Privacy

The controller of the personal data described here is b2 ehf. (kennitala 500522-1000), which runs iTorg. Questions and requests about privacy can be sent to itorg@itorg.is.

This policy covers the website itorg.is and the email we send and receive. It doesn’t cover what you and another user do outside iTorg, for example when you meet or pay.

Account details: name, email address and profile picture from Apple or Google, depending on how you sign in. If you choose “Hide My Email” with Apple, we only get an anonymous relay address. We never receive your password.

Content you post: listings, photos, descriptions, alerts (saved searches), saved items, messages to other users, reports you send about listings and suggestions to us, along with an email address if you give one to get a reply.

Phone number: only if you put it in a listing yourself. It is optional.

Language: which language you chose on the site, so email from us arrives in it.

Search text: what you type into the search on the home page, to turn it into filters. It is not linked to your account.

Email you send us: mail to addresses at itorg.is is kept in our mailbox together with your email address and name, so we can reply.

Technical details: IP address and browser details in server logs, a sign-in cookie that keeps you signed in, and anonymous usage statistics (page views, device type, country, load speed) collected without cookies and impossible to trace to you. We also count views of listings without linking them to you.

Your listings, photos and name are visible to everyone who views the site, including people who aren’t signed in, along with the year you joined iTorg and how many items you have sold. Photos are hosted at public addresses: anyone with the link can open them, including after the listing is taken down, until the photo is deleted.

Your messages are seen only by you and the person you’re talking to, and by our staff in the cases described in the terms (a report of abuse, a suspicion of fraud, a legal obligation).

A phone number in a listing is shown only to signed-in users, and only after they tap the button. Your email address is never shown to other users.

Don’t put anything in a listing, photo or message that you wouldn’t want a stranger to see, such as your home address or a serial number visible in a photo.

To run the service: identify you, show listings, compare new listings against alerts, make messaging between users possible, calculate price guides and understand searches. This is based on our contract with you, these terms.

To send email related to your use: a welcome email, alert notifications and notifications of new messages, and to answer email from you. We don’t send newsletters or marketing email and don’t give your address to anyone for marketing.

To keep the service safe: respond to reports, detect fraud and abuse, close accounts when needed, and keep anonymous statistics on usage and speed. This is based on our legitimate interest in a safe and usable service, which we consider outweighs the inconvenience to you, given how little data is collected.

To meet legal obligations, for example a police request with a legal basis.

We make no automated decisions with legal effects on you, and we don’t profile users.

We never sell personal data and don’t share it with anyone other than service providers working for us under contract, and only what each of them needs:

Apple and Google: sign-in, if you choose to sign in with them. They learn that you signed in to iTorg.

Vercel (USA): hosting the site on servers in London, photo storage, and anonymous usage and speed statistics without cookies.

Neon (USA): the database, hosted in London.

Resend (USA): sends our email from servers in Ireland and receives mail sent to itorg.is.

OpenAI (USA): receives the search text from the home page, without a name or email address, to turn it into filters. Under OpenAI’s API terms the data is not used to train models.

The data is hosted in the UK and Ireland. The UK has an EU adequacy decision for data protection. The providers are US companies and part of the processing (support, the search) may take place in the USA under the EU-US Data Privacy Framework or the EU’s standard contractual clauses.

We use one essential cookie to keep you signed in, one to remember the language you chose, and short-lived cookies while a sign-in with Apple or Google is in progress. No advertising or tracking cookies, no third-party cookies, and therefore no cookie banner. More on the Cookies page.

Account, listings, alerts, saved items and messages: as long as your account exists. When you delete it in Settings, all of this is deleted from the database immediately. Backups disappear within 30 days.

Sold and removed listings: kept while the account exists, so you can see your sales history and price guides stay accurate. A removed listing is visible to no one else.

Reports about listings: until they are handled, and for up to a year after that to recognise repeat offences.

Suggestions: until they are handled. An email address given with a suggestion is deleted as soon as it is handled.

Email to us: until the matter is dealt with, at most two years.

Server logs with IP addresses: up to 30 days.

You can also send a deletion request to itorg@itorg.is and we’ll handle it within a month.

You have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a machine-readable format, to restrict processing and to object to processing based on legitimate interests. Most of this you can do yourself in Settings and under My listings, and the rest by dropping us a line. We reply within a month.

If you think we have mishandled your information, you can complain to the Icelandic Data Protection Authority, personuvernd.is. We’d still like to hear from you first.

All communication with the site is encrypted (HTTPS). We hold no passwords; sign-in is with Apple or Google. Staff access to data is limited to what is needed to run the service and respond to reports. If a security breach affecting you occurs, we notify you and the Data Protection Authority as the law requires.

The service is intended for people aged 18 and over, and younger users may only use it with a guardian’s consent. If you are a guardian and think a child has signed up without your consent, get in touch and we’ll delete the account.

We may update this policy, for example when we add a service provider or a feature. The date of the last change is shown at the top of the page, and we announce significant changes by email.