Privacy Notice

1.1 Who this Notice covers

This Notice applies to Personal Information about:

1. (a)visitors to the Site who do not create an account;
2. (b)Individual Users, meaning people who use the Services for personal, non-commercial purposes (called consumers in this Notice);
3. (c)Members and Administrators of an Organization (including a one-person Organization used for business purposes), and the people who sign up or contact us on behalf of an Organization Customer; and
4. (d)people who correspond with us, attend our events, or otherwise interact with us, including job applicants (Section 2.5).

It also applies, in the limited way Section 1.2 describes, to people who appear in or are mentioned in Customer Content, such as athletes, officials, coaches, and spectators, even if they have no relationship with Owl.

1.2 Our roles: controller and processor

Privacy laws distinguish between a controller (called a “business” under the California Consumer Privacy Act, or CCPA), which decides why and how Personal Information is used, and a processor (a “service provider” or “contractor” under the CCPA), which handles Personal Information on a controller’s behalf. Owl holds both roles, depending on the information. The line that matters for these roles is between consumers and business customers. A consumer is an Individual User who uses the Services for personal, non-commercial purposes. A business customer is anyone who uses the Services for business or organizational purposes; a business customer can and should operate as an Organization (an Organization may be a single person).

(a) Owl is the controller (or business) for:

• Personal Information of Site visitors;
• Personal Information that consumers give us or that we collect about them, including the content they upload, stream, or type into the Services (their Customer Content and the resulting Output);
• account, authentication, billing, support, communications, and marketing information about everyone who uses the Services or contacts us, including Members of Organizations; and
• Usage Data and Service Data about the use of the Services by anyone.

(b) Owl is the processor (or service provider) for Customer Content that an Organization Customer submits to the Services, such as footage, Live Source streams, rosters and other Live Context, prompts, and transcripts, to the extent it contains Personal Information of other people (for example, athletes, officials, coaches, and spectators), when we process it to provide the Services to that Organization Customer. For that processing, the Organization Customer is the controller. Our processing is governed by the Organization Customer’s agreement with us, including the DPA at owl.ai/dpa, which applies automatically to an Organization Customer’s business use where Owl processes Personal Information on the customer’s behalf. If you appear in content that an Organization Customer submitted, or you are a participant, official, or spectator whose information may have been submitted, please direct your privacy requests to the Organization Customer (for example, the league, team, or broadcaster that provided the footage). We will respond to requests about Owl’s own use under Section 5 and refer requests about the customer’s use to the relevant Organization Customer.

(c) Owl is also a controller of Organization Customer Content for Owl’s own purposes. Owl does not use Organization Customer Content solely on the customer’s behalf. Under the Terms (and, for customers with a master services agreement, under that agreement), Owl has a license to use Customer Content and Output to develop, train, test, and improve Owl’s products, services, and models, including services provided to other customers. Owl also creates and uses Usage Data, Service Data, and De-Identified Data from the Services, and owns certain outputs it does not make available to the customer. Owl decides for itself whether and how to do these things. For these purposes, which are described in Section 5 and in purposes (i) through (k) of Section 4, Owl acts as a controller (or business, or, where a state law uses a different term, as the entity that determines the purposes of processing), and this Notice applies to that use. The Organization Customer is responsible for its own notices to individuals about its disclosure of content to Owl. We say this plainly because we do not want you to read the processor description in paragraph (b) as a promise that Owl uses Organization Customer Content only for the customer.

(d) Consumers. Owl is the controller of everything a consumer provides, including any Personal Information of third parties that appears in the consumer’s uploads. No DPA is offered to consumers. Consumers are responsible, under Section 5.6 of the Terms, for having the rights and consents needed for what they upload. If you use the Services for business or organizational purposes, you can and should do so as an Organization (an Organization may be a single person) so that the DPA applies.

