Privacy Policy

1. About This Policy

HonkIO (“we”, “our”, “us”) is committed to protecting the privacy of our customers and end-users in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (Law 25), and other applicable provincial privacy laws. This policy explains how we collect, use, and protect personal information.

2. Information We Collect

Account information: Name, email address, billing information, and API credentials when you create an account.

Message data: Phone numbers (sender and recipient), message content, delivery timestamps, and status information when you send SMS messages through our API.

Consent records: CASL consent records you submit, including phone numbers or email addresses, consent type, timestamp, IP address, and consent description.

Email data: If you use the email API: the recipient addresses, content and attachments of the emails you send, delivery events reported by the receiving mail servers (delivered, bounced, complained, delayed), and, only where you turn on open or click tracking, when a recipient opened an email or followed a link, the mail client they used, and, for a click, the link they followed. If you turn on receiving, or send to your account’s test inbound address: the sender and recipient addresses, headers, content and attachments of the emails you receive, and the provider’s spam and virus verdicts. Received email content is purged 90 days after receipt; its attachments and the raw message are kept 40 days. All of this is stored in ca-central-1 (Montréal).

Usage data: API call logs, rate limit events, and billing ledger entries for operational and compliance purposes.

3. Data Residency & Cross-Border Transfers

What stays in Canada: All personal information is stored in Canada. Our database (Supabase PostgreSQL) and in-memory cache (Upstash Redis) are hosted in the ca-central-1 region (Montréal, Québec). No personal information is written to disk outside Canadian jurisdiction.

Cross-border processing: HonkIO’s API application layer is currently hosted on infrastructure that may be located outside Canada (United States). Personal information (including phone numbers, message content, and consent data) may be transmitted to and processed by such infrastructure on each API request before being written to Canadian-hosted storage. HonkIO intends to migrate the API layer to Canadian-hosted infrastructure; until that migration is complete, this cross-border processing may occur.

Email: Emails are sent through Amazon Simple Email Service (SES) in the ca-central-1 (Montréal) region. Attachments are held in Amazon S3 in the same region and deleted once the email is sent, rejected, failed or cancelled; a storage lifecycle rule backstops that and removes any attachment within 40 days regardless. Once an email leaves SES it travels to the recipient’s own mail server, wherever that server is located, as every email does.

Quebec Law 25 disclosure: Prior to implementing this architecture, HonkIO conducted a Privacy Impact Assessment (PIA) as required by Quebec Law 25 (Loi 25) s. 17. The PIA concluded that adequate contractual and technical safeguards are in place, including: the API host’s data processing terms, which restrict use of personal information to service delivery; TLS 1.3 encryption in transit; no host-side data persistence; and access limited to application execution.

We will notify affected customers before any material change to this cross-border transfer arrangement.

4. How We Use Personal Information

• Providing and operating the SMS gateway service
• Processing billing and managing account credits
• Enforcing CASL consent rules on your behalf (CRTC DNCL enforcement coming soon)
• Generating compliance audit logs as required by CASL
• Communicating service updates, security notices, and billing alerts
• Detecting and preventing fraud and abuse
• Honouring unsubscribe requests for commercial email, and suppressing all email to addresses that bounce or complain, for every email an account sends

We do not sell personal information. We do not use message content for advertising or model training.

5. Data Retention

Message content is retained for 90 days by default. Customers may configure shorter retention periods via API. Message metadata (sender, recipient, timestamps, status) is retained for 3 years for billing and compliance purposes.

CASL consent audit records are retained for a minimum of 3 years from the date of last consent or opt-out, as recommended by the CRTC.

Email content and delivery events are retained on the same schedule as message content and metadata above. When an email's content is purged, its subject is purged with the body. Tags are kept as metadata for filtering for as long as the email record exists, so developers should not put personal information in tags. Attachment files are deleted from storage once the email is sent, rejected, failed or cancelled, backstopped by an automatic expiry; only their names and sizes are kept with the email record.

Account data is retained for the life of the account plus 12 months after account closure.

