VEFGALDUR / MÁRI

Privacy policy

Version 1.0 · Updated 8 October 2026.

This policy describes how Vefgaldur processes personal data on its website and in the Mári service. We update it when the service or confirmed information about processing changes. The policy provides information; it is not a request for blanket consent to all processing.

1. Who is responsible?

Vefgaldur and Mári are operated by Valur Smári Þórðarson, Icelandic ID no. 070874-5209, Smárahlíð 18i, 600 Akureyri. Enquiries and requests to exercise your rights can be sent to mari@vefgaldur.is or you can call 612 2012.

Vefgaldur is the controller for its own business communications, enquiries on vefgaldur.is, invoicing and operation of its own access and security systems. When Mári operates on another business’s website, that business is generally the controller for visitors’ conversations and enquiries. Vefgaldur processes those data on its behalf under a data processing agreement. That business’s privacy policy provides further information about this use.

2. What data do we process and why?

• Enquiries, quotations and services: name, email address, phone number if provided, business name, website address and messages you send. We use these to respond, prepare quotations and provide services. Where you are the contracting party, necessary processing is based on the contract or steps taken at your request before entering into a contract. Communications with business contacts and general enquiries are based on legitimate interests in responding to enquiries and conducting business.
• Conversations with Mári: messages, responses, timestamps, the associated business and technical visitor and conversation identifiers. These enable us to respond, maintain context and protect access to a conversation. On our own website, this assistance is based on legitimate interests in serving visitors. On a customer’s website, the customer determines the appropriate legal basis.
• Recorded enquiries: contact details you provide, a description of the enquiry and its status. These are used to follow up. The description may include a summary of a conversation and may be emailed to the relevant business.
• Access and security: administrator email addresses, associated business, invitations, login links, sessions and technical operational information. Processing is based on legitimate interests in providing access to the right people, protecting data and preventing misuse.
• Payments and accounting: customer identifiers, orders, amounts, payment status and invoice information. We process these for contractual purposes and to meet accounting obligations. The payment service receives card details when that payment method is used.
• Website operation and analytics: hosting may log IP addresses, timestamps, URLs and error information for security and operational purposes. We also use Koko Analytics to count total page views, without an analytics cookie or identification of individual visitors.

Data primarily come from you, the business providing your access, use of the service and payment services. Customers also provide knowledge content for their assistant, including from their websites; this may contain public professional and contact information. If you do not provide necessary contact details, we may be unable to respond to your enquiry or create access. Do not send passwords, card details or unnecessary sensitive personal data to Mári.

3. Artificial intelligence and access to information

Mári sends relevant questions, conversation context and knowledge content to OpenAI to process text and generate answers. AI can make mistakes. We do not use Mári to make automated decisions about individuals that have legal effects or similarly significant effects. Contact the business to confirm important information.

Staff and administrators with a service-related need may have access to information. Each customer can see conversations and enquiries belonging to its business. Technical service providers process data to the extent required by their role:

• FlokiNET: hosting of Vefgaldur’s WordPress website and related email services. Vefgaldur’s web hosting is in Iceland.
• Supabase: Mári’s database. The project is hosted in a region in Ireland. Support, security processing and other service functions may involve processing outside that region.
• Vercel: hosting and operation of Mári and its dashboard, including operational logs.
• OpenAI: AI processing. Data may be processed outside the EEA. A setting that does not store response state does not mean that the provider retains no data.
• Straumur and relevant payment providers: processing payments when that method is used. They may also act as independent controllers for their own legal obligations.

We use data processing agreements for processing on our behalf. We do not claim that all data or all access to them remain within the EEA. Transfers outside the EEA require an appropriate legal basis and safeguards, such as an adequacy decision or the European Commission’s standard contractual clauses and appropriate supplementary measures. Information and a copy of relevant safeguards can be requested from mari@vefgaldur.is.

4. How long do we retain data?

• Conversations in Mári’s operational database: 30 days from the last message. Deletion is carried out by a scheduled task after the period expires. This rule is configured for all current businesses; the implementation grace period ends on 8 October 2026 at 19:57. The task runs hourly and failures may delay deletion.
• Resolved or withdrawn enquiries in Mári: 30 days from being marked resolved or withdrawn. Unresolved enquiries remain for as long as they are needed and must be reviewed regularly. Deleting a conversation does not automatically delete a separate enquiry or its summary.
• Email and enquiries from the WordPress website: are not subject to automatic conversation deletion. Retention depends on whether an enquiry is still being handled, an active business relationship and the need to document a contract, rights or a dispute. Information must be removed when no such need or legal obligation remains. Copies in a customer’s mailbox are the customer’s responsibility.
• Access and contract data: while access or the contract is active, and afterwards only to the extent necessary for security, settlement, legal claims or legal obligations. An expired login link or session does not automatically mean that every related database record has been deleted.
• Accounting records: are retained under accounting law, generally for seven years from the end of the relevant financial year. They are not deleted with conversations.

Service provider backups and logs

Deletion from the active database does not mean immediate deletion from all backups or logs. Our confirmed information is as follows:

• FlokiNET: daily web hosting backups cover the preceding seven days, are stored in the same location as the web hosting, and data in them are permanently removed when that period expires. For Vefgaldur, that location is Iceland. Operational logs are replaced within 30 days by default.
• Supabase: a Pro subscription provides access to the last seven days of daily backups. We have not received confirmation that this is also the maximum retention period for all internal recovery copies. Supabase has confirmed that internal logs may be retained for up to 365 days for security, reliability and abuse prevention. We await further confirmation of what personal data these logs may contain.
• Vercel: accessible operational logs in the current setup have a 30-day retention period. This is not a confirmed maximum for all internal Vercel security or service data.
• OpenAI: standard API abuse monitoring logs may be retained for up to 30 days, with exceptions under the service’s rules and applicable law. No specific zero-retention exception has been confirmed for Mári.

These unconfirmed limits are therefore not presented as a promise to delete all copies within seven or 30 days. We update this section when further confirmation is received. If you need to know the exact scope before sending information, please contact us.

5. Cookies and browser storage

Login uses necessary cookies to manage access. Mári uses local browser storage for technical visitor and conversation identifiers to associate messages with the correct conversation. Conversation text is not saved in that local storage, but may remain visible in an open chat window. Identifiers may remain in the browser until removed or browser data are cleared; 30-day deletion on the server does not remotely clear your device.

Koko Analytics is configured for simple page-view counting without an analytics cookie and without identifying individual returning visitors. You can clear cookies and browser storage in your browser settings, but this may interrupt login or conversation context.

6. Your rights

Where the legal conditions are met, you may request access, a copy, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it without affecting the lawfulness of previous processing.

Send requests to mari@vefgaldur.is and specify the service or business concerned. We may need proportionate additional information to verify your identity; do not send copies of identity documents without being asked. We respond without undue delay and generally within one month. If the law allows an extension because of scope or complexity, we explain the extension and reason within that month.

If your request concerns a conversation on another business’s website, you should generally contact that business. We assist it in handling the request. You may lodge a complaint with the Icelandic Data Protection Authority.

7. Updates

The latest version is published here with its date. Where necessary, we notify important changes appropriately, for example on the website or by email to customers, before new or changed processing begins. Updating the policy does not replace a required legal basis, consent or data processing agreement.

See also Mári’s service terms.