Data Processing Agreement

Roles

When you use OwlAgent for your business, the personal data flowing through the assistant — the contents of your emails, calendar events, files, contacts, and CRM records — belongs to you. For that data, you are the controller and OwlAgent is the processor: we process it only on your instructions, to execute the requests you make. For your own account data (name, email, billing), OwlAgent is the controller, as described in our Privacy Policy.

Our commitments as processor

• Process personal data only to provide the service you requested, never for our own purposes.
• Keep it confidential and apply the security measures described on our Security page.
• Host data in the European Union (Hetzner data centers).
• Assist you with data-subject requests (access, deletion, portability) that concern data we process for you.
• Notify you without undue delay if we become aware of a personal data breach affecting your data.
• Delete your data when you close your account, within 30 days.

Subprocessors

We use the following subprocessors to run the service:

• Hetzner Online GmbH — hosting (EU).
• Stripe — payment processing.
• Meta Platforms (WhatsApp Business Platform) — message delivery.
• AI model providers — processing of request text to generate the assistant's responses, under terms that prohibit training on your data.
• Email delivery provider — transactional email.

Where a subprocessor processes data outside the EU, transfers rely on safeguards such as the EU Standard Contractual Clauses. We will inform customers with a signed DPA before adding a new subprocessor.

Requesting a signed DPA

If your company requires a signed Data Processing Agreement (including the EU Standard Contractual Clauses where applicable), email lorenzo.trichard@gmail.com from your account email and we will provide one for signature.