GDPR · ART. 28(2)
Sub-processor register
The parties we entrust with processing so that Owlly can run. This page is generated from the same register the product runs on: not from a separate copy somebody has to remember to update.
Sub-processors engaged to deliver the Owlly service. Every change to this list is published here, and the register version (a date) changes with it, per GDPR Art. 28(2).
Process personal data
| Sub-processor | Role | Location | Transfer basis |
|---|---|---|---|
| Anthropic (Claude) | Extracts and categorises line items from supplier invoices; generates business insights; powers the AI assistant on the website and inside the product. Data categories: Supplier name and address; Invoice line items; Prices and VAT rates; Tax identifiers (NIP) appearing on invoices; Assistant conversation content; Contact details a prospect or user types into a conversation (name, e-mail, phone) | United States | Standard Contractual Clauses (DPA signed) |
| OpenAI | Fallback model for the same invoice canonisation and insight generation when Claude is unavailable. Data categories: Supplier name and address; Invoice line items; Prices and VAT rates | United States | Standard Contractual Clauses (verify in vendor DPA) |
| DigitalOcean | Hosting: the server that runs the Owlly application and its MySQL database. Data categories: All data held in the Owlly database (invoices, sales, stock, staff records including pay, guest bookings and contact details); Server and access logs, including IP addresses | To be confirmed (the server region is not recorded in the register yet) | To be confirmed with the server region (verify in vendor DPA). |
| Google Cloud — Document AI | OCR and field extraction from uploaded invoice PDFs and scans. Data categories: Full invoice document images; Supplier details; Bank account numbers printed on invoices | European Union | Processed in the EU — processor pinned to the `eu` region (DOCAI_LOCATION=eu), no third-country transfer. |
| Google Cloud Storage | Stores invoice documents and encrypted database backups. Data categories: Invoice documents; Database backups containing all customer personal data | European Union (bucket region) | Processed in the EU. |
| Google Business Profile | Source of the reviews shown in Owlly, where a customer connects their Google Business Profile. Also the destination for a reply the customer writes and sends. Data categories: Reviewer display name and profile photo; Review text, star rating and timestamps; Reply text written by the customer; The Google account e-mail that authorised the connection | European Union / United States | Standard Contractual Clauses (Google Cloud DPA). |
| Stripe | Subscription billing and payment processing. Data categories: Billing contact name and email; Company name; Billing address; VAT identifier | European Union / United States | Stripe Data Processing Agreement with SCCs. |
| Dotykacka | POS integration: imports sales, employees and attendance for customers who use Dotykacka tills. Data categories: Employee names and emails; Attendance records; Sales transactions | European Union (Czech Republic) | EU-based processor. |
| ChoiceQR | Online ordering, QR table ordering and payment, and table bookings, for customers who connect a ChoiceQR venue. Orders and bookings come into Owlly; the menu, dish availability, table bills and order and booking status go back to ChoiceQR. Data categories: Guest name, phone number and e-mail on bookings and orders; Delivery address on delivery orders; Tax identifier (NIP) a guest gives for an invoice; Order contents, amounts and payments; Booking time, party size and guest note | To be confirmed | To be confirmed (verify in vendor DPA). |
| Sentry (Functional Software Inc.) | Application error monitoring and performance tracing. Data categories: Error stack traces; Request paths and metadata; Masked session replays | European Union (de.sentry.io) | EU region selected; data stays in the EU. |
| Brevo (Sendinblue) | Transactional email: invitations, password resets, alerts. Data categories: Recipient name and email address; Email message content | European Union (France) | EU-based processor. |
Receive no personal data
| Sub-processor | Role | Location | Transfer basis |
|---|---|---|---|
| Open-Meteo | Weather history and forecasts used as demand-forecast inputs. Data categories: Branch latitude and longitude | European Union (Germany) | No personal data transferred. |
| OpenHolidays API | School and public holiday calendars as demand-forecast inputs. Data categories: Country and region code | European Union | No personal data transferred. |
Notes
- Anthropic (Claude): Receives invoice content. Supplier contact details on an invoice are personal data of that supplier. Assistant conversations are sent as they are typed, including anything the person chooses to put in the message box.
- DigitalOcean: Holds the live database. The customer company's bank accounts and tax identifier, staff pay and the till's guest register are encrypted in the database (AES-256-GCM); the disks and the rest of the database are not.
- Google Cloud — Document AI: Region is enforced in config.py; do not change it to `us`.
- Google Business Profile: Two-way and unlike the other entries here. Reviews are authored on Google by members of the public and read into Owlly; Google is an independent controller of that platform, not merely our processor. What we send back is the reply text the customer wrote, published under their own listing. Access is granted per company by OAuth and revoked by Disconnect; no data flows before a customer connects.
- Stripe: Card details never reach Owlly; they are entered directly into Stripe Checkout.
- Dotykacka: Only engaged for customers who connect a Dotykacka account.
- ChoiceQR: Only engaged for customers who connect a ChoiceQR venue. Two-way: guests enter their details on ChoiceQR, which sends them to Owlly with the order or booking.
- Sentry (Functional Software Inc.): send_default_pii is disabled and session replay masks all text and media, so invoice and payroll content is not captured.
- Open-Meteo: Receives a restaurant location, never a person.
Data processing agreements (DPAs)
A DPA is a contract accepted in a vendor console or signed on paper: it cannot be implemented in code. The register carries an explicit status for each one.
10 agreements are not yet confirmed on our side and remain operational tasks.
Notification of changes
Every change to the list is published on this page. The date in “Register version” below changes whenever a sub-processor is added or removed, or its data categories change. GDPR Art. 28(2) gives a right to object to a new sub-processor; send an objection to info@owlly.eu.
Register version: 2026-10-09 · 13Source: GET /api/public/subprocessors