Privacy Policy

Who we are

Vefsida.app is a service operated by Novamedia ehf. (reg. no. 540606-2260, Reykjavík, Iceland) that turns WooCommerce and Shopify stores into mobile apps. This policy explains how we handle personal data when you visit our website, use the merchant dashboard, or use an app built with Vefsida.app.

For questions about privacy, contact hallo@novamedia.is.

Two roles

For merchants who create an account, Novamedia is the controller of account and billing data.

For the customers of a merchant's app (end customers), the merchant is the controller. Novamedia processes end-customer data on the merchant's behalf, only to operate the app. Merchants can request a data processing agreement from us.

Data we process about merchants

• Account data: name, email address, password hash (we never store passwords in readable form), language and time zone.
• Organisation data: company name, team members and their roles, billing email, and the payer's kennitala together with the name registered for it in the National Register or Companies Register.
• Store connection data: store address, platform, connection status. Connector secrets and API tokens are encrypted at rest.
• App configuration, uploaded logos and images, store listing texts and generated screenshots.
• Developer account details you provide for Apple and Google, including API keys, which are encrypted at rest and used only to build and submit your apps.
• Billing data: subscription plan, activation date and invoices issued. Subscriptions are invoiced electronically; we do not collect card details.
• Support conversations and an audit log of significant actions in your account, including IP address.

Data we process about end customers

• A random installation identifier, device platform, app version and language.
• A push notification token, if the customer allows notifications.
• In-app events such as product views, add-to-cart and checkout started, linked to the installation identifier.
• If the customer signs in: their customer identifier at the store, so orders and wishlists can be shown. Passwords are sent to the store and are not stored by us.
• Orders and payments are processed by the merchant's store and payment providers, not by Vefsida.app.

Store scanner

When you scan a store address, we fetch public pages of that site to detect the platform, brand colours and sample products. We store the result and a one-way hash of your IP address for abuse prevention. Unclaimed scans are deleted after 30 days.

Why we process data

• To provide the service under our contract with you (accounts, apps, builds, submissions, support).
• To bill subscriptions and meet accounting obligations.
• To keep the service secure and prevent abuse (legitimate interest).
• To understand how the product is used in aggregate and improve it (legitimate interest). We do not sell personal data or use it for advertising.

Service providers

We use the following providers to run Vefsida.app. Each processes data only as needed for its service:

• Supabase — database hosting.
• SMTP2GO — transactional email.
• Já hf. (Já gagnatorg) — lookup of kennitala in the National Register and Companies Register when an account is created or the payer is changed.
• Expo (650 Industries) — app builds and push notification delivery.
• Apple and Google — app distribution and push notification delivery for apps published in merchants' own accounts.
• Our hosting and storage providers, as listed in our data processing agreement.

International transfers

Some providers process data outside the European Economic Area. Where they do, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

Retention

• Account and app data are kept while your account is active.
• If you cancel, your configuration is kept so you can reactivate; you can ask us to delete it at any time.
• App analytics events are kept for about 13 months.
• Invoices are kept as long as accounting law requires.
• When you delete your account, it is removed after a 14-day cancellation window.

Your rights

You can access, correct, export or delete your personal data. Merchants can export their data and request account deletion from Settings. You may also object to processing based on legitimate interest and ask us to restrict processing.

End customers should contact the merchant whose app they use; we will help the merchant respond.

You can complain to the Icelandic Data Protection Authority (Persónuvernd) or your local supervisory authority.

Security

We encrypt secrets at rest, hash passwords and session tokens, sign app configuration, verify webhook signatures and restrict staff access by role with audit logging. No system is perfectly secure; if a breach affects your data, we will notify you as required by law.

Cookies

We use a strictly necessary session cookie when you sign in and a cookie to remember your language. We do not use advertising or third-party tracking cookies.

Changes

We will post changes on this page and notify account holders of material changes by email.