1.3 Information not covered

This Notice does not apply to information that has become De-Identified Data (Section 7.8), to third-party websites and services (Section 16), or to Personal Information about Owl personnel, which is handled under Owl’s internal policies. Personal Information we collect from job applicants is covered by Section 2.5.

2.1 Site visitors

When you visit the Site without creating an account, we collect:

• Device and connection data: IP address, browser type and version, operating system, device type, language, referring and exit pages, pages viewed, dates and times of visits, and approximate location derived from IP address;
• Cookie and similar-technology data: identifiers and settings stored through cookies, pixels, and local storage, as described in Section 12; and
• Information you submit: information you give when you fill out a contact, demo-request, waitlist, or newsletter form, or when you email us, such as your name, work email address, organization, role, use case, and message.

2.2 Account holders (Individual Users, Members, Administrators)

When you create or use an account, we collect:

• Identity and account information: name, email address, profile information, Organization name, role and permissions, and a unique account identifier, authentication methods, and session information. Depending on how you sign in, this can include information from a third-party sign-in service you choose, such as your name, email address, and profile photo.
• Organization administration records: records of the creation, modification, and deletion of an Organization; invitations sent, accepted, and revoked; and the addition and removal of Members (see Section 3.4 of the Terms).
• Billing and transaction information: plan or Billing Option selected, purchase history, OIU balance and ledger, invoices, billing name and address, and tax information. Where offered, payment card and bank details are collected and held by our payment processor; we receive limited information such as card brand, last four digits, expiration date, billing postal code, and payment status.
• Usage Data and Service Data: features used, processing volumes and OIU consumption (recorded at the Account or Organization level and, for some activity such as Watches, attributed to the Member who set it up), performance metrics, error and diagnostic information, security events, and audit logs.
• Communications and support: messages to our support team, feedback and Feedback Notes, survey responses, and records of our communications with you, including whether you open or click marketing emails.
• Preferences and settings: display and notification preferences, marketing preferences, and any privacy settings you select, such as a model-training setting (Section 5.6).

Signing in with Google. If you sign in with your Google account, we receive a unique identifier for your Google account, your name and profile picture, and your email address. We use this information only to authenticate you and to create and maintain your account. We do not use information received from Google for advertising. We share it only with service providers that help us operate sign-in on our behalf, or as required by law. Owl’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.3 Content

Consumers, Organization Customers, and their Members may upload Videos, connect Live Sources, type prompts and chat messages to the Agent, provide Live Context (such as rosters and descriptions of what to look for), and save moments, clips, and exports. This content, and the Output the Services generate from it, is Customer Content and Output. It may contain Personal Information about the person who submitted it and about others who appear in the footage, including:

• images, video, and audio in which people may be visible or audible;
• names, jersey numbers, positions, team affiliations, and roster information; and
• performance, movement, event, and scoring data linked to identifiable people.

Our role depends on who submitted the content. For a consumer’s content, including other people’s Personal Information in it, Owl is the controller. For an Organization Customer’s content, Owl is the processor as to other people’s Personal Information in it when we process it to provide the Services (Section 1.2(b)), and a controller for Owl’s own purposes (Section 1.2(c)). That Personal Information may include athletes’ and officials’ images, video, and audio, names and identifying information associated with footage, and event, performance, or scoring data linked to an identifiable individual; coaches and others may appear incidentally. You must have the rights and consents described in Section 5.6 of the Terms and must not upload Prohibited Data (Section 5.7 of the Terms), such as health information, government identification numbers, or payment card numbers.

2.4 Members’ own information

1. (a)Members’ own information. Information about a Member that the Platform generates, such as the Member’s name, email address, role, sign-in events, the prompts and chat messages the Member types, Watches and Live Sources the Member creates, and activity within the Organization, is information we collect about the Member. We are the controller of the Member’s account, usage, and billing information. Prompts and other content that a Member submits to the Organization’s workspace are Customer Content of the Organization.
2. (b)What your Organization can see. Members of an Organization can generally view Customer Content and Output within that Organization, including Live Source connection details, and Administrators may be able to see usage, billing, and Member activity and to add or remove Members. If you join an Organization using your own email address, your Administrators may see your account information and activity in that Organization, may be able to remove your access, and may receive information about you from us as described in Section 7.3 of this Notice. Content you create in an Organization’s workspace may be retained or deleted by the Organization (Section 12.6 of the Terms).

