Privacy Policy

Spjallbox is operated by Novamedia ehf. (reg. no. 540606-2260). Privacy questions can be sent to spjallbox@spjallbox.is.

• User account details (name, email) needed to provide the service.
• Content of communications processed through the system (messages, attachments and contact details).
• Verification data when a company enables electronic ID (Kenni / Auðkenni): a customer’s verified national ID, name and phone number.
• Technical information (usage logs, IP addresses) for operation and security.
• Billing information related to the subscription.

We process personal data to provide and improve the service, fulfill contracts, ensure security and comply with legal obligations. Processing is based on contract, legitimate interests and — where applicable — consent.

AI features (draft replies, summaries, knowledge base search) run to assist support agents. Content is processed solely to generate a reply and is not used to train general third-party models.

Companies may choose to let customers verify themselves in the live chat using electronic ID through Kenni (Auðkenni). When a customer verifies, we receive a verified national ID, name and phone number from the identity provider and link it to the conversation and the relevant company’s contact record.

National ID numbers are treated as sensitive identifying information: they are used only to identify the customer and match prior interactions, are not shown in audit logs in readable form, and are accessible only to staff of the relevant company. Each company is the data controller for the national IDs it collects, and verification is always optional for the customer.

Data is hosted within the European Economic Area. We retain data for as long as needed for the service or legal obligations, and delete or anonymize it afterwards.

We use trusted sub-processors (e.g. for hosting, email delivery, electronic ID verification, payments and AI) that operate under processing agreements and adequate security requirements.

• Access to, correction of and deletion of personal data.
• Restriction of or objection to processing.
• Data portability and withdrawal of consent.
• Complaint to the Icelandic Data Protection Authority.

To exercise your rights, contact us at spjallbox@spjallbox.is.