GDPR · ART. 13 AND 14
Privacy Policy
Last updated: 2026-10-28
This notice explains what personal data Owlly processes, why, on what legal basis, who it is shared with and how long it is kept. It is written to meet Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679).
Owlly plays two different roles. For your own account we are the data controller. For the data you put into Owlly about your staff and your suppliers, you are the controller and we act as your processor under a data processing agreement.
1. Who we are
The controller of your account data is Matteo Liscaio Company 1, ul. Jana Kochanowskiego 47a, 05-091 Ząbki, Poland, NIP 1251793004, REGON 542562362 ("Owlly", "we").
For privacy questions, or to exercise any of the rights in section 8, contact us at info@owlly.eu.
2. What we collect
- Account data — your name, email address, phone number, password (stored only as a bcrypt hash), language and country, profile picture.
- Company data — company name, registered address, VAT identifier (NIP), branch addresses, bank account numbers (IBAN).
- Employee data you enter — names, emails, phone numbers, tax identifiers, pay rates and salary, attendance and worked hours, PIN (stored only as a bcrypt hash).
- Documents you upload — supplier invoices and receipts, including the supplier details, bank accounts and line items printed on them.
- Usage data — IP address, browser user agent, pages visited and actions taken, kept in an activity log for security and support.
- Data from Google, only if you connect it — the e-mail address of the Google account you connect with; from Google Business Profile, the reviews on the listings you choose to link (each reviewer's display name, profile photo, star rating, review text and any reply) and the listings' performance figures; from Google Ads, Google Analytics and Google Search Console, the reports and settings of the accounts, properties and sites you choose. See section 11.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service you signed up for: processing invoices, stock, scheduling, point of sale | Performance of a contract — Art. 6(1)(b) |
| Billing and collecting payment | Performance of a contract — Art. 6(1)(b) |
| Extracting and categorising invoice data using AI models | Performance of a contract — Art. 6(1)(b) |
| Answering your questions through the AI assistant | Performance of a contract — Art. 6(1)(b) where you are a customer; legitimate interests — Art. 6(1)(f) for enquiries from visitors who are not yet customers |
| Reading and summarising the reviews on a Google Business Profile you have connected | Performance of a contract — Art. 6(1)(b) |
| Reporting on the Google Ads, Analytics and Search Console accounts you have connected, and — only where you turn it on — changing your own campaigns or sending bill values back to Google Ads | Performance of a contract — Art. 6(1)(b) |
| Keeping accounting and tax records | Legal obligation — Art. 6(1)(c) |
| Security logging, fraud and abuse prevention, service monitoring | Legitimate interests — Art. 6(1)(f) |
| Product analytics and marketing cookies | Consent — Art. 6(1)(a); you can withdraw it at any time |
4. Automated processing and AI
Invoices you upload are processed by optical character recognition and by large language models to read and categorise their contents. Owlly also produces demand forecasts and business insights from your sales history.
These are decision-support tools. They do not make automated decisions that produce legal effects concerning any individual, within the meaning of Article 22.
Invoice content sent for AI processing includes supplier names, addresses and tax identifiers printed on the document. See section 5 for where that data goes.
Owlly also offers an AI assistant, on our website and inside the product. What you type into it is sent to Anthropic to generate a reply, so please do not paste invoices, or other people's personal data, into the message box. The assistant tells you it is an AI at the start of every conversation. It cannot make decisions about you; a person handles anything it escalates.
We keep the conversation, and any contact details you choose to give us in it, so we can follow up on your enquiry. You can ask us to erase it at any time — see section 8.
Where you connect a Google Business Profile, the text of each review is sent to Anthropic to classify its sentiment and the topics it raises, and to write a summary of a period's reviews. Nothing drafts or publishes a reply for you: a reply is only ever posted when a person at your business writes it and presses send.
Where you connect Google Ads, Google Analytics or Google Search Console, the in-app assistant can read those figures to answer a question someone at your business asks it; the figures it uses for that answer are sent to Anthropic with the question. See section 11.
5. Who we share it with
We do not sell personal data and we do not share it for third-party marketing. We use the sub-processors below to deliver the service. The current, authoritative list is published at /api/public/subprocessors.
