Privacy
Last updated: 11 October 2026
MyIceland is the trading name of Nökkvi Helgason, kt. 210798-2859 (Icelandic ID number), Vesturgata 53, 101 Reykjavík, Iceland. We decide how the personal data described here is used, so in the law’s words we are its controller. For any question or request, email info@myiceland.io.
This page covers our website www.myiceland.io, the Get started form and emails with us. It is for tour operators and anyone else who visits.
In short
- We ask before we measure how you use our site. Without your OK, we keep only what it takes to run the site and keep it safe, plus anonymous daily visit totals.
- We collect data to improve MyIceland, and this page lists all of it.
- If you sign up, we use your details to reach you and get you set up.
- No ads, no trackers from other companies, and we never sell your data.
When you visit
What every visit sends us. Like on any website, your browser sends your IP address, the name and version of your browser and system (the user agent), the page you ask for and the time. We and our host, Railway, use this to show you the site, keep it secure and fix problems. Railway keeps these logs for up to 30 days. Our own server also keeps your IP address in memory for up to two days, to stop anyone sending us too many requests or inflating our visit counts, and never saves it.
Visit counts. Our server counts the pages it sends each day: which page, whether you came from another page of our site or from elsewhere, the website that sent you (only its name, such as linkedin.com), any campaign tags in the link you followed (such as utm_source=newsletter) and whether you use a phone, tablet or computer. It also counts how many times each cookie choice is made each day (Accept, Decline or statistics only). We keep only the daily totals, with no IP address, cookie or ID.
Legal basis: our legitimate interest in running a secure website and knowing how many people visit it.
If you accept statistics
If you press Accept, we also measure how you use the site:
- which parts of each page you see, how far you scroll and how long you stay
- the links, menus and questions you open
- what you try in the live demo, and the colours you pick
- how you use the Get started form and the monthly or yearly switch: which fields you use and whether you send it, never what you type until you press Continue
- your device type, screen width range and browser language, how you reached the page (a link, a reload or the back button), the website you came from and any campaign tags in the link
- how fast our pages load for you, and script errors, with anything that looks personal removed
We also give your browser a random ID, in a cookie called mi_vid. It lets us see when you come back and how your visits connect. If you then sign up, we link your sign-up to what you looked at on our site, so we know what interests you and can talk with you about what matters to your company. The ID lasts 12 months and is never extended. It does not contain your name, and it only works on our own website.
Legal basis: your consent. You can withdraw it at any time, see Your choices below.
Even with your OK, we never record your screen or mouse, never read what you type before you send it, never follow you on other websites and never use analytics or advertising tools from other companies.
When you use Get started
You give us your name, your company, your email address and how you want to pay. We also keep the price you saw and which page you used. We use these details to reach you, send your setup link and video guide, and get you set up.
If you let us remember your browser (Accept does), we also link your sign-up to what that browser looked at on our site, as described above.
To spot spam and abuse of the form, we also keep a scrambled form of your IP address (a hash) and your user agent. We delete both after 90 days.
Each sign-up is emailed to our inbox and we reply from there, so your details also pass through our email providers, listed below.
You don’t have to give us these details, but without them we can’t reach you or set you up.
Legal basis: our legitimate interest in answering your company’s request and preparing an agreement with it. If you sign up for yourself as a sole trader, we use your details to take the steps you asked for before an agreement.
When you email us
We receive your email address, your message and anything you attach, and use them to answer you.
Legal basis: our legitimate interest in answering you.
If your company uses MyIceland
This page covers our website. When your company uses the MyIceland app, our Terms of Service and Data Processing Agreement apply to it. If you are a traveller using a tour operator’s MyIceland portal, the tour operator decides how your booking details are used, so please read their privacy policy. We handle those details for them.
If such a portal lets you add a ticket to Apple Wallet, doing so is your own choice, and your ticket works the same without it. If you add one, we keep a record of the pass for the tour operator: the tour, its date and times, your pickup place, the number of guests, the booking reference, the ticket’s barcode and a scrambled form of your email address (a hash). It does not hold your name, your email address itself or your phone number. For each device that holds the pass we also keep an identifier and a push token that Apple Wallet gives us, so we can tell the device when your booking changes. To do that we send Apple the push token and nothing about your booking. The pass itself is kept by Apple Wallet on your devices and with your Apple Account, under Apple’s terms. To stop, remove the pass from Wallet. When Wallet tells us it is gone, we delete that device’s identifier and push token. The record of the pass stays in the tour operator’s MyIceland account.
