Privacy Policy
Last updated: August 2, 2026
Data Controller: Stefán Freyr Margrétarson
Contact: alerts@icelandroads.com
Supervisory Authority: Persónuvernd (Icelandic DPA)
1. Data We Collect
| Category | Data | Purpose |
|---|---|---|
| Watch registration | Email, watch type, target, dates | Send alerts (Consent - Art. 6.1.a) |
| Payments | None. We sell nothing and process no payments | Not applicable |
| Technical | IP (hashed), timestamps | Rate limiting (Legitimate interest) |
| Analytics | Page views, country | Improvement (Consent via banner) |
No sensitive data (health, biometrics) is collected.
2. How We Use Your Data
- Send alerts you explicitly requested
- Daily forecast digests, if you asked for one
- Manage your subscriptions
- Service communications (critical changes only)
- Aggregate analytics to improve coverage
We do NOT: sell data, share with advertisers, or use for unrelated marketing.
3. Data Sharing
| Recipient | Purpose | Safeguards |
|---|---|---|
| Cloudflare | Hosting, email | DPA, EU data centers |
| PostHog EU | Analytics | DPA, EU hosting |
4. Data Retention
- Unconfirmed watches: 30 days then auto-deleted
- Confirmed watches: Until unsubscribed + 30 days
- Analytics events: 13 months then auto-deleted
5. Your Rights (GDPR)
| Right | How to Exercise |
|---|---|
| Access | Email us - JSON export within 30 days |
| Rectification | Manage page or email us |
| Erasure | Email us - deleted within 30 days |
| Portability | JSON export via access request |
| Withdraw consent | Unsubscribe link in any email |
Complaints: Persónuvernd, Rauðarárstíg 10, 105 Reykjavík
6. Security
- Cloudflare Workers (ISO 27001), D1 encrypted at rest
- Payments are processed by Stripe (PCI-DSS compliant); no card data is ever stored on our servers
- Rate limiting, hashed IPs, no passwords (magic links only)
- Annual security review
7. Cookies
| Cookie | Purpose | Consent |
|---|---|---|
| __cf_bm | Bot management | Strictly necessary |
| posthog_* | Analytics (EU) | Opt-in via banner |
No third-party marketing cookies.
8. Children
Service not directed at children under 13. We do not knowingly collect their data.
9. Contact
Data Controller: Stefán Freyr Margrétarson
Email: alerts@icelandroads.com
DPO: Not required (small scale)