Skip to content

Legal

Privacy policy

How Owlie collects, uses, discloses, and safeguards personal data.

Last updated: September 21, 2026

This Privacy Policy describes how Owlie, LLC (“Owlie,” “Company,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal data in connection with our websites and identity and access management software-as-a-service offerings (the “Services”). This Policy is intended to comply with applicable privacy laws, including:

  • GDPR and UK GDPR
  • Swiss DPA
  • CCPA/CPRA
  • Other U.S. state privacy laws

This Privacy Policy works together with the Master Subscription Agreement (Terms of Service), Data Processing Addendum (“DPA”), Acceptable Use Policy, and Security Addendum.

1. Scope and Roles

This Privacy Policy applies to:

  • Visitors to our websites (“Website Users”)
  • Users who access the Services (“End Users”)
  • Representatives of customers, vendors, or partners (“Business Contacts”)

Owlie acts in different roles depending on the context:

Owlie as Processor (Service Provider)

We process Customer Content (identity data, access data, logs, directory sync data) strictly on behalf of customers and according to the Agreement and DPA.

Owlie as Controller

We process data as a controller for our own business operations, such as:

  • Account administration
  • Billing and subscription management
  • Security and platform monitoring
  • Website analytics
  • Marketing communications

2. Information We Collect

2.1 Information Provided Directly

We may collect personal data that you or our customers provide, including:

  • Contact details (name, email, phone, job role, company)
  • Account registration information
  • Authentication and login elements (usernames, keys, MFA factors, never plaintext passwords)
  • Configuration, policy, and workflow settings within the Services
  • Communications with support or customer success teams

2.2 Information Collected Automatically

When you access our websites or Services, we may automatically collect:

  • IP addresses and geolocation approximations
  • Device identifiers, browser type, operating system
  • Access logs and authentication events
  • API usage and performance telemetry
  • System activity metadata

2.3 Customer Content

Customers may submit, synchronize, generate, or authorize Owlie to process:

  • Employee, contractor, administrator, and service-account identity data
  • Roles, groups, permissions, accounts, entitlements, and access relationships
  • Human resources, directory, application, and connector data
  • Access requests, reviews, approvals, policies, provisioning actions, and audit records
  • Assistant conversations, prompts, instructions, tool inputs and results, generated outputs, saved workspace artifacts, audio submitted for transcription, transcripts, and product-feedback or diagnostic context
  • Messages and interaction metadata from customer-enabled integrations, including Slack

Owlie processes Customer Content only to provide, secure, support, and maintain the Services in accordance with the Agreement and DPA.

When you use voice input, Owlie sends your recorded audio to the selected transcription provider. Owlie does not persist raw audio in its application storage, and its current transcription providers do not retain the audio after processing. The returned transcript is placed in the composer for you to review and submit. Submitted transcript text may become part of the saved conversation. Retention and deletion of this information are governed by the standard data-retention provisions in Owlie’s Data Processing Addendum (DPA), including any applicable provider-retention arrangements and subsequent updates.

Authorized Owlie staff can retrieve saved assistant conversations and generate on-demand exports when necessary for support, security, troubleshooting, or another purpose permitted by the DPA. The assistant may also submit product-improvement requests containing a description, limited diagnostic context, and account or conversation references. These records must not include secrets, raw transcripts, or unnecessary Customer Content and are subject to the DPA’s applicable retention and deletion provisions. This does not authorize unrestricted staff access or model training.

2.4 Cookies and Tracking Technologies

We may use:

  • Essential operational cookies
  • Analytics tools (e.g., pseudonymized usage metrics)
  • Error monitoring and performance telemetry

We do not use tracking for cross-site advertising.

3. How We Use Personal Data

We use data for the following purposes:

Service Delivery

  • Authentication and access control
  • Provisioning, deprovisioning, and identity lifecycle management
  • Generating security logs and audit trails

Security & Fraud Prevention

  • Detecting unauthorized access
  • Monitoring system performance and anomalies
  • Protecting against phishing, credential abuse, and fraud

Service Improvement

  • Telemetry to optimize platform stability
  • To provide customer support and technical assistance
  • To improve and develop the Services using permitted telemetry and feedback; Customer Content remains subject to the DPA and is not used for unrelated purposes
  • Enhancing product features and user experience
  • Providing AI-assisted search, explanations, workflow preparation, recommendations, authorized actions, and transcription. AI outputs may be inaccurate and require appropriate review. Owlie does not use Customer Content to train general-purpose AI models for Owlie or third-party providers.

