in link.
What you look up and call
For each API, MCP or feed call we record the tool or endpoint, its arguments (such as the address, network, CVE or query you asked about), the address the call came from, the time, how many rows it read, how long it took and its status. For signed-in web lookups we record what you searched and when. For each API key we keep the addresses it was used from, and for each saved-query feed the address and user agent of recent fetches. A bulk enrichment is recorded as a count and a one-way hash of the submitted list, not the list itself.
We use these records to count your quota and credits (article 6(1)(b)), and to detect abuse, answer support questions and find what users look for and do not find (article 6(1)(f), our legitimate interest in keeping the service secure and useful). We do not store the results we returned to you.
Payment
Stripe processes your card, billing name and address, and VAT number. We store your Stripe customer and subscription ids, the plan and its status. The basis is the contract (article 6(1)(b)) and, for invoices, our legal duty to keep tax records (article 6(1)(c)).
We send sign-in links, the alerts you set up, and notices about your account and plan as part of the service (article 6(1)(b)). We may also send an account holder an occasional reminder about a feature they have not set up, or a single mail after a long time without use. Every such mail can be stopped by replying "stop" or with your mail client's unsubscribe button (article 6(1)(f), and article 11.7(3) of the Dutch Telecommunications Act). Blog posts are mailed only to addresses that confirmed the subscription by double opt-in, and every mail has an unsubscribe link (article 6(1)(a), consent, which you can withdraw at any time).
Research applications and correspondence
When you apply for the Research plan or email us, we keep what you send so we can answer it and, for an application, decide on it (article 6(1)(b) or 6(1)(f)).
3. Visitors to honeylabs.net
For every page view, signed in or not, we record the client address, the country Cloudflare derives from it, the user agent, the path and query string, the referring page, and whether the visitor was signed in. Sign-in tokens and other secrets are removed from the query string and the referrer before the record is stored. For a signed-in visitor the record also carries the pseudonymous account reference described in section 9. Blog post views are recorded the same way. We use these records to understand which pages are read and to detect scraping and abuse, which is our legitimate interest (article 6(1)(f)). We use no third-party analytics, advertising or tracking scripts.
Cloudflare serves the site and therefore processes the address and request details of every visit on our behalf.
4. Parties whose traffic reaches our sensors
Our sensors are machines on the public internet that offer no service to anyone, so every connection to them is unsolicited. For each connection we record the source address, its network and country, the time, the ports, what the client sent (requests, payloads, the usernames and passwords it tried, the commands it ran) and the files it fetched or uploaded. We did not collect this data from the people concerned (article 14 GDPR), and an address may belong to a person, for example a home connection or an infected device.
We publish these observations on honeylabs.net, through the API and the MCP server, and in the TAXII and MISP feeds, so that network operators and security teams can detect and block attacks on their own networks. We may also report an address, with the evidence, to the abuse contact registered for its network, and we check files against VirusTotal. The legal basis is our legitimate interest and that of the defenders who use the data in the security of networks and information (article 6(1)(f) and recital 49 GDPR). In weighing that interest we take into account that the traffic was sent unasked to a machine that serves nobody, and that we publish what was observed without claiming who sent it.
Informing every party individually is impossible, because we know only an address, so this section is the information article 14(5)(b) requires. Retention is in section 7.
If you believe an address of yours is listed, you can object to the processing on grounds relating to your situation (article 21 GDPR) by emailing info@honeylabs.net with the address and your reasons. We answer within one month. If we accept the objection, the address is removed from every public page, feed and API response. We may keep the underlying record only where we have compelling legitimate grounds, such as an ongoing attack from that address, and we tell you if that is the case. You also have the rights in section 8 for this data.
5. Recipients
We share personal data only with these parties, and only for the purposes above:
- Stripe, for payments, invoices and the billing portal;
- Cloudflare, for serving the site and routing mail sent to our addresses;
- Resend, for sending email;
- hosting providers in the EU, for our servers and backups;
- VirusTotal, which receives file hashes and malware samples fetched from attacker addresses, never account data;
- the abuse contact of a network, for reports about traffic from that network (section 4);
- everyone who reads the public pages and feeds, for the sensor observations in section 4;
- authorities, where the law obliges us to provide data.
