HONCHO — PRIVACY POLICY

This Privacy Policy explains how Plastic Labs, Inc. ("Plastic Labs," "we," "us," "our") collects, uses, discloses, and protects personal data when you or your end-users interact with Honcho—the cloud API, dashboard, and related services we operate (together, the "Services").

It is part of, and governed by, the Honcho Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

1. Information We Collect

We do not knowingly collect data about children under 13. You must not allow children under 13 to use the Services.

2. How We Use Information

We never train public large-language models on Customer Content without your explicit opt-in.

3. Sharing & Sub-Processors

We use a small number of trusted vendors ("sub-processors") solely to operate the Services:

* "Primary Region" shows where each vendor initially stores or processes data. Some vendors operate globally-redundant systems; contact privacy@honcho.dev if you need region-specific guarantees.

Changes to sub-processors. We may add or replace a sub-processor. If the change materially affects how we handle personal data, we will notify account owners (e-mail or in-dashboard) before the new vendor goes live.

4. International Transfers

Our primary infrastructure is in the United States, so your information will be processed there regardless of your location. By using the Services, you acknowledge and consent to the transfer of your personal data to the United States and any other country where we or our sub-processors operate, as detailed in Section 7.5 of our Terms of Service.

If specific legal mechanisms are required for cross-border data transfers (such as the EU's Standard Contractual Clauses or the U.K.'s International Data Transfer Addendum), we will implement appropriate safeguards before accepting such data.

Plastic Labs has not yet self-certified to the EU-U.S. Data Privacy Framework. We will update this Policy if that changes.

5. Security

• TLS 1.2+ encryption in transit; AES-256 encryption at rest
• Least-privilege IAM with MFA; all production access logged
• Continuous vulnerability scanning and 24 × 7 infrastructure monitoring
• Third-party penetration test performed at least once per calendar year
• Incident-response target: initial assessment within 24 hours of detection

(Honcho is not yet SOC 2 or ISO 27001 certified; those audits are on our 2025 roadmap.)

6. Data Retention

You may request shorter retention via the dashboard or API where supported.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

We will not discriminate against you for exercising your rights.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information:

• Right to Know: You can request information about the categories of personal information we collect, the purposes for which we use it, the categories of sources from which we collect it, and the categories of third parties with whom we share it.
• Right to Delete: You can request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: You can opt out of the "sale" or "sharing" of your personal information, as defined under California law. We do not sell your personal information for monetary consideration, but some data sharing may constitute a "sale" or "sharing" under the broad definitions in California law.
• Shine the Light: California residents may request information about how we share certain categories of personal information with third parties for their direct marketing purposes.

To exercise these rights, please contact us at privacy@honcho.dev. We will verify your identity before responding to your request.

9. Cookies & Tracking

Our website and dashboard use the following cookies:

• Essential cookies: Session management, security, and fraud prevention (cannot be disabled). These cookies typically persist for the duration of your session or up to 30 days for persistent authentication.
• Analytics cookies: We use PostHog to understand product usage and improve our services. These cookies collect information about how you interact with our website, including pages visited and features used.

Visitors in the EU/UK will see a consent banner and can refuse non-essential cookies. We respect Global Privacy Control (GPC) signals from your browser.

We do not serve third-party behavioral advertisements or sell your data to advertising networks.

10. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect their data. If we discover that we have inadvertently received such data, we will delete it.

11. Changes to This Policy

We post any changes here and, for material changes, notify account owners at least 30 days in advance. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.

12. Contact Us

Plastic Labs, Inc.
169 Madison Avenue, STE 2703
New York, NY 10016 USA
privacy@honcho.dev | +1 (917) 773-8115

For European users: While we do not specifically target EU users, we welcome them to use our Services. Although we have not appointed a formal EU representative under GDPR Article 27, we remain committed to respecting EU privacy rights. Please contact us directly at privacy@honcho.dev with any EU-specific privacy inquiries.