How we handle your data

Fyrstu kaup (fyrstukaup.is) is a free information site for first-time home buyers. The operator of the site is responsible for the personal data processed in connection with it, under the Icelandic Data Protection Act No. 90/2018 and the General Data Protection Regulation (GDPR).

This policy explains what information is created when you use the site, where it is stored and how you stay in control of it. Send questions and requests to fyrstukaup.is/en/contact.

Most of the site works without an account. What you enter in the steps is stored in your browser (localStorage) on the device you are using, not with us:

• Budget · : the number of buyers, whether it is a first purchase, monthly take-home pay, savings and séreign pension savings.
• The property and the offer · : the address and property number of the home you are looking at, the estimate, the asking and offer prices, notes from the viewing, dates from the purchase agreement, and the buyers’ names if you enter them.
• Templates · : drafts of documents you fill in, including any names, phone numbers and addresses you write in them.

This data never reaches us and we cannot see it. It stays on the device until you delete it, for example by clearing the site data for fyrstukaup.is in your browser. Anyone else using the same device can see it.

An account is optional and only needed to save checklists online. When you create one, we store:

• Sign-in with email · : your name, email and password. The password is never stored as you type it, only as a bcrypt hash that cannot be turned back into the password.
• Sign-in with Google · : your name, email and the link to your Google profile picture, your Google account ID and the access tokens the sign-in needs. We never receive your Google password.
• Checklists · : the property address, your assessment of each item, notes, the viewing date and any photos you add.

We only email you about your account: confirming your email address, a link to reset your password, and a welcome when the account is created. No newsletters and no marketing.

When you send us a message, we store your name and email, the category, subject and text of the message, and the address of the page you sent it from. If you are signed in, the message is linked to your account.

We use this information only to reply to you and to fix what you point out.

We use no advertising or tracking cookies. The cookies the site sets are necessary:

• Sign-in · : an encrypted session cookie that keeps you signed in for up to 30 days, and short-lived security cookies while signing in. They are created when you sign in or use the sign-in pages.
• Language · : a cookie that remembers whether you chose Icelandic or English. It disappears when you close the browser.

To understand how the site is used, we use the statistics service stats.is. It sets no cookies and records which pages are viewed, where the visit came from, the type of device, and how long and how far people read. It is not used on the sign-in pages.

Like any web service, the site’s servers receive your device’s IP address with each request. We use it briefly, without storing it, to guard against abuse such as too many sign-in attempts. Our hosting provider keeps technical access logs for a short time for operations and security.

We never sell personal data or share it for marketing. To run the site we use the following services, which process data only as far as their service requires:

• Vercel · : hosting for the site and its servers.
• Database · : a PostgreSQL database that stores accounts, checklists and messages.
• Resend · : sends the emails about your account.
• Google · : sign-in with Google, if you choose it.
• stats.is · : visit statistics without cookies.
• OpenStreetMap · : maps on the site are loaded straight from OpenStreetMap into your browser. Address search and the neighbourhood analysis go through our server to Nominatim and Overpass, which are based on OpenStreetMap, so those services do not see your IP address.
• GitHub · : a font file for the checklist PDF is loaded into your browser when you create the PDF.

Some of these providers are in the United States. Processing there relies on appropriate safeguards, such as the EU–US Data Privacy Framework or standard contractual clauses. We only hand information to authorities if the law requires us to.

We process personal data only for these purposes:

• Accounts and checklists · : to provide the service you signed up for (necessary for a contract).
• Emails about your account · : a necessary part of the account (necessary for a contract).
• Messages to us · : to reply to you (legitimate interests).
• Statistics and security · : to keep the site running, protect it and improve it (legitimate interests).

The data is not used for automated decision-making or profiling.

• Accounts and checklists · : until you delete them or the account.
• Messages · : until your enquiry is dealt with, or until you ask us to delete them. They are deleted with your account.
• Links in emails · : the link to confirm your email is valid for a day, and the password reset link for an hour.
• Data in your browser · : until you delete it from the device.

When you delete your account, everything linked to it is deleted: your account details, the link to Google, your checklists with their photos, and the messages you have sent us.

You have the right to access the information about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a machine-readable format.

• Download your data · : under My account (fyrstukaup.is/en/account) you can download everything stored about you as a JSON file.
• Delete your account · : in the same place you can delete your account and everything that comes with it.
• Correct or ask · : send us a line at fyrstukaup.is/en/contact, for example if your name or email needs changing.

If you feel your data is not handled properly, you can complain to the Icelandic Data Protection Authority (Persónuvernd): personuvernd.is.

All communication with the site is encrypted (HTTPS). Passwords are stored as bcrypt hashes, access to the admin area is restricted, and the system limits repeated attempts to prevent abuse. No system is perfectly secure, though. If a breach affects your data, we will inform you and Persónuvernd as the law requires.

We update this policy when the site changes. The date at the top of the page shows when that last happened, and we announce significant changes on the site.