Salabókun

Privacy

Privacy policy

What personal data we collect, why, who processes it and how we protect it. Your data is stored within the EEA.

Last updated · September 2026Data stored within the EEA
1

Data controller

Salabókun ehf., Hlíðasmári 8, 201 Kópavogur, is the data controller for the personal data processed in the service.

Enquiriessupport@salabokun.is
2

What data is collected

Email, name, language, notification settings
WhoAll users
NoteStored on the user profile.
Kennitala
WhoHosts (required), guests (on first booking)
NoteEncrypted at rest, never written to system logs, shared only with the identity service for verification and with the accounting service when a fiscal document or bank claim requires it.
Identity confirmation (eID), bank account, VAT status
WhoHosts
NoteIdentity is verified with Icelandic electronic ID (rafræn skilríki); bank account and VAT status are entered in host onboarding and stored with us.
Card data
WhoGuests
NoteFull card details never touch our servers. Entered directly with the PCI-certified payment provider on the venue's own merchant agreement; we store only the token reference, brand and last four digits.
Saved-card reference (token, card brand, last four digits)
WhoGuests (card bookings)
NoteLets the venue's payment provider charge the saved card when the host accepts; usable only on that provider's merchant agreement. Stored with the booking request.
Messages and attachments
WhoGuest ↔ host
NoteRetained indefinitely as evidence.
Reviews and booking history
WhoAll
NoteReviews appear publicly on the venue and profile.
Calendar tokens (OAuth)
WhoHosts
NoteEncrypted at rest with a dedicated key, least privilege.
IP address and card window
WhoGuests
NoteShared with the payment provider when a card is entered; it processes this within the EEA as an independent controller under its own privacy terms.
System and audit logs
WhoAll
NoteMetadata without personal data, no kennitölur.
3

Processors

We use the following service providers to run Salabókun. Each processes only the data its service requires.

Payment providerEEA
Card payments under the venue's own merchant agreement: for card bookings the host is the merchant of record, and Teya Iceland processes card data within the EEA as an independent controller under its own privacy terms; it is not Salabókun's processor. Its own onward transfers, including to the international card networks, are covered by its own privacy terms.
CalendarOutside EEA
Calendar sync, only if the host connects
Email serviceOutside EEA
Transactional email
Maps serviceOutside EEA
Maps and geographic search
Electronic IDOutside EEA
eID login and verification of kennitölur on our instructions under a DPA; runs outside the EEA (United Kingdom, under the EU adequacy decision)
Google AnalyticsOutside EEA
Web analytics: anonymous usage statistics (Google Ireland Ltd.; data may be transferred outside the EEA under standard contractual clauses).
Host web analyticsOutside EEA
Anonymous web analytics from our hosting provider (Vercel Inc.): page views and performance metrics. Cookieless: nothing is stored on your device and no identifiers are kept. Data may be transferred outside the EEA under standard contractual clauses.
Accounting systemEEA
Invoices, receipts and bank claims (bankakröfur) issued on our instructions under a DPA; receives the name, kennitala and amounts a fiscal document or claim requires.
HostingEEA
Web hosting, pinned to Frankfurt
DatabaseEEA
Database in Frankfurt, backups and PITR
Auth layerEEA
Sign-in and password hashing (argon2id/bcrypt)
4

Data location

  • Core user data is stored within the EEA: database and file storage in Frankfurt.
  • Some of the services we use operate wholly or partly outside the EEA: the email service (United States, SCCs), the maps service (SCCs), calendar sync when a host connects one (the host's own account with that provider, which acts as an independent controller), web analytics (SCCs) and electronic ID (United Kingdom, under the EU adequacy decision). Card data is processed within the EEA by the payment provider (Teya Iceland) as an independent controller under its own privacy terms.
  • Identity verification by electronic ID (eID) runs on a processor whose infrastructure is in the United Kingdom (covered by the European Commission's adequacy decision) together with a content-delivery network. It processes kennitölur only on our written instructions under a data processing agreement (DPA).
  • Each sub-processor operates under a data processing agreement (DPA); the email service's transfer to the United States is covered by the European Commission's Standard Contractual Clauses (SCCs) in that DPA. The payment provider is not our processor but an independent controller; it processes card data within the EEA (Teya Iceland) under its own privacy terms.
5

Deletion and retention

  • You have the right to erasure under GDPR. On deletion, the reference to you in the audit log is removed without disturbing the log itself. Its metadata contains no personal data.
  • Messages between guest and host are retained as long as necessary as evidence in case of a dispute.
  • Accounting records (invoices, receipts and settlement records) are kept for seven years as required by Icelandic bookkeeping law (Lög um bókhald). Other personal data is kept only as long as necessary for the purpose it was collected for, or until you exercise your right to erasure.
6

Security measures

Kennitölur and calendar tokens encrypted at rest.
Full card details never touch our servers; card entry happens with the PCI-certified payment provider. We store only a saved-card reference (token) with the card brand and last four digits, and only the venue's payment provider can use it, for this booking's charge.
Signature verification on webhooks.
CSRF protection, rate limiting and schema validation on input.
7

Google Calendar

Hosts can choose to connect Google Calendar to a listing for two-way sync of bookings. The connection is optional and the OAuth tokens are encrypted at rest. We request only the scopes the sync needs:

  • calendar.events — to read and write booking events in the calendar you choose.
  • calendar.calendarlist.readonly — to list your calendars so you can pick which one to sync.

We do not sell, share, transfer, or disclose your Google user data to any third party. The calendar events and the OAuth tokens from this connection are used only to provide the two-way sync you turned on; they are stored solely in our own EEA infrastructure (hosting and database in Frankfurt), are never used for advertising, sold to data brokers, or used to train AI or machine-learning models, and are deleted when you disconnect the calendar.

Salabókun's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
8

Cookies and analytics

We use Google Analytics to understand how the site is used: which pages are viewed and how people find their way around. The service runs in Consent Mode: no measurement cookies are set and no identifiers are stored unless you choose “Accept” in the cookie banner. We additionally run anonymous web analytics from our hosting provider that works without cookies: it sets no cookie, stores no identifier and puts nothing on your device, so it does not depend on your choice in the banner.

  • No consent → no cookies. Until you make a choice, only anonymous, cookieless statistical signals are sent.
  • The host web analytics runs without cookies and therefore without consent: it records only anonymous page views and performance metrics, never your name, email or kennitala.
  • With consent, usage data is collected: page views, device and browser type, and a truncated IP address. Your name, email, or kennitala is never sent to Google.
  • You can withdraw consent at any time by clearing the site's browser data. The banner will then reappear.
9

Marketing email

We send only transactional email: confirmations, reminders and booking notifications. There is no marketing email and no marketing consent gate at launch.

Questions about privacy?

Get in touch and we'll answer as quickly as we can.

Get in touch →