| Recipient | What it receives | Location |
|---|---|---|
| Anthropic (Claude) | Invoice content: supplier names and addresses, line items, prices, tax identifiers. Also everything typed into the AI assistant, including any contact details given in a conversation | United States |
| OpenAI | The same invoice content, as a fallback model | United States |
| Google Cloud — Document AI | Invoice document images | European Union |
| Google Cloud Storage | Invoice documents and database backups | European Union |
| Stripe | Billing contact, company name, address, VAT identifier | EU / United States |
| Dotykacka | Employee and sales data, where you connect a Dotykacka till | European Union |
| Sentry | Error diagnostics; personal data is disabled and session recordings are masked | European Union |
| Brevo | Recipient name and email for transactional email | European Union |
| DigitalOcean | Hosting of the application server and its database, so every category of data in this notice | To be confirmed |
| ChoiceQR | Only if you connect it: guest name, phone, email, delivery address and tax identifier on online orders and bookings, and the order and booking contents | To be confirmed |
| Google Business Profile | Only if you connect one: the replies you write and send. Reviews travel the other way, from Google to Owlly | EU / United States |
| Google Ads | Only if you connect it and turn these on: the campaign changes described in section 11, and, for a booking that came from an ad, its click identifier and bill value — with the guest's e-mail and phone number only as SHA-256 hashes and only where the guest agreed. Reports travel the other way, from Google to Owlly | EU / United States |
6. Transfers outside the EEA
Anthropic processes invoice content and AI assistant conversations in the United States, and OpenAI processes invoice content there as a fallback model. Those transfers rely on the European Commission's Standard Contractual Clauses under Article 46(2)(c), together with the safeguards in each provider's data processing agreement.
The sub-processors listed above with a European Union location process data there; Google Document AI is pinned to the EU region. The locations of DigitalOcean and ChoiceQR are being confirmed and will be stated here and in the register.
7. How long we keep it
| Data | Retention period |
|---|---|
| Account data | For the life of your account, then deleted or anonymised on request |
| Invoices and accounting records | 5 years counted from the beginning of the year following the financial year (ustawa o rachunkowości art. 74) |
| Payroll and attendance records | Set by your employer: 10 years from the end of the year employment ended for staff first registered for social insurance after 2018 (Kodeks pracy art. 94 pkt 9b), and up to 50 years for those registered between 1999 and 2018 unless the employer filed ZUS OSW/RIA |
| Security and activity logs | 2 years, after which identifying details are automatically stripped |
| Google reviews, where a profile is connected | For as long as the connection lasts. After 2 years the reviewer's name and photo are automatically blanked, keeping only the rating, the text and our analysis |
| Google Ads, Analytics and Search Console data, where connected | For the life of your account. Disconnecting stops every further read; what was already downloaded stays until you ask us to delete it. A booking's ad click identifier is removed after 90 days |
| Database backups | 30 days |
8. Your rights
Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, and to receive it in a portable format.
You can download everything we hold about you at any time from Settings, or by calling GET /api/gdpr/export. You can delete your account from the same place.
If the data concerns you as an employee of an Owlly customer, your employer is the controller: send your request to them, and we will assist them in answering it.
Where processing is based on consent, you may withdraw it at any time without affecting processing carried out beforehand.
You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.
9. How we protect it
We describe here only the measures actually in place.
- All traffic is encrypted in transit with TLS 1.2 or 1.3, with HSTS enabled.
- Passwords and PINs are stored only as bcrypt hashes; they are never recoverable, by us or anyone else.
- Bank account numbers you enter, tax identifiers and salary figures are encrypted in the database with AES-256-GCM, as are third-party access tokens and mailbox credentials.
- Database backups are encrypted before leaving the server.
- Access is separated per tenant and enforced centrally, so one customer cannot reach another's data.
- A strict Content Security Policy, rate limiting and account lockout protect against common web attacks.
- Note that the underlying server disks and database tablespaces are not themselves encrypted at rest; protection relies on the field-level encryption and access controls described above.
10. Cookies
We use cookies that are strictly necessary to run the service — keeping you signed in and holding your preferences. These do not require consent.
We also use Google Analytics to understand product usage. These analytics cookies are only set after you agree, and you can change or withdraw that choice at any time from the cookie settings link in the footer.
11. Data from Google (Google user data)
This section describes what Owlly does with data it receives from Google APIs. Owlly has two separate Google connections, and each is made only if someone at your business chooses to connect it: Google Business Profile (Settings → Google), and Google Ads, Google Analytics and Google Search Console (Settings → Integrations → Ads and analytics). If neither is connected, Owlly requests nothing from Google and none of the following happens. Either way you are sent to Google's own consent screen and sign in with your Google account: you never give Owlly your Google password, and Google lists every permission before you agree.
Google Business Profile — what we access. We request one permission, "See, edit, create and delete your Google Business Profile listings and reviews" (business.manage), plus your e-mail address so we can show you which account is connected. From it we read the listings that account manages and, for the listings you choose to link to a venue, the reviews (the reviewer's display name and profile photo, the star rating, the review text, its dates and any reply) and the performance figures Google reports for the listing: how often it was seen in Search and Maps, the searches it appeared for, and the calls, direction requests, website visits, bookings and menu views it led to.
Google Business Profile — what we do with it. Reviews and figures are shown to you in Owlly, grouped by venue. Review text is sent to Anthropic to classify sentiment and topics and to summarise a period, as described in section 4. When you write a reply and press send, we publish exactly that text to Google under your listing. We never write a reply for you, never post one automatically, and never change your listing in any other way — no setting anywhere in Owlly enables that.