2.5 Job applicants

If you apply for a job with Owl, we collect through our applicant tracking system: identity and contact details; your resume and work history; links and portfolio materials you provide; our communications with you; interview notes and assessments; and references. We use this information to evaluate your candidacy, communicate with you about your application, comply with legal obligations, and improve our recruiting.

We keep applicant information for up to two (2) years after the application process ends, unless you are hired or the law requires us to keep it longer. We do not sell or share job applicants’ Personal Information, as those terms are defined under the CCPA. Depending on where you live, the state-law rights described in Section 10 apply to this information. To ask a question or exercise a right, contact privacy@owl.ai.

2.6 Information we do not intend to collect

We do not intend to collect biometric identifiers or biometric information (Section 6), and you shall not submit the categories of Prohibited Data listed in Section 5.7 of the Terms. Except as stated in Section 6 and in the sensitive Personal Information discussion in Section 10.1(e), we do not knowingly collect sensitive Personal Information about our account holders. If you or your Organization submit content that includes it, our rights and your responsibilities are those the Terms describe.

5.1 Which AI providers process which information

The Services are built on artificial intelligence, and Owl’s own models improve by learning from the content the Services process. The current list of providers is in the Subprocessor List at owl.ai/subprocessors.

5.2 What our AI providers do not do

Owl’s agreements with, and account settings at, its AI providers are configured so that those providers do not use Customer Content to train their own models. Our providers may retain and process Customer Content for as long as necessary to provide their services to Owl, secure their systems, detect and prevent abuse, and comply with law. We do not control changes a provider makes to its own terms or practices; we update the Subprocessor List and this Notice if a change affects your information. Our providers’ use of your information is also subject to their own terms and privacy policies.

5.3 What Owl does with Customer Content and Output

Owl itself trains on Customer Content and Output. You grant Owl, through the Terms (and, for customers with a master services agreement, through that agreement), the Training License (defined in Terms Section 5.3): a license to access, use, reproduce, store, retain copies of, process, analyze, and create derivative works from Customer Content and Output, including uploads, streams, prompts, Live Context, transcripts, and feedback, to develop, train, test, validate, evaluate, and improve Owl’s and its affiliates’ products, services, technology, and machine learning models, including products and services provided to other customers. This is true whether you are an Individual User or an Organization Customer, unless you are an Organization Customer whose Customer Agreement says otherwise. This use can involve Personal Information about the person who submitted the content and about people who appear in it. The Training License continues until you delete the Customer Content, close your account or Organization, or opt out (Section 5.6), except that rights in models, weights, parameters, and training artifacts already trained or created survive except as prohibited by applicable law (Section 5.4).

The Training License has limits. In exercising it, Owl will not (i) disclose or make available Customer Content to any third party, other than providers acting on Owl’s behalf; (ii) generate or make available any output that reveals or reproduces Customer Content; or (iii) identify you as a source of Customer Content, except as the Terms expressly permit.

5.4 Deleting content does not untrain a model

When you delete content or close your account, we delete the content from our active systems and backups on the timelines in Section 8. Deletion does not retrain, roll back, or remove the effect that the content has already had on a trained or improved model. Models and other improvements may retain information learned from the content after the content is deleted, and Owl is not required to retrain, roll back, or delete any model, model weight, or parameter, except as applicable law requires or as a regulator with authority over Owl directs. We design our training so that models are not intended to store or reproduce identifiable individuals’ content, and content that is deleted or opted out is excluded from training datasets assembled after the deletion or opt-out.

