Subprocessor List
Last updated: October 6, 2026.
Honeybee Logic Inc. may engage the service providers listed below to operate and support its Services, subject to the applicable agreements and privacy requirements. The providers used depend on the Services, features, and arrangements applicable to each customer; inclusion in this list does not mean that every provider processes every customer's information.
This list supplements our Privacy Policy and, where applicable, your service agreement and Data Privacy Agreement (DPA). Those documents govern the permitted uses of your information and our obligations to you.
Hosting, communications, and payments
| Provider | Service and information involved | Service locations |
|---|---|---|
| Amazon Web Services (AWS), including Amazon Cognito | Application hosting, databases, file storage, backups, and account authentication | Canada for core organizational application storage |
| AWS — Simple Email Service (SES) | Account invitations, service notifications, and other application emails; recipient addresses and message content | Canada |
| Stripe | Payments, billing, and invoicing for individual subscriptions; necessary contact, payment, and transaction information | United States and international infrastructure |
| Google Workspace | Business email and support correspondence, including necessary adult contact and support information | United States and international infrastructure |
Our core organizational application storage remains in Canada as required by the applicable DPA. Overseas payment or communications processing is subject to the applicable disclosures and authorizations; it is not authorized by the AI-processing exception alone. We do not store full payment-card numbers.
AI and media services
| Provider | Service | Service locations |
|---|---|---|
| AWS — Amazon Bedrock | AI model inference through a cloud platform | Canada; international processing may apply to selected models and routes |
| OpenAI — paid commercial APIs | AI generation and related features | International infrastructure, including the United States |
| Anthropic — paid commercial APIs | AI generation and related features | International infrastructure, including the United States |
| Google — paid direct AI APIs | AI generation and related features, separately from Google Cloud | International infrastructure |
| ElevenLabs | Speech and audio generation | United States and international infrastructure |
| fal.ai | Image and media generation | United States and international infrastructure |
Information involved. Requested AI and media features use the content submitted for that feature and necessary request metadata. Product inputs are intended for non-personal, non-confidential content. Student-identifying information, private records, credentials, sensitive personal information, and confidential third-party material must not be submitted. Adult account, billing, and support records are not intended AI inputs.
Training and safety. We do not authorize the use of Customer Data to train or fine-tune general-purpose generative AI models. Providers may process requests to operate and secure their services, monitor abuse, and enforce their policies, including limited human review and models used solely for safety or policy enforcement, as permitted by the applicable agreement.
Retention and locations. Processing locations and retention vary by service, model, feature, and applicable commercial terms. Providers may retain request and response data for service operation or abuse monitoring, with longer retention for safety incidents or legal requirements. Stored files, conversations, caches, and generated media may have separate lifetimes and deletion controls. Paid API access does not itself mean zero retention, a single retention period, or Canadian-only processing. These provider practices do not override a stricter commitment in your accepted agreement.
Further information about the direct API providers' published practices is available from OpenAI, Anthropic, and Google. Different services from the same provider may have different terms and data-handling practices.
Optional usage analytics
| Provider | Purpose and information involved | Service locations |
|---|---|---|
| Google Analytics 4 | Measure visits and approved adult feature use through limited browser/device information, pseudonymous identifiers, and usage events | United States and international infrastructure |
Analytics does not receive submitted or generated content, student information, names, email addresses, account/user IDs, school/customer identifiers, or identifying URLs. We do not link activity to named accounts or use it for advertising or individual teacher evaluation.
Where we enable Google Analytics, our use excludes Google Signals, advertising personalization, remarketing, advertising-account links, and optional sharing for unrelated Google products and services. GA4 uses IP addresses to derive approximate location but does not log or store individual IP addresses. User/event retention is limited to 14 months, without resetting on new activity; browser cookies normally last up to two years, subject to browser limits and renewal. Non-identifying aggregate reports may remain longer.
Analytics remains subject to the Privacy Policy's separate choices and retention limits and, for organizational use, the DPA's authorization requirements. You may decline or withdraw analytics without losing access to the Services. Analytics availability depends on the Service and applicable permissions.
Cloud and model-routing services
| Provider | Service |
|---|---|
| Google Cloud, potentially including Vertex AI | Cloud-hosted AI services and/or application infrastructure, while maintaining the applicable Canadian core-storage and other contractual safeguards |
| OpenRouter | AI model routing restricted to no-training, zero-data-retention endpoints, without plugins or tools on Customer Data routes |
| Moonshot AI Kimi models — through Amazon Bedrock only | Cloud-hosted AI inference; the direct Moonshot API is excluded from Customer Data processing |
These services may be used for the purposes described above, subject to the data-handling limits and safeguards in the applicable agreements. Google's direct AI APIs, Workspace, Analytics, and Cloud are distinct services with their own terms and processing practices.
Changes to this list
We may add, replace, or change providers within the purposes and safeguards of the applicable agreements, without changing those agreements merely to update a provider name or compatible service configuration.
Inclusion in this list does not replace any notice, objection, or consent requirements that apply when we engage a provider for your Services.
For organizational customers, we give at least 30 days' written notice before adding or replacing a provider that touches Personal Information, with the objection and resolution rights in DPA §6.3. Where an urgent replacement is necessary to protect security or availability, that section permits prompt notice afterward with the same objection rights. Material changes to privacy practices remain subject to the Privacy Policy's notice and consent requirements.
A list update does not amend an accepted agreement, reduce its protections, authorize a new processing purpose, or override an analytics refusal. Changes outside the accepted scope require the applicable amendment or consent. We retain dated prior versions of this list.
For questions about our providers or their handling of your information, contact privacy@honeybeelogic.com.