Privacy policy
Updated July 2026
Vefapp is a division of Datatech ehf. This policy explains what personal data we collect when you use our site, why, who processes it on our behalf, and how you can exercise your rights.
Data controller
The data controller is Datatech ehf. (reg. 420115-0240), Reykjavík, Iceland. Privacy enquiries can be sent to vefapp@datatech.is.
What we collect
When you send an enquiry, a quote request, or enter your email in the site scan, we collect the details you provide: name, email, phone, company and message.
When you chat with our assistant Edda, we store the conversation together with a hashed version of your IP address and browser information.
When you use the site scan, we store the you submitted, the results and a hashed IP address. We never store a raw IP address.
Why and on what basis
We process the data to answer enquiries, provide our services and improve the site. The legal bases are contract (when we do business), legitimate interests (answering enquiries and protecting our systems) and consent (for example for analytics).
If you contact us, our team may follow up about your enquiry. You can ask to be removed from any list at any time.
Cookies
We use strictly necessary cookies for language, login and to remember your consent choice. These are required for the site to work.
Analytics only runs if you opt in via the consent banner. We use Analytics for traffic statistics and Microsoft Clarity to see how visitors use the site — through behavioural metrics, heatmaps and session recordings — via first- and third-party cookies. For more about how Microsoft collects and uses this data, see the Microsoft Privacy Statement. Nothing measures usage before you decide, and you can change your choice at any time from the footer.
If you accept marketing cookies, Google Tag Manager loads and handles ad measurement for Google and Microsoft. When you send an enquiry, request a quote or scan a site with sign-up, we share your email (and phone where relevant) with Google and Microsoft to attribute ad performance. The data is hashed in your browser before it leaves, and none of this happens for visitors who decline marketing cookies.
Processors and sharing
We use service providers that process data on our behalf: (database), (hosting and analytics), Google (Tag Manager and ad measurement), Microsoft (Clarity analytics and ad measurement), Resend (email) and (rate limiting).
Chat with Edda and site-scan content are sent to () to generate responses.
Some of these providers (including , Google, Microsoft, , Resend and ) process or store data in the United States, so personal data may be transferred outside the European Economic Area (EEA). For those transfers we rely on the EU Standard Contractual Clauses (SCCs) and put a data-processing agreement in place with each provider.
We never sell personal data.
Retention
Chat conversations are automatically deleted after 180 days. Site-scan results are kept for up to 6 months. Enquiries and quote requests are kept for up to 24 months. 404 logs are kept for 90 days.
After that the data is deleted automatically unless we are legally required to keep it longer.
Your rights
You have the right to access your data, have it corrected, have it erased, restrict processing, object to processing, and receive your data in a portable, machine-readable format (the right to data portability).
Where processing is based on consent (for example analytics) you have the right to withdraw that consent at any time from the footer, without affecting the lawfulness of processing carried out beforehand.
To exercise these rights, email us at vefapp@datatech.is and we'll respond within the statutory time frame.
You also have the right to lodge a complaint with the Icelandic Data Protection Authority (personuvernd.is).
Changes
We may update this policy. The latest version is always published here.