Vulnerability data from the US National Vulnerability Database and CISA comes to us as public data. We send them nothing about you.
6. Where the data is kept and transfers outside the EU
Our servers and backups are in the EU. Stripe, Cloudflare and Resend are based in, or may transfer data to, the United States. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it (article 45 GDPR), and otherwise on the European Commission's standard contractual clauses (article 46(2)(c) GDPR). Email us for a copy of the safeguards that apply. The sensor observations in section 4 are published openly and can be read from anywhere.
7. Retention
| Data | Kept for |
|---|---|
| Account, Stripe ids, saved queries, watchlists, alert subscriptions, feed tokens, connected MCP clients, research applications | While the account exists |
| API keys (stored hashed) and the addresses each key was used from | While the account exists |
| Browser sessions | 30 days, deleted one day after they expire |
| Sign-in link records | Valid for 15 minutes, deleted 7 days after use or expiry |
| Usage records for API, MCP and feed calls | 90 days |
| Web lookups made while signed in | 180 days |
| Fetches of a saved-query feed (address and user agent of the fetcher) | 7 days, except the latest 50 fetches of each feed |
| Page views on honeylabs.net | 400 days |
| Blog post views | 180 days |
| Blog subscription | Until you unsubscribe |
| Email you send us | As long as the request and any follow-up need |
| Invoices and payment records | 7 years, as Dutch tax law requires (article 52 Algemene wet inzake rijksbelastingen) |
| Record that an account was deleted (a one-way hash of the email address and the date) | Kept, so we can show that the request was carried out |
| Backups of the databases above | 35 days (account database) and 45 days (event database) |
| Raw observations of traffic that reached our sensors | 400 days |
| Records derived from those observations: an address linked to a client fingerprint, to malware it served, or to an attempt to exploit a published vulnerability | No fixed limit today, while they serve as evidence of who probed and exploited what, and when. An upheld objection takes the address out of every public page, feed and API answer (section 4) |
When you delete your account, a paid subscription is cancelled with Stripe and the account is deleted at once, together with its keys, sessions, settings, web lookups and research applications. Usage records expire on their 90-day schedule. Invoices and payment records stay for the period tax law sets, and the deletion record stays. Page views that carry the pseudonymous account reference can no longer be linked to you once the account is gone, and expire after 400 days. Deleted data leaves the backups within 45 days.
8. Your rights
Under the GDPR you have the right to access your data (article 15), to correct it (article 16), to have it deleted (article 17), to restrict its processing (article 18), to receive it in a portable format (article 20), to object to processing based on our legitimate interest (article 21), and to withdraw consent at any time without affecting what happened before (article 7(3)).
The dashboard lets you download your account, keys, sessions, sign-in links and the last 90 days of usage as a JSON file, and delete the account yourself. For anything else, including your web lookups, saved queries and watchlists, email info@honeylabs.net. A request sent from the address on the account is enough to identify you. We answer within one month, which the law allows us to extend by two months for a complex request, and we tell you if we do (article 12(3)).
You may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live or work (article 77). We would like the chance to fix the problem first, but you do not need to contact us before you complain.
10. Security and breaches
Connections are encrypted, keys and session tokens are stored only as hashes, and access to production systems is limited to the people who run them. If a personal data breach occurs, we report it to the Autoriteit Persoonsgegevens within 72 hours where article 33 GDPR requires it, and we tell the people affected without undue delay when the breach is likely to put their rights at high risk (article 34).
11. Children, automated decisions and changes
The service is meant for security work and is not directed at children. We do not knowingly hold an account for anyone under 16, the age of consent for online services in the Netherlands (article 5 of the Dutch GDPR Implementation Act). We make no decisions about you by automated means that have legal or similarly significant effects (article 22). Quotas and rate limits are applied automatically and only limit how much you can query.
When this policy changes, the date at the top changes with it. We email account holders before a change that affects how we use their data takes effect. The terms of service cover the rest of our agreement with you.