GDPR · ART. 28(2)
Sub-processor register
The parties we entrust with processing so that Owlly can run. This page is generated from the same register the product runs on — not from a separate copy somebody has to remember to update.
Sub-processors engaged to deliver the Owlly service. Customers are notified before a new sub-processor handling personal data is added, per GDPR Art. 28(2).
Process personal data
| Sub-processor | Role | Location | Transfer basis |
|---|---|---|---|
| Anthropic (Claude) | Extracts and categorises line items from supplier invoices; generates business insights; powers the AI assistant on the website and inside the product. Data categories: Supplier name and address; Invoice line items; Prices and VAT rates; Tax identifiers (NIP) appearing on invoices; Assistant conversation content; Contact details a prospect or user types into a conversation (name, e-mail, phone) | United States | Standard Contractual Clauses (DPA signed) |
| OpenAI | Fallback model for the same invoice canonisation and insight generation when Claude is unavailable. Data categories: Supplier name and address; Invoice line items; Prices and VAT rates | United States | Standard Contractual Clauses (verify in vendor DPA) |
| Google Cloud — Document AI | OCR and field extraction from uploaded invoice PDFs and scans. Data categories: Full invoice document images; Supplier details; Bank account numbers printed on invoices | European Union | Processed in the EU — processor pinned to the `eu` region (DOCAI_LOCATION=eu), no third-country transfer. |
| Google Cloud Storage | Stores invoice documents and encrypted database backups. Data categories: Invoice documents; Database backups containing all customer personal data | European Union (bucket region) | Processed in the EU. |
| Stripe | Subscription billing and payment processing. Data categories: Billing contact name and email; Company name; Billing address; VAT identifier | European Union / United States | Stripe Data Processing Agreement with SCCs. |
| Dotykacka | POS integration: imports sales, employees and attendance for customers who use Dotykacka tills. Data categories: Employee names and emails; Attendance records; Sales transactions | European Union (Czech Republic) | EU-based processor. |
| Sentry (Functional Software Inc.) | Application error monitoring and performance tracing. Data categories: Error stack traces; Request paths and metadata; Masked session replays | European Union (de.sentry.io) | EU region selected; data stays in the EU. |
| Brevo (Sendinblue) | Transactional email: invitations, password resets, alerts. Data categories: Recipient name and email address; Email message content | European Union (France) | EU-based processor. |
Receive no personal data
| Sub-processor | Role | Location | Transfer basis |
|---|---|---|---|
| Open-Meteo | Weather history and forecasts used as demand-forecast inputs. Data categories: Branch latitude and longitude | European Union (Germany) | No personal data transferred. |
| OpenHolidays API | School and public holiday calendars as demand-forecast inputs. Data categories: Country and region code | European Union | No personal data transferred. |
Notes
- Anthropic (Claude) — Receives invoice content. Supplier contact details on an invoice are personal data of that supplier. Assistant conversations are sent as they are typed, including anything the person chooses to put in the message box.
- Google Cloud — Document AI — Region is enforced in config.py; do not change it to `us`.
- Stripe — Card details never reach Owlly; they are entered directly into Stripe Checkout.
- Dotykacka — Only engaged for customers who connect a Dotykacka account.
- Sentry (Functional Software Inc.) — send_default_pii is disabled and session replay masks all text and media, so invoice and payroll content is not captured.
- Open-Meteo — Receives a restaurant location, never a person.
Data processing agreements (DPAs)
A DPA is a contract accepted in a vendor console or signed on paper — it cannot be implemented in code. The register carries an explicit status for each one.
7 agreements are not yet confirmed on our side and remain operational tasks.
Notification of changes
Customers are notified before a new sub-processor handling personal data is added — GDPR Art. 28(2) gives a right to object, which can only be exercised if the list is visibly moving. The register version below changes with every such change.
Register version: 2026-09-02 · 10Source: GET /api/public/subprocessors