Who else handles your data
These companies handle personal data when we run our website and email:
| Company | What they do for us | Where the data is |
|---|---|---|
| Railway Corporation, USA | Hosts our website, database and server logs | Stored in the Netherlands. Railway runs its service from the USA and may pass your request through a server near you. |
| Resend, Inc., USA | Sends each sign-up to our inbox, and our replies to you | USA, kept for 30 days |
| ImprovMX Incorporation, USA | Forwards email sent to info@myiceland.io to our inbox | Received in France and deleted once delivered. Some of its sending servers are in the USA. Its logs (sender, recipient, subject) are kept for 7 days. |
| Google Ireland Limited (Gmail) | Our email inbox | Google may store email in the USA and other countries |
| GoDaddy Operating Company, LLC, USA | Our domain name. If you type myiceland.io without www, GoDaddy’s servers send you on to www.myiceland.io. | USA and other countries |
Railway, Resend, Google (Google LLC) and GoDaddy are certified under the EU-US Data Privacy Framework, which the European Commission has found to protect personal data sent to the USA. Resend’s terms with us also include the EU Standard Contractual Clauses. Email us if you want to know more about these safeguards.
We share data with authorities only when the law requires it. We never sell your data or share it with advertisers.
How long we keep it
| What | How long |
|---|---|
| Sign-ups | 24 months after you sign up. If your company becomes a customer, we keep what we need while it is a customer, and invoices as long as accounting law requires. |
| Emails with you | 24 months after we were last in touch |
| The IP hash and user agent from a sign-up | 90 days |
| Your IP address in our server’s memory | Up to 48 hours |
| Statistics about how you use the site | 25 months |
| Your browser ID (mi_vid) | 12 months, never extended |
| Our record that you accepted: the ID, the time, where you accepted and the version of our question | 37 months, as long as the statistics it covers |
| Your choice (mi_consent) | 12 months after Accept, 6 months after Decline. Then we ask again. |
| Daily totals of visits and cookie choices | 25 months |
| Server and hosting logs | Up to 30 days |
| Copies at Resend | 30 days |
| ImprovMX logs | 7 days |
Cookies and similar tools
| Name | Type | What it does | How long | When it is set |
|---|---|---|---|---|
| mi_consent | Our own cookie | Remembers whether you accepted or declined | 12 months after Accept, 6 months after Decline | When you choose. We need it to respect your choice. |
| mi_vid | Our own cookie | A random ID for statistics, see above | 12 months, never extended | Only after you accept |
| mi_internal | Our own cookie | Marks our own team’s browsers, so our own visits aren’t counted | 400 days | Never for visitors |
| Browser cache | Your browser’s own copy of our files | Makes pages load faster. Everyone gets the same files, so it can’t tell visitors apart. | Until your browser clears it | Always |
We use no cookies or trackers from other companies. The live demo runs inside your browser with made-up bookings and saves nothing.
Your choices
Which parts you see, what you try in the demo, how fast pages load.
Return visits, and what you looked at before signing up.
You can change your mind anytime with Cookie settings at the bottom of every page, or right here. To allow the statistics without the browser ID, turn on “Measure how I use the site”, leave “Remember this browser for 12 months” off and press Save. Your visits are then not connected to each other or to a sign-up.
When you withdraw, we stop measuring at once and delete the ID from your browser, with the statistics linked to it, and a sign-up is no longer linked to what you looked at. If your ID has already expired, email us and we’ll remove that link. What we did before you withdrew stays lawful.
If your browser sends a Global Privacy Control signal and you haven’t made a choice here, we treat it as Decline. A choice you make here or under Cookie settings still applies.
Your rights
You can ask us to:
- give you a copy of your personal data
- correct it
- delete it
- limit how we use it
- send the data you gave us to you, or to another company, in a common format
Email info@myiceland.io. It’s free, and we answer within a month. We may ask you to confirm who you are.
If you haven’t signed up, we can’t tell which statistics are yours. With “Remember this browser for 12 months” on, they are tied only to a random ID in your browser, and withdrawing your consent under Cookie settings deletes them. Statistics you allowed without it are tied to no ID, so we can’t find them again. They are deleted after 25 months.
Your right to object
Where we rely on our legitimate interests (running and securing the site, counting visits, answering sign-ups and emails), you can object at any time, for reasons relating to your situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend a legal claim.
Complaints
If you think we handle your data wrongly, please tell us first so we can put it right. You can also complain to Persónuvernd, the Icelandic Data Protection Authority: Laugavegur 166, 105 Reykjavík, Iceland, postur@personuvernd.is, +354 510 9600, www.personuvernd.is. If you live or work in another EEA country, you can also complain to the authority there.
Automated decisions
We don’t make decisions about you by automated means alone.
Security
Our website uses encrypted connections (HTTPS), and our database is stored in the EU. Only we can open the list of sign-ups. Our logs hide most of your email address, and we delete what we no longer need.
Changes
When we change this page, we update the date at the top. If a change affects what you accepted, we ask you again.
Contact
Nökkvi Helgason, trading as MyIceland
Vesturgata 53, 101 Reykjavík, Iceland
info@myiceland.io