5.5 Biometric carve-out

Owl will use biometric identifiers or biometric information that is included in Customer Content, or that Owl processes to extract or generate from Customer Content, solely to provide the Services to you, and will not use it to develop or improve any other product or service, unless that data has first become De-Identified Data. As Section 6 explains, the Services are not designed to collect biometric data in the first place.

5.6 How to limit this use

• Organization Customers have no account-level opt-out and may obtain an exclusion from the Training License through a Customer Agreement signed by Owl. Any exclusion applies prospectively.
• Individual Users can limit this use by not uploading or typing content they do not want used. This use is on by default unless you turn it off. You can turn off use of your Customer Content for model training in your account settings; the setting applies prospectively.
• Privacy-law requests. Depending on where you live, you may have rights to object to, opt out of, or limit certain uses of your Personal Information, including profiling, or for training. If you make a request under Section 10 or Section 11 relating to this use, we will evaluate it under the applicable law and tell you the result. Where applicable law grants you rights over this use, Owl will honor them as that law requires. If we do not act on your request in full, we will explain why.
• People who appear in content submitted by someone else may ask us to exclude the affected content (or segments of it) from future training datasets whether or not they have an account, by contacting privacy@owl.ai (Sections 6.4 and 9.5). We implement verified requests by excluding the affected content from training datasets assembled after the request. We review requests beyond training exclusion, such as deletion, under Section 9.5. Where an Organization Customer submitted the content, they may also contact the Organization Customer, who decides what content to submit and holds the relevant consents (Section 1.2(b)).

5.7 Other model-related uses

Owl does not use Customer Content to build facial recognition templates or biometric databases. Owl may use Usage Data and Service Data, which exclude Operational Logs and do not generally include the content of Customer Content, to improve the Services. Operational Logs (logs that record Customer Content or the inputs to and outputs from AI models) are not Service Data; they are kept and deleted as Section 8 and Terms Section 12.3 state. We may also use feedback you provide, including Feedback Notes, to improve the Services, subject to the Terms.

6.1 Our policy

Owl does not configure or use the Services to perform facial recognition or to create or match face templates, and the Services are not designed to intentionally collect biometric identifiers or biometric information. Owl identifies athletes, officials, and other participants in Customer Content from roster, jersey number, position, and other contextual information, such as team information, that customers or the competition supply. Owl does not create face or voice templates or voiceprints, and does not perform speaker identification. The Terms prohibit users from instructing or configuring the Services to perform facial recognition or to collect biometric data (Terms Section 6.1).

Because customers choose the content and instructions they give the Services, and because laws in some states define “biometric identifiers” or “biometric information” broadly (including, in some laws and in the Terms, gait or movement-pattern data and, under some laws, pose data derived from video, reasonably capable of identifying a specific individual), it is possible that a customer’s content or instructions could cause the Services to derive data that qualifies as biometric under some laws. Where derived data qualifies, Owl treats it in accordance with this Section 6. This Section is Owl’s publicly available written policy for any such data, whether or not the Services are designed to collect it. It applies to biometric data under the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, Washington’s biometric privacy law, Colorado’s biometric privacy law, and similar laws.

6.2 Retention schedule and destruction guideline

Biometric identifiers and biometric information, if any, and all analysis data derived from a video, are permanently destroyed when that video is deleted (including the index and embeddings held by our video-analysis provider), when the account or Organization is deleted, and in all events no later than three (3) years after creation. Destruction means deletion from active systems and removal from backups on the timelines in Section 8 (within 30 days and 90 days, respectively), and from systems of our providers consistent with our agreements with them.

