Privacy policy
Last updated: 2026-07-27
1. Data controller
The controller for the data collected through this site is Honing.
For any question about your personal data: contact-honing@luxuryoperations.org.
2. Data collected and purposes
The personal data collected depends on the features you use. The exhaustive list appears in the Subprocessors section below, where each recipient states precisely which data it processes and for what purpose.
2 bis. Improving the tool
On every analysis we record a numeric fingerprint of your model (number of tables, columns, measures, relationships…) along with the identifiers of our own rules that fired. No table, column or measure name, and none of the data in your tables, appears in it. We also record the names of the Power Query functions our tool cannot handle yet, and only where those functions are published by Microsoft: a function you defined yourself is counted without its name being kept. Legal basis: legitimate interest in fixing and improving the service.
With your explicit agreement only (the “Help improve the tool” setting in your account, off by default), we additionally keep the skeleton of the query concerned: its structure, with every name and every piece of text replaced by anonymous labels and the comments removed. This lets us reproduce the case and fix it. Legal basis: consent, revocable at any time from your account, with immediate effect.
That same consent allows us to write to you when an improvement goes live following a finding that came out of one of your reports: a thank-you message, with a link to what changed. No other message is sent on this basis, and withdrawing consent stops them immediately.
These items are kept for as long as your account exists, and are erased along with it.
3. Legal basis for processing
The processing of your data rests on one of the legal bases set out in Article 6 of the GDPR, depending on the context: performance of a contract, legitimate interest, consent, or legal obligation.
4. Subprocessors and recipients
To provide this service we call on third-party subprocessors. Each subprocessor processes only the data strictly necessary for its task, under a contract compliant with Article 28 of the GDPR.
Vercel Inc.
440 N Barranca Ave #4133, Covina, CA 91723, USA
- Purpose
- Hosting and serverless function execution (Frankfurt region - fra1)
- Data processed
- IP addresses
- Server logs
- Session cookies
- Retention
- 30 days for logs
- Legal basis
- Legitimate interest (Art. 6.1.f GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Functions run in the EU (Frankfurt) but legal entity is US-based
- Learn more
- Privacy policyData processing agreement (DPA)
Databricks, Inc. (Neon)
160 Spear Street, 13th Floor, San Francisco, CA 94105, USA
- Purpose
- PostgreSQL database hosting
- Data processed
- All application data stored in the database
- Retention
- Account lifetime (deletion on request)
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Database region configurable (eu-central-1 available)
- Learn more
- Privacy policyData processing agreement (DPA)
Resend Inc.
2261 Market Street #4667, San Francisco, CA 94114, USA
- Purpose
- Transactional email delivery
- Data processed
- Recipient email
- Content of sent emails
- Retention
- 30 days for delivery logs
- Legal basis
- Contract performance / legitimate interest
- Transfer / details
- Standard Contractual Clauses (SCC)
- Learn more
- Privacy policyData processing agreement (DPA)
Cloudflare, Inc.
101 Townsend Street, San Francisco, CA 94107, USA
- Purpose
- Temporary storage of the uploaded semantic model for analysis
- Data processed
- Power BI semantic model (.pbip): structure and formulas, without business data (the data cache is stripped in the browser before upload)
- Metadata (file name, size)
- Retention
- 7 days by default, adjustable per report up to a hard cap of 90 days from upload; daily automatic purge, or deletion on request
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). R2 "EU" jurisdiction: objects stored in the European Union
- Learn more
- Privacy policy
Anthropic PBC
548 Market Street #84749, San Francisco, CA 94104, USA
- Purpose
- AI-assisted rewriting and analysis of the model's DAX and Power Query (M) expressions
- Data processed
- DAX / Power Query (M) expressions of the model (structure and formulas) - never business data
- Retention
- 30 days on the Anthropic side (unless a zero-retention agreement applies)
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC)
- Learn more
- Privacy policyData processing agreement (DPA)
5. Retention period
The .pbip file you upload is kept for 7 days by default, then automatically deleted from our storage by a daily purge. You can adjust this duration report by report, within an absolute limit of 90 days from upload: that ceiling cannot be pushed back, including through successive extensions. You can also delete the file at any time, without waiting for the deadline.
The analysis results (findings, statuses, rewrites, and any volume figures you imported) contain none of the business data in your reports: they are kept for as long as you keep the report in your workspace, and deleted when you delete the report or your account.
Account data (email address, hashed password) is kept for the lifetime of the account and deleted when it is deleted, which you can trigger yourself from the “My account” page.
Every change of duration, every deletion and every automatic purge is written to a log viewable from the page of the report concerned, so that the actual application of this policy is verifiable rather than merely declared. If you asked for it, an alert warns you before a file is deleted.
6. Your rights
Under the GDPR, you have the following rights over your data:
- Right of access and rectification
- Right to erasure (right to be forgotten)
- Right to data portability
- Right to object and to restriction of processing
- Right to withdraw your consent at any time (where processing is based on consent)
- Right to lodge a complaint with the CNIL, the French data protection authority (cnil.fr)
To exercise your rights: contact-honing@luxuryoperations.org. We undertake to reply within one month at most.
7. Cookies
By default this site uses only the cookies strictly necessary for it to work (session, preferences). No advertising or profiling cookie is set without your explicit consent.
If an audience-measurement feature requiring consent is enabled (Google Analytics, for instance), a consent banner is shown before any non-essential cookie is set.
8. Changes
This policy may be updated to reflect changes in the services and subprocessors used. The date of the last update is shown at the top of this page. Substantial changes will be notified by email to holders of a user account.