Administrative Purposes

  • Contract and billing management
  • Customer communications
  • Compliance and legal obligations

Owlie does not sell personal data and does not use Customer Content for targeted advertising.

Where applicable, Owlie processes personal data under the following legal bases:

  • Performance of a contract
  • Legitimate interests (security, fraud prevention, service improvement)
  • Compliance with legal obligations
  • Consent for optional marketing or analytics tools

5. Data Sharing and Disclosure

We may share data with:

Service Providers & Subprocessors

Cloud hosting, monitoring, analytics, messaging, support, and identity infrastructure providers. All subprocessors are bound by contractual confidentiality and data protection obligations. We use service providers and subprocessors for application infrastructure, managed databases, security, observability, billing, support, and AI inference. Depending on enabled features, these providers may process Customer Content, assistant prompts and outputs, account information, logs, telemetry, or billing information. Owlie’s current Subprocessor List identifies the providers that process Personal Data on Owlie’s behalf.

Affiliates

Where necessary for operations or support.

Legal Requirements

Courts, regulators, or government authorities when required.

Business Transactions

In connection with mergers, acquisitions, or restructuring events with appropriate safeguards.

All service providers are bound by contractual obligations to protect personal data and use it only for authorized purposes.

We do not sell or share personal data for behavioral advertising.

Customer-Directed Integrations

Customers may connect Owlie to third-party applications and data sources. When a Customer directs Owlie to exchange data with such a provider, that provider’s handling of the data is governed by the Customer’s agreement and privacy terms with that provider.

6. Data Security

We implement appropriate technical and organizational measures designed to protect personal data, including:

  • Encryption in transit and at rest
  • Role-based access controls and MFA enforcement
  • Segregated environments
  • Vulnerability management and penetration testing
  • Logging and monitoring of privileged access

Details are provided in the Security Addendum.

7. Data Retention

We retain controller data for as long as reasonably necessary for the purposes described in this Policy, including account administration, security, legal compliance, and dispute resolution.

Account closure immediately soft-deletes the tenant and halts tenant functionality, including scheduled and automated work. Closure starts a thirty (30)-day period during which Customer Content remains in the operational database. There is no customer self-service export path after closure; an authorized customer representative may contact legal@owlie.com during that period for manual, secure data return. On day thirty-one (31), Owlie permanently deletes the tenant and associated Customer Content from the operational database, subject to completion of a timely return request and legally required retention. Other active storage and subprocessors remain subject to the DPA’s deletion requirements. Where an agreement ends without account closure, the return and deletion process in the Agreement and DPA applies.

Backup copies may remain until removed through the applicable backup retention cycle and remain protected and isolated from ordinary use. Before restored data becomes available to users or ordinary processing, Owlie checks separate deletion receipts and removes listed tenants and their associated data. Database deletion does not mean every backup or external copy has already been erased.

Owlie retains a limited deletion receipt outside the operational database, containing the tenant identifier, the identity of the person who requested or performed deletion, relevant timestamps, and minimum necessary deletion metadata. Receipts evidence deletion and prevent restoration of deleted tenants. They are access-restricted and retained only as necessary for these purposes, including while relevant backups remain restorable, or as required by law. Receipt information identifying a person remains subject to applicable privacy requirements. Separate controller records, such as billing and legally required business records, follow the controller retention criteria above; this does not authorize retention of the deleted tenant’s operational dataset.

8. International Data Transfers

Personal data may be transferred to and processed in countries other than your country of residence. Where data is transferred internationally, we use:

  • Standard Contractual Clauses
  • UK Addendum or IDTA
  • Other approved transfer mechanisms

We implement supplementary safeguards where required.

9. Your Privacy Rights

Depending on jurisdiction, you may have rights to:

  • Access your data
  • Correct inaccurate data
  • Delete data
  • Restrict or object to processing
  • Port your data
  • Opt out of “sharing” or targeted advertising
  • Appeal decisions in certain cases

Requests may require identity verification and customer authorization.

10. Children’s Privacy

The Services are not directed to children under 13 (or other age as required by law), and we do not knowingly collect personal data from children. Use by minors is prohibited.

11. Changes to This Privacy Policy

We may update this Policy from time to time.

Material changes will be communicated through the Services or via other appropriate means.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact:

Owlie, LLC
Attn: Privacy Officer
Email: legal@owlie.com