Privacy Notice
How Owlia handles your data across the public site, the access request and the application: what is collected, why, for how long, and what you can ask us for.
In force since .
1. Who is responsible
The controller of the personal data described here is Owlia Education, of Av. de les Nacions Unides, 40, AD700 Andorra. For anything about privacy, or to exercise the rights in section 8, write to legal@owlia.app.
2. What this notice covers
Owlia has three surfaces, and they behave very differently:
- www.owlia.app, the public site
- Static pages that anyone can read. They collect nothing about you.
- The access request
- Where you give us an email address so we can consider you for a place.
- my.owlia.app, the application
- Where you study with Owlia once you have been invited, and the only surface where there is much to say.
3. The public site collects nothing
www.owlia.app is a set of static files. It has no forms, no uploads, no login and no comments, so there is no way to send us anything from it. It runs no analytics, no advertising and no tracking pixels, it loads no third party scripts, and it sets no cookies of its own.
The one thing it leaves behind is the language you chose, stored in your own browser under the key owlia_locale.
- What it holds
- One language code from the fourteen the site is written in, such as en, es or ca. Nothing else.
- What it is for
- So that your next visit opens in the language you chose, instead of guessing it again from your browser settings.
- How long it lasts
- Until you choose another language or clear this site's data. It has no expiry of its own.
- How to remove it
- Clear the site data for www.owlia.app in your browser settings. Everything on the site keeps working without it.
It is kept in the browser's local storage, not in a cookie. It is not an identifier, it carries no timestamp, it is not combined with anything else, and it never leaves your browser: nothing on those pages sends it anywhere, and there is no server there that could ask for it.
The files are served from a content delivery network. Like any web server, that infrastructure processes what a request carries — the IP address, the browser's user agent and the time — in order to return the page and to keep the service available and protected against abuse. We install no analytics of our own, and what we see from that infrastructure is aggregate traffic, not a record of who read what.
That same infrastructure asks your browser to do one thing on its own, and it is the only thing on the site that sends anything anywhere. When a connection to the site fails, your browser reports the failure to an address belonging to the delivery network: what was requested, what went wrong, and the address and browser the attempt came from. Only failures are reported, never successful visits, and the instruction expires after seven days. We do not receive those reports and we cannot switch them off on the plan we are on; they exist so that the network can see where it is breaking. If that matters to you, browsers let you turn network error reporting off in their settings.
4. Asking for access
The access request asks for an email address, and for a parent's or guardian's if you are under 16. We use it to consider your request, to tell you what we decided, and to send an invitation if there is one. Nothing else: it is not a mailing list and it is not sold or shared for anyone else's marketing.
The identity provider we use holds that address for us. Following the button on the public site carries one thing with you: the language the request will be handled in, so that the screen opens in it and links the documents written in it. That is the language you were reading in when these documents exist in it — English, Spanish and Catalan — and English otherwise, because they are written in those three and are not translated by machine. It carries no country, no location, no identifier and no cookie: the site knows a language, not where you are.
The lawful basis is our legitimate interest in running a controlled early access, and your consent where the law requires it because of your age. Asking does not create an account and does not promise you one.
5. Using Owlia
Once you have a place, using Owlia means processing rather more:
- Who you are
- The account identity held by our identity provider: your email address, the name you give, and how you sign in. We do not store your password.
- What you say to Owlia
- Your conversations, the answers you attempt, what you got right and wrong, and the material you paste in. This is the substance of the service: without it there is no studying to continue.
- What you have learned
- Topics practised, cards earned, progress and what is due for review.
- What you told us about yourself
- Your school year, subjects and preferences, so that Owlia works at the right level.
- Technical records
- Logs of requests and errors, kept to keep the service running and secure.
The lawful basis is the contract between us — these are the terms you accepted — together with our legitimate interest in keeping the service secure, and consent where the law requires it because of your age.
Owlia does not use your conversations to train models. To produce a reply, the text of the conversation is sent to the model provider we use, under terms that forbid using it for training, and it is not used to improve anyone's model. It is not sold, and it is not shared for advertising. There is no advertising in Owlia.
6. Who processes data for us
We use providers to run Owlia, and they process data on our instructions and nothing more:
- the identity provider that holds accounts and sign-in;
- the language model provider that produces Owlia's replies;
- the cloud infrastructure that runs the application;
- the content delivery network that serves the public site.
Where a provider processes data outside the European Economic Area, that transfer is covered by the safeguards the law requires. We do not sell personal data, to anyone, ever.
7. How long we keep it
An access request is kept while it is being considered and, if we do not approve it, for 12 months after that decision. What you write in Owlia is kept while your account exists, so that your studying continues where you left it. When you delete your account we delete the data that belongs to it within 30 days, keeping only what the law requires us to keep and a minimal record that the deletion happened, which contains nothing about you.
8. Your rights
Under Andorran data protection law, the Llei 29/2021 qualificada de protecció de dades personals, you can ask us for access to your personal data and for its rectification, erasure, restriction or portability, and you can object to its being processed. Where processing rests on consent, you can withdraw it at any time, and withdrawing it does not undo what was lawful before. Write to legal@owlia.app.
If you are under 16, your parent or guardian can exercise those rights with you. You can also complain to the Andorran Data Protection Agency (APDA), which is the authority that supervises us.
9. Young people
Owlia is built for people aged 12 to 18, so most of the data described here belongs to a minor, and it is treated accordingly: the minimum needed to run the service, no profiling for advertising, no selling, and no using conversations to train models. Where the law asks a parent or guardian to consent before a young person's data is processed, that consent is asked for at the access request and can be withdrawn afterwards.
10. Security
Data is encrypted in transit, access to it is limited to what running the service requires, and each account's data is separated from every other. No system is perfect. If a breach happens that puts your rights at risk, we will tell you and the supervisory authority within the time the law allows.
11. When this notice changes
A change to this document is a new version, not an edit. Every version keeps its own permanent address and never changes once it is published, so the version you read can always be read again exactly as it was. The version in force is always the one at /privacy/, and a change that affects you materially is told to you rather than left to be discovered.
12. Terms
The terms on which you may use Owlia are a separate document: the Terms and Conditions.