Google Ads, Analytics and Search Console — what we access. One consent covers the three products. We request "See, edit, create and delete your Google Ads accounts and data" (adwords — Google offers no read-only permission for Google Ads), "See and download your Google Analytics data" (analytics.readonly), "View Search Console data for your verified sites" (webmasters.readonly), and your e-mail address. We read only the accounts, properties and sites you tick in Owlly. From Google Ads: the accounts and how they are built (campaigns, ad groups, ads, keywords, budgets and settings), their daily results (impressions, clicks, cost, conversions), the search terms that showed your ads, ad clicks (the click identifier, or GCLID, with its date, campaign, keyword and device), calls from ads (time, length, status and the caller's country and area code — never the full number), the account's change history, landing pages, asset results and keyword search volumes. From Google Analytics: aggregated reports on your website (visitors, sessions, events and conversions by day, page, traffic source, device and city) and how many people are on it right now — Analytics never tells Owlly who an individual visitor is. From Search Console: the searches your site appeared for, with their clicks, impressions and position by page, country and device, and the indexing status of your pages and sitemaps.
Google Ads, Analytics and Search Console — what we do with it. The figures are shown to the people at your business who can see Marketing in Owlly, set against your own sales and bookings: which campaigns brought bookings and what they cost, how people find your website and your name, and how that changes. When someone at your business asks the in-app assistant about them, the figures it needs for that answer are sent to Anthropic with the question (section 4). If your business connects an AI app and gives it the Marketing area (section 12), that app can read the same figures.
What we change in Google Ads — only if you turn it on. Analytics and Search Console are only ever read. Owlly changes nothing in a Google Ads account unless an owner turns one of these on for it. First, steering: Owlly can raise or lower a campaign's daily budget, pause or resume a campaign, and add negative keywords. Each change is proposed to a person to approve unless an owner lets a rule act by itself, and even then no budget moves by more than 20 % in a day; every change is recorded in Owlly with what it replaced. Second, sending bill values back: Owlly creates one conversion action in your account and uploads to it, for a booking that came from an ad and was paid, the click identifier, the time and the bill's value — plus the guest's e-mail address and phone number as SHA-256 hashes, never in plain text and never a name, only where the guest agreed to ad measurement when booking.
What we never do, with any data from Google. Apart from the changes to your own campaigns that you turn on above, we do not use data from Google APIs for advertising — not to show ads, and not for retargeting, personalised or interest-based advertising. We do not sell it. We do not transfer it to anyone except as needed to provide the features described here (Anthropic, section 5; an AI app your business connects, section 12), to comply with the law, or with your consent. We do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models. No one at Owlly reads it, except with your permission for a support request you make, where needed for security or to comply with the law, or once it is aggregated and anonymised for running the service. Owlly's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
How it is stored. The access and refresh tokens that authorise each connection are encrypted in our database (AES-256-GCM) and are never shown in the interface. The data is stored in the European Union with the rest of your account data, under the safeguards in section 9; the raw answers of each download are also kept, compressed, in Google Cloud Storage in the European Union under your company, with every token removed, so a figure can be read again without asking Google twice.
How long we keep it. For as long as the connection lasts, and after that until you ask us to delete it, so that disconnecting does not silently erase the history you have been reading. Two years after a review was written we automatically blank the reviewer's name and profile photo, keeping only the rating, the text and our analysis. A booking's ad click identifier is removed after 90 days.
How to stop it. Press Disconnect on the same settings screen at any time. We then revoke our token with Google, and nothing further is read or changed. Ask us at info@owlly.eu and we will delete what was already downloaded, as is your right under section 8. You can also revoke Owlly independently from your Google account at myaccount.google.com/permissions.
12. AI apps you connect (Claude, ChatGPT and others)
This section applies only if someone in your company connects an AI app to Owlly in Settings → Integrations → AI assistants. If nobody does, none of the following happens.
Who chooses the app. The AI app (for example Claude by Anthropic, or another app that supports remote MCP connectors) is chosen and contracted by your company. Data the app reads from Owlly goes to the company behind that app under your own agreement with it; that company is not an Owlly sub-processor, and the reasoning happens in your app — Owlly spends no AI credit on it.
What is shared. Only the areas the person who connects picks, at the level they pick (Off, Read or Change), and never more than your owner allows in Owlly. A guest's phone number and e-mail are never shared unless your owner turns that on; otherwise the app sees a first name and an initial. Salaries, staff rates, bank account numbers, PINs and passwords are never shared.
Who can connect. Owners, admins and managers, each connection for one company; a manager of one venue reaches only that venue. Every request is checked again by Owlly, whatever the app asks.
What we keep. The connection (who connected which app, when, and the areas given) and a record of each request the app made — which tool, when, and whether it was refused — so your owner can see what the apps did. Sign-in tokens are stored only as one-way hashes.
How to stop it. Disconnect in Settings → Integrations → AI assistants; it takes effect at once. You can also remove Owlly from the AI app itself.
13. Changes to this notice
Every change to the list of sub-processors is published at /api/public/subprocessors and on the sub-processors page, with the register version (a date) changing with it. A material change to this notice changes the date at the top.