InnihaldÍslenska

Privacy Policy

Last updated 15 October 2026

1. Data controller

[Lögheiti félags ehf.], ID no. [000000-0000], [Heimilisfang, póstnúmer Reykjavík, Ísland], is the controller of personal data processed in Innihald. Privacy enquiries: hallo@innihald.is.

2. What we process and why

  • Account data (name, email, hashed password): to create and run your account. Legal basis: performance of contract.
  • Company and team data (company name, members and roles): to give the team shared access. Legal basis: performance of contract.
  • Content you submit (recipes, ingredients, images and PDFs): to provide the service, including AI analysis. Legal basis: performance of contract.
  • Usage and technical data (logins, AI usage, error logs, anonymous analytics): for security, fair use and improving the service. Legal basis: legitimate interests.
  • Payment data: Paddle processes card details as an independent controller. We only receive subscription status. Legal basis: performance of contract and legal obligation (bookkeeping).
  • Waitlist (email and name): to tell you when access opens. Legal basis: consent.

3. Recipients

We use the following providers as processors or independent controllers:

  • Supabase: database and authentication, hosted in [EU, e.g. Frankfurt].
  • Vercel: website hosting and cookieless analytics.
  • Anthropic: AI that reads the recipes, images and PDFs you submit for analysis. The data is not used to train models.
  • Paddle: Merchant of Record handling payments, invoices and taxes.
  • Resend: email delivery, e.g. team invitations.
  • Cloudflare: protection against automated sign-ups (Turnstile).

We may also share data with our advisers or with authorities where required by law.

4. Transfers outside the EEA

Some providers process data in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision (EU-US Data Privacy Framework).

5. Retention

We keep data while your account is active. When you delete your account we delete your personal data, and your company's data if you are its last member. Deleted data may remain in backups for up to 30 days. Accounting records are kept as long as the law requires.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing, and to withdraw consent at any time. We respond to requests within one month. You can complain to the Icelandic Data Protection Authority, Persónuvernd.

7. Security

We protect data with encryption in transit, access controls that keep each company's data separate, and limited staff access.

8. Cookies

We only use essential cookies to keep you signed in. Our analytics do not use cookies. Cloudflare Turnstile may process essential data to detect automated traffic.