6.3 Other commitments

• Consent. Customers represent in the Terms that they have obtained all required notices and releases, and Owl may decline to process content until it receives evidence of them (Terms Sections 5.6(e), 6.4, and 13.2). Customers are responsible for providing the notices and obtaining the written releases and consents that applicable biometric laws and any applicable collective bargaining agreement require.
• No sale, lease, or trade. Owl does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.
• Limited disclosure. Owl does not disclose or disseminate biometric identifiers or biometric information except (i) with the consent or authorization of the individual or the individual’s legal representative, (ii) to complete a financial transaction the individual requests or authorizes, or (iii) where required by law or valid legal process. Providers that process this data for Owl act as processors on Owl’s behalf under written contracts, and that processing is not a disclosure to a third party.
• Limited use. Biometric data, if any, is used solely to provide the Services to the customer that submitted it and is not used to develop or improve other products or services unless first de-identified (Section 5.5). Owl does not intend any model weight, parameter, or training artifact to constitute or contain biometric data.
• Security. Owl protects biometric identifiers and biometric information using reasonable administrative and technical safeguards, with at least the care Owl uses for its other sensitive information of like kind or sensitivity.

6.4 Questions and requests

To ask about this policy, or to request deletion of biometric data, contact privacy@owl.ai. Individuals whose biometric data may appear in an Organization Customer’s content should also contact that customer (Section 1.2(b)).

7.1 Service providers and subprocessors

We disclose Personal Information to Third-Party Providers that host, operate, secure, and support the Services, who may use it only to provide services to us and under written agreements that require appropriate protection. As of the date of this Notice they include those parties set forth on the Subprocessor List. We may update the Subprocessor List on at least thirty (30) days’ notice before a new provider begins processing Customer Content, except where an immediate change is needed for security, legal compliance, or continuity of the Services.

7.2 AI providers

Our AI providers are service providers that process Customer Content and related information to provide their services to Owl.

7.3 Organization Customers

If you are a Member of an Organization, we share information about you with that Organization, including your name, email address, role, account status, and activity, usage, and OIU consumption records in the Organization’s workspace, and the content you submit there. We share this with the Organization’s Administrators and other Members as the Platform’s permissions allow. If you use the Services as an Individual User, we do not share your content or account information with any Organization unless you choose to share it, for example by exporting or sending a clip.

7.5 Affiliates

We may disclose Personal Information to our current and future affiliates, who will use it consistent with this Notice.

7.6 Legal, regulatory, and safety reasons

We may disclose Personal Information if we believe in good faith that doing so is necessary to comply with law, regulation, legal process, or a governmental request; to enforce the Terms; to detect, prevent, or address fraud, security, or technical issues; to respond to claims by rights holders or others, including notices under the Digital Millennium Copyright Act; or to protect the rights, property, or safety of Owl, our users, or the public.

7.7 Business transfers

If Owl is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, Personal Information may be disclosed in diligence and transferred to the successor, subject to this Notice or equivalent protections. We will provide notice if a transfer will cause your Personal Information to be governed by a materially different privacy notice.

7.8 De-Identified Data; third-party licensing of insights

We create and use De-Identified Data, which is data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual or to our customer. We commit that we will apply technical and organizational measures consistent with generally accepted industry practice and applicable law to De-Identified Data, will maintain this public commitment not to attempt to re-identify it, and will not attempt to re-identify it, except as reasonably necessary to test the effectiveness of our de-identification measures. We use, disclose, and commercialize De-Identified Data and aggregated statistics for any lawful business purpose, in a form that does not identify you, any Member, or any other individual. Owl will contractually obligate any recipient of De-Identified Data not to attempt to re-identify it and to comply with this commitment. Owl does not license insights derived from Customer Content to third parties (Terms Section 5.9(c)). Once data has been de-identified, privacy law and this Notice’s rights sections do not apply to it.

7.9 With your consent or at your direction

We disclose Personal Information to other parties when you ask us to or consent to it, for example when you connect a Live Source or integration or ask us to share information with a named recipient. Content you share and Output you distribute are disclosed at your direction.

9.1 Account settings

You can review and update your account information, manage your Organization membership, and, where offered, manage Billing Options and cancel a Subscription in your account settings. Sign-in options and security settings, including multi-factor authentication where available, are managed through our identity provider.