6. Your Rights (PIPEDA & Law 25)

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Withdraw consent to processing (subject to legal and contractual restrictions)
• Erasure (right to be forgotten): Request deletion of personal information via DELETE /v1/compliance/erasure API endpoint or by emailing privacy@honkio.ca
• Data portability: Receive a copy of your data in machine-readable format
• Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca

Quebec residents also have rights under Law 25 including the right to be informed of automated decision-making affecting you.

7. Third-Party Service Providers

We share limited data with the following Canadian-compliant processors:

• Telnyx LLC (United States): telecom carrier aggregator. Phone numbers and message content are transmitted to Telnyx for delivery. Telnyx’s Data Processing Addendum, incorporated in its terms of service, governs its handling of this data.
• Railway Corp. (United States): API application hosting (US East region). Personal information is processed in memory on each request; no personal data is persisted by the host. See §10 for the safeguards assessed in our PIA.
• Supabase Inc.: database hosting, restricted to ca-central-1 (Montréal). All persistent personal data is stored here.
• Upstash Inc.: Redis cache hosting, restricted to ca-central-1 (Montréal). Used for rate limiting and session state.
• Stripe Inc. (United States): payment processing. Billing information is handled directly by Stripe. For a card you save for auto top-up, HonkIO keeps the card brand, last four digits and expiry date, Stripe’s identifiers for you as a customer and for the saved card, and the authorization you gave. HonkIO never holds the full card number.
• Amazon Web Services, Inc. (Amazon SES and Amazon S3, ca-central-1, Montréal): sends the emails you send through the email API, and receives email sent to an address you have set up for receiving. Also sends the platform’s own transactional email (account verification, password reset, billing and service notices) and our replies from the contact inbox, and receives the mail sent to @honkio.ca addresses (the contact inbox), with its attachments. Holds attachments from sent email in S3 until the email is sent, rejected, failed or cancelled, and the attachments and raw message of received email in S3 for 40 days, each backstopped by an automatic expiry; after that, only the filename and size are kept. Receives sender and recipient addresses, email content and attachments, for email you send and email you receive. AWS’s standard data processing terms apply.

Each processor’s data processing terms, incorporated in its standard terms of service, govern its handling of personal information on our behalf. Processors whose infrastructure is located outside Canada are assessed in our Privacy Impact Assessment (§10).

8. Security

We implement industry-standard security measures including TLS 1.3 in transit, AES-256 at rest, API key hashing (bcrypt), HMAC webhook signatures, and network-level access controls. API keys are hashed before storage, so we cannot recover your key if it is lost. We review our security controls at least annually and log privileged access.

9. Cookies and Tracking

Our website uses only the first-party cookies required for session management. We do not use analytics or advertising cookies and we do not load third-party tracking scripts. The API itself does not use cookies. Authentication is via API keys in request headers.

Email open tracking (a 1×1 image) and click tracking (links routed through HonkIO) are off by default. A sender can turn them on for an email or for a sending domain. The time a recipient opened an email or followed a link, and which link they followed, are personal information under PIPEDA and Quebec Law 25; a sender who turns tracking on is responsible for informing its recipients.

10. Privacy Impact Assessments

Pursuant to Quebec Law 25 s. 17, HonkIO conducts Privacy Impact Assessments (PIAs) before implementing new data flows involving personal information outside Quebec.

A PIA was completed on April 3, 2026, and revised on September 2, 2026, covering the cross-border transfer of personal information through HonkIO’s Railway-hosted API (see §3 above). The assessment reviewed the sensitivity of data in transit, the legal framework of the receiving jurisdiction (United States), contractual protections in place, technical controls, and residual risks. The PIA concluded that adequate protection exists and the transfer may proceed.

11. Contact Our Privacy Officer

Our designated Privacy Officer can be reached at:

12. Changes to This Policy

We will notify you of material changes to this Privacy Policy by email at least 14 days before they take effect. The “last updated” date at the top of this page will always reflect the current version.