Privacy Policy
Last updated: October 5, 2026
Data Controller: Stefán Freyr Margrétarson
Contact: alerts@icelandroads.com
Supervisory Authority: Persónuvernd (Icelandic DPA)
1. Data We Collect
| Category | Data | Purpose (lawful basis) |
|---|---|---|
| Free email alerts | Email, alert type, road or region, optional trip dates, when you gave consent | Send the alerts you asked for (Consent, Art. 6.1.a) |
| Trip Pass purchase record | Order number, email, the trip dates you bought, pass type (7 or 14 days), currency and amount paid, and the time you agreed at checkout that the pass starts immediately | Record of the sale, support and refunds (Contract, Art. 6.1.b; Legal obligation, Art. 6.1.c, accounting) |
| Trip Pass itinerary | Email, trip dates, your stops for each day with arrival and departure times, where you sleep, the trip name and roads you enter, per-day alert settings, whether the pass is active, paused or cancelled, and the road and region alerts we derive from your route | Send the morning briefs and route alerts you paid for (Contract, Art. 6.1.b) |
| Feedback form | The message you write, the kind of feedback you pick, the date and time, your email only if you choose to give one, the address of the page you were on (prefilled, and you can edit or clear it; we cut off anything after the page address, such as a query string or a link fragment), the owner's own triage status and note on your message, and the first part of your browser description. No location and no analytics identifier is attached | Read and act on what you send, and reply if you gave an email (Legitimate interest, Art. 6.1.f; Consent, Art. 6.1.a, for the optional email) |
| Payment details | None held by us. Card and billing details go to Paddle, who sells the Trip Pass (see section 3). We never see or store card numbers | Not applicable |
| Technical | IP address, request time | Rate limiting and abuse prevention by Cloudflare; we do not store them (Legitimate interest, Art. 6.1.f) |
| Analytics (PostHog) | Pages viewed, referrer, country, device type, page-speed measurements, and Trip Pass funnel events (for example "checkout started", "brief sent") | Understand which pages and features help (Legitimate interest, Art. 6.1.f) |
| Analytics (Google) | Pages viewed, with your IP address anonymised | Same purpose, only if you click Accept on the banner (Consent, Art. 6.1.a) |
No sensitive data (health, biometrics) is collected.
How analytics works here. PostHog is hosted in the EU and reached through our own domain, so your browser only talks to icelandroads.com. It runs cookieless and in memory only: no identifier is stored on your device, so a later visit is not linked to an earlier one. Server-side Trip Pass events carry a keyed hash of your email in place of the address, so a purchase and its briefs can be counted together; PostHog never receives the address, and the hash cannot be reversed without a secret key that only our server holds. Google Analytics is not loaded at all unless you accept it on the banner.
2. How We Use Your Data
- Send alerts you explicitly requested
- Daily forecast digests, if you asked for one
- For Trip Pass holders: build and send the morning brief for each planned day, and alerts for the roads and regions on your route
- Manage your subscriptions and your pass (dates, pause, cancel)
- Service communications (critical changes only)
- Read the feedback you send, and answer it if you left an email address (a copy of each message is also emailed to us)
- Aggregate analytics to improve coverage
We do NOT: sell data, share with advertisers, or use for unrelated marketing.
Buying a Trip Pass does not sign you up to marketing. The newsletter is a separate opt-in with its own confirmation email.
3. Data Sharing
| Recipient | Role and purpose | Safeguards |
|---|---|---|
| Paddle.com | Merchant of record for the Trip Pass: Paddle is the seller, takes the payment, charges any sales tax, issues the receipt and handles refunds. For that it is an independent controller under its own privacy notice. We send Paddle your email, the trip dates and pass type; Paddle tells us the order number, amount and currency | Paddle's own privacy notice and buyer terms |
| Cloudflare | Processor: hosting, the database that holds alerts, passes and itineraries, and email delivery (Cloudflare Email Sending) | DPA |
| PostHog (EU) | Processor: analytics, proxied through our domain | DPA, EU hosting |
| Google Analytics, only after you accept it on the banner | Google's data processing terms |
4. Data Retention
- Unconfirmed free alerts: 30 days, then deleted automatically
- Confirmed free alerts: until you unsubscribe, plus 30 days
- Trip Pass itinerary and its alerts: deleted automatically 90 days after the last day of your trip (or 90 days after the pass is cancelled), or straight away when you use "Delete my trip data" on your trip page
- Trip Pass purchase record: 7 years, because Icelandic accounting law requires records of sales to be kept. It holds no itinerary, and it is kept even if you delete your trip data
- Feedback messages: kept until we delete them. Email us to have yours removed, within 30 days (we delete the row outright, together with any note we added)
- Analytics: as configured in PostHog (see PostHog's EU data processing terms) and, if you accepted it, in Google Analytics
5. Your Rights (GDPR)
| Right | How to Exercise |
|---|---|
| Access | Email us - JSON export within 30 days |
| Rectification | Manage page, your trip page, or email us |
| Erasure | Trip Pass: "Delete my trip data" under "Your pass" on your trip page deletes the itinerary and its alerts at once. Anything else: email us, deleted within 30 days. The purchase record is kept for the accounting period above |
| Portability | JSON export via access request |
| Withdraw consent | Unsubscribe link in any free alert email; "Cookie settings" in the footer for Google Analytics |
| End a Trip Pass | Pause or cancel from your trip page; this ends the service, which is a contract rather than consent |
Complaints: Persónuvernd, Rauðarárstíg 10, 105 Reykjavík
6. Security
- Cloudflare Workers (ISO 27001), D1 encrypted at rest
- Payments are taken by Paddle on its own checkout; no card data ever reaches our servers
- Rate limiting, no passwords: your trip page is opened by the private link in your confirmation email
- Annual security review
7. Cookies and Device Storage
| Name | Purpose | Consent |
|---|---|---|
| __cf_bm | Bot management (Cloudflare cookie) | Strictly necessary |
| ir-analytics-consent | Remembers your answer to the analytics banner (browser storage) | Strictly necessary |
| tripPassSession, tripPassDraft | Trip Pass only: reopens your trip and keeps unsaved edits on this device (browser storage, never sent to us on its own) | Strictly necessary |
| _ga, _ga_* | Google Analytics cookies | Only after you click Accept on the banner |
PostHog sets no cookie and stores nothing on your device.
No third-party marketing cookies.
8. Children
Service not directed at children under 13. We do not knowingly collect their data.
9. Contact
Data Controller: Stefán Freyr Margrétarson
Email: alerts@icelandroads.com
DPO: Not required (small scale)