Privacy policy

Last updated: July 29, 2026

This Privacy Policy describes how Owlie, LLC (“Owlie,” “Company,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal data in connection with our websites and identity and access management software-as-a-service offerings (the “Services”). This Policy is intended to comply with applicable privacy laws, including:

GDPR and UK GDPR
Swiss DPA
CCPA/CPRA
Other U.S. state privacy laws

This Privacy Policy works together with the Master Subscription Agreement (Terms of Service), Data Processing Addendum (“DPA”), Acceptable Use Policy, and Security Addendum.

1. Scope and Roles

This Privacy Policy applies to:

Visitors to our websites (“Website Users”)
Users who access the Services (“End Users”)
Representatives of customers, vendors, or partners (“Business Contacts”)

Owlie acts in different roles depending on the context:

Owlie as Processor (Service Provider)

We process Customer Content (identity data, access data, logs, directory sync data) strictly on behalf of customers and according to the Agreement and DPA.

Owlie as Controller

We process data as a controller for our own business operations, such as:

Account administration
Billing and subscription management
Security and platform monitoring
Website analytics
Marketing communications

2. Information We Collect

2.1 Information Provided Directly

We may collect personal data that you or our customers provide, including:

Contact details (name, email, phone, job role, company)
Account registration information
Authentication and login elements (usernames, keys, MFA factors—never plaintext passwords)
Configuration, policy, and workflow settings within the Services
Communications with support or customer success teams

2.2 Information Collected Automatically

When you access our websites or Services, we may automatically collect:

IP addresses and geolocation approximations
Device identifiers, browser type, operating system
Access logs and authentication events
API usage and performance telemetry
System activity metadata

2.3 Customer Content

Customers may submit, synchronize, generate, or authorize Owlie to process:

Employee, contractor, administrator, and service-account identity data
Roles, groups, permissions, accounts, entitlements, and access relationships
Human resources, directory, application, and connector data
Access requests, reviews, approvals, policies, provisioning actions, and audit records
Assistant conversations, prompts, instructions, tool inputs, tool results, and generated outputs
Messages and interaction metadata from customer-enabled integrations, including Slack

Owlie processes Customer Content only to provide, secure, support, and maintain the Services in accordance with the Agreement and DPA.

2.4 Cookies and Tracking Technologies

We may use:

Essential operational cookies
Analytics tools (e.g., pseudonymized usage metrics)
Error monitoring and performance telemetry

We do not use tracking for cross-site advertising.

3. How We Use Personal Data

We use data for the following purposes:

Service Delivery

Authentication and access control
Provisioning, deprovisioning, and identity lifecycle management
Generating security logs and audit trails

Security & Fraud Prevention

Detecting unauthorized access
Monitoring system performance and anomalies
Protecting against phishing, credential abuse, and fraud

Service Improvement

Telemetry to optimize platform stability
To provide customer support and technical assistance
To improve and develop our Services
Enhancing product features and user experience
Providing AI-assisted search, explanations, workflow preparation, recommendations, and authorized actions. AI-generated outputs may be inaccurate and should be reviewed before they are used for identity-governance or access decisions. Owlie does not use Customer Content to train Owlie-owned models.

Administrative Purposes

Contract and billing management
Customer communications
Compliance and legal obligations

Owlie does not sell personal data and does not use Customer Content for targeted advertising.

Where applicable, Owlie processes personal data under the following legal bases:

Performance of a contract
Legitimate interests (security, fraud prevention, service improvement)
Compliance with legal obligations
Consent for optional marketing or analytics tools

We may share data with:

Service Providers & Subprocessors

Cloud hosting, monitoring, analytics, messaging, support, and identity infrastructure providers. All subprocessors are bound by contractual confidentiality and data protection obligations. We use service providers and subprocessors for application infrastructure, managed databases, security, observability, billing, support, and AI inference. Depending on enabled features, these providers may process Customer Content, assistant prompts and outputs, account information, logs, telemetry, or billing information. Owlie’s current Subprocessor List identifies the providers that process Personal Data on Owlie’s behalf.

Affiliates

Where necessary for operations or support.

Legal Requirements

Courts, regulators, or government authorities when required.

Business Transactions

In connection with mergers, acquisitions, or restructuring events with appropriate safeguards.

All service providers are bound by contractual obligations to protect personal data and use it only for authorized purposes.

We do not sell or share personal data for behavioral advertising.

Customer-Directed Integrations

Customers may connect Owlie to third-party applications and data sources. When a Customer directs Owlie to exchange data with such a provider, that provider’s handling of the data is governed by the Customer’s agreement and privacy terms with that provider.

6. Data Security

We implement appropriate technical and organizational measures designed to protect personal data, including:

Encryption in transit and at rest
Role-based access controls and MFA enforcement
Segregated environments
Vulnerability management and penetration testing
Logging and monitoring of privileged access

Details are provided in the Security Addendum.

7. Data Retention

We retain controller data for as long as reasonably necessary for the purposes described in this Policy, including account administration, security, legal compliance, and dispute resolution.

Customer Content is retained during the subscription term. Following termination, Customers have thirty (30) days to export or request return of Customer Content. After that period, Owlie deletes or renders remaining Customer Content inaccessible within a commercially reasonable period, subject to legal-retention requirements and normal backup-deletion cycles, as described in the Agreement and DPA.

8. International Data Transfers

Personal data may be transferred to and processed in countries other than your country of residence. Where data is transferred internationally, we use:

Standard Contractual Clauses
UK Addendum or IDTA
Other approved transfer mechanisms

We implement supplementary safeguards where required.

9. Your Privacy Rights

Depending on jurisdiction, you may have rights to:

Access your data
Correct inaccurate data
Delete data
Restrict or object to processing
Port your data
Opt out of “sharing” or targeted advertising
Appeal decisions in certain cases

Requests may require identity verification and customer authorization.

10. Children’s Privacy

The Services are not directed to children under 13 (or other age as required by law), and we do not knowingly collect personal data from children.Use by minors is prohibited.

11. Changes to This Privacy Policy

We may update this Policy from time to time.

Material changes will be communicated through the Services or via other appropriate means.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact:

Owlie, LLC
Attn: Privacy Officer
Email: legal@owlie.com