9.2 Deleting content, your account, or your Organization

• Videos and conversations. You can delete Videos and, where the Platform offers the option, conversations in the Platform. Deleted Videos follow the timeline in Section 8.
• Other inputs. To request earlier deletion of prompts, context, logs, and transcripts, or deletion of your account or Organization, contact support@owl.ai or privacy@owl.ai from the email address on the account. We may require verification of identity and authority. An Organization’s Administrator can delete the Organization.
• Limits. Section 5.4 and Section 8 describe what deletion does not reach. Download any clips and exports you want to keep before deleting. Deleting your account cancels any Subscription (Terms Section 9.2).
• Organizations. Customer Content that an Organization controls is deleted at the Organization’s direction. If you are a Member, your Administrator may be able to delete or retain content you created.

9.3 Marketing communications

You can opt out of marketing emails at any time by clicking “unsubscribe” in any marketing email or by emailing privacy@owl.ai. You will still receive transactional and account-related messages, such as receipts, security notices, renewal and billing notices, and notices of changes to the Terms or this Notice.

9.4 Cookies and tracking

See Section 12 for cookie controls and the opt-out mechanisms available to you.

9.5 Access, correction, and other rights

Depending on where you live, you may have the rights described in Section 10 (U.S. states) or Section 11 (EEA, UK, and Switzerland). Where applicable law grants you rights over your Personal Information, we will honor them as that law requires. Anyone may submit a request to privacy@owl.ai, and we will review it consistent with applicable law. If you are a Member or you appear in an Organization Customer’s content, see Section 1.2(b) for where to send your request.

9.6 Limiting AI-related uses

See Section 5.6.

10.1 California

This Section 10.1 is our notice at collection and privacy policy for California residents under the CCPA, as amended by the California Privacy Rights Act (CPRA). For Section 10.1, “you” means a California resident. This notice at collection is also linked from the sign-in page and from forms on the Site.

(a) Categories of Personal Information collected, sources, purposes, and disclosures in the past 12 months.

We do not collect categories of Personal Information described in Cal. Civ. Code § 1798.80 or the CCPA that are not listed above, such as protected-classification characteristics, education information, or health information, except to the extent a customer’s content or an individual’s description in a support message includes it, or except that Output may depict competition division or category information such as age group or gender provided by the customer (Terms Section 5.7(d)). We do not knowingly collect Personal Information of California residents under 16 as account holders (Section 14).

(b) Business and commercial purposes. We use and disclose Personal Information for the purposes in Section 4. Under the CCPA, these include performing services, auditing, security and integrity, debugging, short-term transient use, internal research, quality and safety maintenance, and verifying or maintaining the quality of the Services.

(c) Retention by category. Section 8 states how long we keep each category. Where Section 8 states a period by data type rather than by CCPA category, the period for the CCPA category is the longest period that applies to the data in it, except as the criteria in Section 8 require otherwise.

(d) “Sale” and “sharing.” In the preceding 12 months, we have not sold Personal Information for monetary or other valuable consideration and have not shared Personal Information for cross-context behavioral advertising, as those terms are defined by the CCPA. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16. We do not sell or share Customer Content. Where Owl uses Customer Content for its own purposes under Section 5, it does so as a business/controller, and the Organization Customer is responsible for its own notices. Our use of Customer Content for model training is described in Section 5.

(e) Sensitive Personal Information. We collect the sensitive Personal Information listed above only to provide and secure the Services and for other purposes permitted under the CCPA regulations (Cal. Code Regs. tit. 11, § 7027(m)), and we do not use or disclose it to infer characteristics about you.

(f) Your California rights. Subject to exceptions, you have the right to:

• know the categories and specific pieces of Personal Information we have collected about you, the sources, the purposes, and the categories of recipients;
• delete Personal Information we collected from you;
• correct inaccurate Personal Information;
• opt out of the sale or sharing of your Personal Information (see paragraph (d));
• limit the use and disclosure of sensitive Personal Information in certain circumstances (not applicable, per paragraph (e));
• receive your Personal Information in a portable format; and
• not be discriminated against for exercising your rights. We will not deny you the Services, charge you different prices, or provide a different level of quality because you exercise your rights, except as the CCPA permits (for example, if we cannot provide a service without the information you ask us to delete).

