Privacy Policy

1. Introduction

Net Partner 011 AB (“we”, “us”, or “our”) operates the Tiny Owl observability platform, available at tiny-owl-kit.io (the “Service”). This Privacy Policy explains what data we collect, how we use it, how we protect it, and your rights as a user.

By using the Service, you agree to the collection and use of information as described in this policy.

2. Who We Are

Tiny Owl is a Software-as-a-Service (SaaS) observability platform that enables development teams to log, monitor, and analyse application events in real time.

3. Information We Collect

3.1 Account & Organisation Data

When you register, we collect:

• Email address — used for authentication, billing notifications, and support
• Name (optional) — displayed in the dashboard
• Organisation name — used to scope your workspace
• Password — stored as a bcrypt hash; never stored in plaintext

3.2 Event Data (Submitted by You)

When you use the Tiny Owl SDK or REST API to ingest events, we store:

• Event message — the log message you send
• Severity level — info, warning, or error
• Context metadata — key/value pairs you choose to include (e.g. user IDs, trace IDs, environment names)
• Timestamp — when the event was received
• Project association — which of your projects the event belongs to

3.3 Usage & Technical Data

• IP address — for security, rate limiting, and audit logging
• Browser/device user agent — for compatibility and security purposes
• Authentication tokens — stored as HTTP-only cookies; not accessible via JavaScript
• API key usage — which API keys are used, when, and from which IP addresses

3.4 Billing Data

For paid plans, billing is handled by Stripe. We do not store your credit card details. We receive from Stripe: subscription status, billing cycle and plan tier, invoice history, and payment success/failure notifications. Stripe’s privacy policy applies to payment processing: stripe.com/privacy.

3.5 Audit Log Data

The Service maintains a comprehensive audit log of all administrative and account actions, including login/logout events, project changes, API key operations, and role changes. Audit log entries include the acting user’s ID, role, IP address, user agent, timestamp, and the before/after state of changed resources.

4. How We Use Your Data

We do not sell your personal data to third parties. We do not use your event data for advertising or training AI/ML models without your explicit consent.

5. Data Retention

6. How We Protect Your Data

7. Data Sharing & Third Parties

8. Cookies, Analytics & Advertising

We use cookies and similar technologies in three categories. Strictly necessary cookies are always on. Analytics and marketing cookies are only set if you accept them in our cookie banner.

8.1 Strictly necessary

8.2 Analytics

With your consent we use Google Analytics 4 (Google Ireland Limited) and Microsoft Clarity (Microsoft Corporation) to understand how visitors use Tiny Owl, including page views, clicks and anonymised session recordings. The legal basis is your consent. Analytics data is not used for advertising. These providers may process data in the United States; transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

8.3 Advertising & conversion measurement

With your consent to marketing cookies we load the advertising tags of Google Ads, Meta (Meta Platforms Ireland Limited), Reddit (Reddit, Inc.), LinkedIn and X to measure whether our ads lead to sign-ups. We use them to attribute conversions and to optimise our campaigns, not to sell your data. The legal basis is your consent.

• What is shared: a sign-up event (with a random event identifier), the ad click identifier and, where the platform supports enhanced conversions and you consented, your email address, which the platform hashes before use.
• First-party attribution: when you create an account we store how you found us (UTM parameters, ad click identifiers, landing page, referring website) together with your cookie choices in our own database. Without marketing consent this is kept only for our own aggregated reporting (legal basis: our legitimate interest in understanding which channels bring sign-ups) and is never uploaded to advertising platforms. Advertising click identifiers are stored with your account record and are deleted when your account is deleted.
• Uploads: hashed email addresses are only sent to advertising platforms for users who consented to marketing.
• Transfers: these providers may process data in the United States. Transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

8.4 Browser storage

To remember where you came from until you sign up, we may keep a first-touch record in your browser’s session storage (key to_attribution) while you have accepted analytics or marketing. We also keep an identifier in local storage (to_signup_tracked) to avoid counting the same sign-up twice; it holds only a random event identifier. On withdrawal of consent the first-touch record is removed from session storage and the sign-up identifier is not used for any further tracking.

8.5 How to withdraw consent

You can change or withdraw your choices at any time with the Cookie Settings link in the page footer. Withdrawing marketing consent removes the advertising tags and the cookies set on our domain, and for signed-in users updates the consent we have stored for your account. Cookies that LinkedIn or X set on their own domains cannot be removed by our site; you can delete them in your browser settings. You can also contact us at info@np011.se.

9. Your Rights

Depending on your location, you may have the following rights:

• Access — Request a copy of the personal data we hold about you
• Rectification — Correct inaccurate or incomplete data
• Erasure — Request deletion of your personal data
• Portability — Receive your data in a machine-readable format
• Restriction — Request that we restrict processing of your data
• Objection — Object to processing based on legitimate interests
• Withdraw consent — Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at info@np011.se. We will respond within 30 days.

10. International Data Transfers

Our servers are primarily located in us-east-1 (AWS). If you access the Service from outside this region, your data may be transferred internationally. We ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses for EU/EEA transfers). For analytics and advertising providers (sections 8.2 and 8.3), transfers to the United States rely on the EU–US Data Privacy Framework or Standard Contractual Clauses, as described there.

11. Children’s Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@np011.se and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date, send an email notification to all registered account owners, and show an in-app notification banner. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

13. Contact

If you have questions, concerns, or requests regarding this Privacy Policy: