Owlbert Privacy

This page explains what Owlbert collects, why, where it is kept and for how long. It applies to the Owlbert service at tools.ehrenbergbass.com, operated for the Ehrenberg-Bass Institute of Marketing Science. Effective 6 September 2026.

What we collect

Your name and work email, to keep the member list, and a personal access token that proves it is you.
What your AI assistant sends when it calls a tool: the marketing question, any plan text the assistant chooses to pass, and the category and brand numbers you give the Dirichlet model.
A request log for every call: time, your name, the tool called, how long it took, whether it succeeded, and the name of the assistant that called.
A question log holding the text of the questions your assistant put to Owlbert (only what is sent in a tool call, never the rest of your conversation). We keep it so the Institute can see what sponsors ask and improve the tool. It is on by default and switched off for your account on request; you can also ask your assistant not to record a particular question (the log then shows only that a tool was called, not what you asked).

Nothing else. Owlbert stores no files, no customer data and no payment data. Documents you share with your assistant stay with the assistant; Owlbert sees only what the assistant includes in a tool call.

Why we collect it

To provide the service to members, keep it reliable, and, unless you have asked us not to, to learn what sponsors ask so the Institute can add answers. We do not sell data, use it for advertising, or train models on it.

Where it is kept and who else sees it

Railway (United States) hosts the service and its encrypted storage. Railway holds SOC 2 Type II certification.
Voyage AI (United States) receives the question text only, to power the research search.
GitHub holds an off-site backup of the law cards and logs in a private repository. Access tokens are never written to it.
Your AI assistant's provider sees everything you type. That is governed by your own agreement with them, not by Owlbert.

We share data with no one else unless the law requires it.

How long we keep it

Request log and question log: 7 years from the date of the entry.
Your member record: for the life of your access plus 7 years.
The law cards and research content are the Institute's own material and are kept.

If your organisation's agreement needs a shorter period for its own questions, we delete those entries on request.

How it is protected

Connections use HTTPS only. Your assistant signs in through standard OAuth 2.1 and holds a short-lived token that expires within the hour. Access can be withdrawn instantly, and every call is checked and logged. Owlbert itself holds no SOC 2 or ISO 27001 certificate; its hosting does.

Your choices and contact

You can ask for a copy of your records, a correction, the question log to be turned off, or your record to be removed. Write to bill.page@marketingscience.info. If an incident affects your data we tell you within 72 hours of confirming it.