Owlpane / Privacy notice

Privacy notice

Draft, not in force. This page was drafted by an AI assistant from what the software does. It has not been reviewed by a lawyer and the company data is incomplete (address, firmenbuchNumber, registerCourt, vatId, managingDirectors, registered). It is hidden from search engines until the data in scripts/site/config.mjs is complete. Highlighted [brackets] need your input.

Last updated: [date]. This notice covers this website, the Owlpane console and how we handle account and billing data. Telemetry that customers send to Owlpane is handled under a data processing agreement with the customer, who decides what is sent.

Who is responsible

NandTech GmbH, [street, postcode, city, country]. Contact for privacy questions: hello@owlpane.com. [name a data protection contact if you appoint one; a DPO is not obviously required, confirm with your lawyer]

What we collect and why

Visiting the website. Our hosting provider processes your IP address and request details in server logs to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). The website sets no cookies and loads no third-party fonts, scripts or trackers.
Creating an account. Your name, work email and a hash of your password (never the password itself) so we can create and secure your account (contract, Art. 6(1)(b)). We email you a confirmation link.
Where you came from. If your sign-up link carries campaign parameters (utm_*) or a partner code, they are sent with your sign-up and stored with your account to attribute sign-ups and pay partner commission (legitimate interest, Art. 6(1)(f)) [confirm the legal basis with your lawyer]. They are read from the address bar; nothing is stored in your browser for this.
Using the console. A session cookie (__Host-owlpane_session) and a CSRF token keep you signed in securely; they are strictly necessary. Your browser also stores your own choices: owlpane_lang (language), owlpane_console_theme (light or dark), owlpane.currency and owlpane.billing (price display), and sidebar and dashboard layout keys. These stay on your device and are never used to track you.
Billing. Company name, billing contact, VAT ID and plan. Payments are handled by Stripe; we do not see your card number. We keep invoices as required by tax law (Art. 6(1)(c); in Austria generally 7 years, §132 BAO [confirm]).
Support and security. Emails you send us, audit-log entries for account actions, and rate-limit records to prevent abuse (contract and legitimate interest).

Who receives data

Service providers that process data on our behalf are listed on the sub-processors page. We do not sell personal data.

Transfers outside the EU

Some providers (for example Stripe, and AI providers if you enable AI features) may process data in the United States. We rely on the EU-US Data Privacy Framework or Standard Contractual Clauses [confirm per provider].

How long we keep it

Account data: while your account exists, then deleted within [period, e.g. 30 days] unless the law requires us to keep it.
Invoices and accounting records: as long as tax law requires.
Security and rate-limit logs: [period, e.g. 90 days].

Your rights

You can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to hello@owlpane.com. You may complain to the supervisory authority: in Austria the Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, www.dsb.gv.at [adjust if the company is established elsewhere].

Security

We use HTTPS everywhere, per-tenant data isolation in the database, hashed passwords, optional two-step verification and passkeys, and audit logs. Please report vulnerabilities as described in security.txt.

Changes

We will update this page when our processing changes and show the date above.