Privacy notice
Last changed 30.09.2026
1. Two roles
Einyrkinn handles personal data in two ways. For the data it needs to run your account it is the controller, and this notice describes that data. For the records your business keeps in Einyrkinn, such as invoices and clients, the business is the controller and Einyrkinn its processor, on the terms in section 6 of the terms of service.
2. What Einyrkinn processes, and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email address, password (stored only as a hash), language | To give you an account and send you the emails it needs | Contract, Art. 6(1)(b) |
| Signed-in sessions: IP address, browser and device, and when you signed in | To keep your account secure and let you sign out other devices | Legitimate interest, Art. 6(1)(f) |
| The CAPTCHA answer and your IP address on the sign-up and password-reset forms | To check that a person, not a script, is filling in the form | Legitimate interest, Art. 6(1)(f) |
| The business's name and kennitala, Einyrkinn's invoices to it and their payment | To bill the subscription and keep Einyrkinn's own accounts | Contract, and legal obligation under the Bookkeeping Act, Art. 6(1)(b) and (c) |
Einyrkinn uses no advertising or analytics, and sells no data. When you look up a client by kennitala, Einyrkinn asks Skatturinn's company register and uses only what it returns about that client: name, address, whether it is a person or an organisation, and whether it is bankrupt, insolvent or deregistered.
3. Who helps Einyrkinn
These processors work for Einyrkinn under contract. They process data only on Einyrkinn's instructions. Scaleway and Hetzner are also the sub-processors for the business's records.
| Processor | What for | Where |
|---|---|---|
| Scaleway SAS, France | Servers, the database, stored receipts, and sending email | EU (Paris) |
| Hetzner Online GmbH, Germany | Encrypted off-site backups | EU |
| Cloudflare, Inc., USA | The CAPTCHA (Turnstile) on the sign-up and password-reset forms, which sends the visitor's answer and IP address to Cloudflare to check they are a person | USA, under the EU–US Data Privacy Framework |
4. How long data is kept
- While the account exists, its data is kept, even if it is not used. Einyrkinn does not close dormant accounts.
- When you close the account, the account and all of the business's data are deleted irreversibly, after you have downloaded the archive. You keep the archive; the terms describe what that means.
- Backups are kept for at most 30 days, so deleted data is gone from all of them no later than 30 days after closing.
- The closure receipt survives as a one-way hash of the code in its link and the time deletion finished, until 90 days after deletion. It identifies nobody.
- The email with the closure receipt, like any email Einyrkinn sends, stays in the email provider's records for a limited time after Einyrkinn has deleted its own copy of your address.
- Einyrkinn's billing records are kept for as long as the Bookkeeping Act requires Einyrkinn to keep them: seven years from the end of the accounting year.
5. Cookies
Einyrkinn sets a cookie to keep you signed in and one to remember your language. The CAPTCHA may set what it needs to do its check. There are no advertising or tracking cookies.
6. Your rights
You can ask for access to your data, for it to be corrected or erased, for its processing to be restricted, or object to it. The archive in Settings gives you all of the business's data in a portable form. If you believe Einyrkinn has handled your data wrongly, you can complain to the Data Protection Authority, Persónuvernd (personuvernd.is).
7. If you are a client of a business that uses Einyrkinn
The business that invoiced you is responsible for your data in its records. Contact it with any request. A request that reaches Einyrkinn is passed on to that business, because it may be obliged by law to keep the record.
8. Changes to this notice
Einyrkinn emails account holders before a change that matters to them takes effect, and updates the date at the top of this page.