We do not offer a financial incentive or price or service difference in exchange for Personal Information.

(g) How to submit a request; verification; authorized agents. Email privacy@owl.ai. We will verify your request by matching information you provide to information we hold, and for requests to delete or to know specific pieces of information we may require additional verification. If you have an account, we may require you to submit the request through it. An authorized agent may submit a request for you with your signed permission, and we may require you to verify your identity directly with us and confirm the agent’s authority. We will confirm receipt within 10 business days and respond within 45 days, and we may extend by up to another 45 days with notice to you. If we deny a request, we will explain why, to the extent the CCPA permits.

(h) Global Privacy Control. We honor opt-out preference signals, such as the Global Privacy Control, as an opt-out of sale or sharing where the law requires.

(i) “Shine the Light.” California Civil Code § 1798.83 permits California residents to ask for certain information about disclosures of Personal Information to third parties for their direct marketing purposes. We do not disclose Personal Information to third parties for their direct marketing purposes.

10.2 Colorado

This Section applies to residents of Colorado under the Colorado Privacy Act (CPA) and its rules.

Rights. Colorado residents have the right to: access the Personal Information we hold about them; correct inaccuracies; delete it; obtain it in a portable format; and opt out of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Profiling. Owl does not engage in profiling of Individual Users or Members in furtherance of decisions that produce legal or similarly significant effects. The Services generate AI Output about participants in sports content, and our customers may use it, but Owl does not use it to make such decisions about those individuals, and the Terms require our customers to apply human oversight. If you believe you have been subject to such profiling, you may opt out by contacting privacy@owl.ai.

Sensitive data. We do not intentionally process sensitive data, as the CPA defines it (including biometric data used for the purpose of uniquely identifying an individual). Content submitted by customers may include images of children and, incidentally, data revealing racial or ethnic origin. We do not use such data to infer sensitive traits. Owl does not knowingly use content depicting minors for model training, and the Terms bar minors as subjects of analysis on the self-serve Platform (Terms Section 6.3).

Targeted advertising and sale. We do not engage in targeted advertising or the sale of Personal Information.

Making and responding to requests. Submit requests as Section 10.1(g) describes. We will respond within 45 days, extendable by 45 days with notice. You may make a request free of charge up to twice per year. If we decline to act, we will tell you why, within 45 days.

Appeals. If we decline to act on your request, you may appeal within a reasonable period by emailing privacy@owl.ai with the subject line “Privacy Appeal,” identifying the request and the reasons you disagree. We will inform you in writing of our decision within 45 days of receipt of the appeal (which we may extend by 60 days where reasonably necessary) with a written explanation. If we deny the appeal, you may contact the Colorado Attorney General at coag.gov/file-complaint.

10.3 Other states

Residents of Virginia, Connecticut, Texas, Oregon, Montana, Utah, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, and of any other state whose comprehensive privacy law takes effect after the date of this Notice, may have rights under their state’s law similar to those described in Section 10.2, which may include rights to confirm whether we process their Personal Information and access it; correct it; delete it; obtain a portable copy; opt out of targeted advertising, sale, and certain profiling; and, in some states, obtain a list of the categories of third parties to which we disclose Personal Information and be informed of the specific third parties. Minnesota and certain other states also give residents rights concerning profiling and the right to question the result of profiling. Submit requests as Section 10.1(g) describes. We will respond within the period your state’s law requires, generally 45 days (extendable by 45 days), and subject to the exceptions in your state’s law.

Appeals. If we deny your request, you may appeal by emailing privacy@owl.ai with the subject line “Privacy Appeal,” explaining why you disagree. We will respond in writing within the period your state requires (generally 45 to 60 days), and if we deny the appeal, we will explain why and tell you how to contact your state attorney general or other regulator.

