SECURITY · GDPR
What Owlly does with your data, how it is protected, and where our reach ends.
Last updated: 9 October 2026
OCR (Google Document AI) runs in the EU region, enforced in configuration. Invoice content, meaning the supplier, line items, prices and NIP, also goes to AI models: Anthropic, and OpenAI when Anthropic is unavailable. Both process this data in the United States under Standard Contractual Clauses. The full list, with the status of each agreement, is in the sub-processor register.
Access is granted per page and per company. Every request runs within the company it acts for, and an automated check before each release verifies that reads of company data carry that filter.
Selected data is encrypted in the database with AES-256-GCM: your company’s bank account numbers and tax identifier (NIP), staff rates and salaries, contact details in the till’s guest register and on online orders, and KSeF and other integration tokens. The server disks and the rest of the database are not encrypted. The key does not live in the repository.
Traffic to Owlly, and between Owlly and its service providers, runs over TLS. A request sent over plain HTTP is redirected to HTTPS.
A dump of every database each night, compressed and encrypted with AES-256-GCM before it leaves the server, and pruned on a schedule. With no key configured the job refuses to write rather than writing plaintext.
The console the Owlly team uses to run the platform has two-factor authentication (TOTP) with recovery codes. Turning it on is voluntary. The restaurant app has no second factor.
A complete export of the account’s data in a machine-readable format, on request.
Identity and contact data are erased on request. Two limits we will not cross are described below, because the law does not permit it.
For staff records the restaurant is the controller, not Owlly. An erasure request from a waiter is handled by their employer: erasing those records on the employee’s request would destroy documentation the employer is legally required to keep.
Polish law requires invoices to be retained for 5 years and payroll documentation for 10 (up to 50 for staff first registered for social insurance before 2019 without ZUS OSW/RIA). So identity and contact data go, while financial rows remain with the link to a person removed: GDPR Art. 17(3)(b). Claiming we delete everything would be more convenient and untrue.
Questions from procurement or IT: info@owlly.eu