10.4 Other state-specific notices

• Nevada. Nevada residents may opt out of the “sale” of certain covered information as Nevada law defines it. We do not sell covered information.
• Washington (My Health My Data Act). We do not intend to use the Services to infer health conditions.
• Biometric laws. Illinois, Texas, Washington, and other states have laws specific to biometric data. See Section 6.

10.5 AI-training and your state rights

Section 5 describes our use of Customer Content and Output for training. State laws that give you the right to delete, to opt out of profiling, or to limit certain processing apply to that use as they apply to any other use for which Owl is the controller. See Section 5.6. We will tell you the outcome of your request, including any exception we rely on.

11.1 Roles

Owl AI, Inc. is the controller of the Personal Information described in Section 1.2(a) and (c) and the processor of Customer Content described in Section 1.2(b).

11.2 Legal bases

Where we rely on legitimate interests, you can object (Section 11.3). We do not intentionally process special categories of Personal Information or biometric data for the purpose of uniquely identifying a person (Section 6).

11.3 Your rights

Subject to the exceptions in the law, you have the right to: access your Personal Information; have inaccurate information corrected; have it erased; restrict processing; receive it in a portable format; object to processing based on legitimate interests (including for profiling and for direct marketing, which we will stop on request); withdraw consent at any time (without affecting earlier processing); and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. To exercise a right, contact privacy@owl.ai. For Personal Information we process as a processor, contact the relevant Organization Customer. We will respond within one month, extendable under the law. We may need to verify your identity.

11.4 International transfers

We are based in the United States and host the Services in the United States. If you are in the EEA, the UK, or Switzerland, your Personal Information will be transferred to and processed in the United States and, through our providers, other countries. Where required, we rely on a transfer mechanism recognized by law: the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum or the UK’s International Data Transfer Agreement, and Swiss amendments, in our agreements with providers and customers.

11.5 Representatives

Owl will appoint EU and UK representatives before offering the Services in those regions; their details will appear here. Owl has not appointed a data protection officer. Contact privacy@owl.ai for data protection matters.

11.6 Complaints

You have the right to complain to your local supervisory authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch); and in the EEA, the authority in your country of residence, work, or the alleged infringement. We encourage you to contact us first so that we can try to resolve your concern.

12.1 What we use

We and our providers use cookies, pixels, local storage, and similar technologies on the Site and the Platform. They fall into the categories below. The current cookie-by-cookie list, with each cookie’s provider, purpose, and lifespan, is maintained by Owl and is available at owl.ai/cookies; the categories below summarize it.

12.2 Your choices

• Cookie settings. Where required by law, a cookie banner appears the first time you visit the Site and lets you accept or reject non-essential cookies. You can change your choice at any time through the cookie banner or cookie settings on the Site.
• Regional defaults. When you visit the Site or Platform, analytics and functional cookies may load by default. They do not load before you consent if you are in a region where consent is required before non-essential cookies are set (the European Economic Area, the United Kingdom, Switzerland, and similar regions) or if we cannot determine your region. In those cases, nothing non-essential is set until you consent.
• Browser controls. Most browsers let you block or delete cookies. Blocking strictly necessary cookies may stop the Platform from working.
• Opt-out preference signals. We honor opt-out preference signals, such as the Global Privacy Control, as an opt-out of sale or sharing where the law requires. Because we do not sell or share Personal Information, the signal does not change our data practices. We do not respond to “Do Not Track” browser signals because there is no common standard for them.

We do not use cookies or similar technologies in the Platform to track your activity on third-party websites or to build profiles of Customer Content.

Strictly necessary cookies are always on. Declining analytics or functional cookies does not affect your access to the Services, but we may not be able to remember your preferences, and some measurement of Site performance will be unavailable. Third-party tools set their own cookies under their own privacy policies.