What we collect and why

The controller of the data and the operator of Torgið is Aþena hugbúnaður ehf., company ID (kt.) 460726-0690. Torgið gathers the offers of Icelandic shops in one place. The shops sell the products themselves.

• Which offers are shown and opened, and when you leave Torgið for a shop's website. This is counted with no link to you, so shops can see totals for their own offers.
• The search words you enter and the number of results, that a filter was used on a given page, and the kind of device (phone, tablet or computer), also with no link to you, so we can see what is missing from the selection.
• An identifier calculated anew every day from the date, your IP address and your browser, together with a secret key. The IP address itself is not stored with the data, the identifier is not kept in your browser, and it cannot be linked from one day to the next.
• Before you have chosen, only impressions and views of offers and trips to shops' websites are counted, with no link to you.

• Everything listed above under “With the choice Essentials only”.
• Which pages you view, what you click, how long you stay on an offer and how far you scroll.
• How long the visit lasts, how many pages you view, which filters you use and which offers you save or put on a list.
• Screen size, your browser's language, time zone, where you came from and any campaign tags (utm) in the address.
• The cookie mist_sid, which lets us recognise the same browser again (see “Cookies and your choice”).
• If you are signed in and have chosen Everything, these records are linked to your account. Records from the same browser from before you signed in then count too when you download or delete your data. Otherwise they are not linked to you.
• We use this to show offers that fit you under “For you” and so shops can see what works. “For you” is based on the brands you follow, your favourite categories, the offers you save or put on a list and, only if you have chosen Everything, the offers you viewed or went to a shop for in the last 30 days.

• Your email and password, or signing in with Google. From Google we receive your email, name and picture.
• Your name, if you give one, your favourite categories and the brands you follow.
• Saved offers and lists. A list you share by link can be seen by anyone who has the link.
• Your data collection choice with the time and kind of browser, and the history of changes to it, so it can be shown when and how consent was given.
• The sign-in service records when you signed in, with your email and IP address.

This is what Torgið puts in your browser:

mist_consent

Stores your choice, Everything or Essentials only. Valid for one year.

mist_sid

Only with Everything. An identifier for the browser, so we can recognise it again. Valid for one year and renewed while you use Torgið. Pages cannot read it (HttpOnly), and it is removed when you choose Essentials only.

sb-*

Only while you are signing in or after you have signed in. Set by the sign-in service so that you stay signed in. When a sign-in or sign-up starts, by email or with Google, it also sets a cookie whose name ends in -code-verifier. It is used to complete the sign-in and is removed when that is done. Their names start with sb-.

torgid:saved:v1

Kept in the browser, not a cookie: offers you save before you sign in. They do not leave your device until you sign in.

torgid:saved:kept:v1

Kept in the tab, not a cookie: when a saved offer does not come with you at sign-in because it is no longer live, the browser remembers that for up to an hour so it does not ask again on every page. It goes when the tab is closed.

mist:session-started

Kept in the tab, not a cookie: marks that a visit has started. It goes when the tab is closed.

You can change your choice here at any time. The change applies immediately.

Torgið uses these providers to run the site:

• Vercel hosts the site and so receives your browser’s requests, including your IP address.
• Supabase stores the database, handles signing in and sends the email an account needs, for example a link to reset a password.
• Search uses models that run on a server Torgið rents from Contabo. Search words go there, through Supabase, to calculate the search, and so do photos you send for photo search. Torgið does not store the photo. To limit the number of requests from one user, the service receives a value calculated from your IP address with a secret key, not the IP address itself.
• Google handles the sign-in if you choose “Continue with Google”.
• Shops receive totals for their own offers: impressions, views, saves, trips to their website and the average time an offer is viewed. They cannot see who did what. When you go to a shop's website, its own data rules apply. Torgið only adds source tags (utm) to the address, nothing about you. Pictures of offers can also be loaded straight from the shop's own server, which then sees your IP address and browser.

Data is removed automatically every night according to this:

• Records of what you do on the site (impressions, views, saves, searches, clicks and page views): 13 months after they were made.
• Information about visits (kind of device, screen size, source): when 13 months have passed since the browser was last seen or since it was first seen, whichever comes first.
• Counters that protect the site from too many requests: those older than an hour are removed in the nightly run, so each is gone within a little over a day.
• The sign-in log of the sign-in service (email and IP address): 13 months after the sign-in.
• Your account and what belongs to it (profile, saved offers, lists, preferences, followed brands and your data collection choice with its history): until you delete the account.
• When you delete the account, the events (searches, clicks and page views) and the visits linked to it are deleted too. Records about offers (impressions, views, saves and trips to shops' websites) stay with no link to you and are removed after 13 months.

This is the legal basis on which Torgið processes the data described above:

• Account and signing in: performance of the contract with you, set out in the terms of use.
• The choice Everything, that is data about how you use the site beyond what is necessary: your consent. You can withdraw it at any time by choosing Essentials only.
• Necessary cookies, the choice Essentials only and security logs (counters that protect the site from too many requests, and the sign-in log): necessity for running the site and Torgið's legitimate interests in protecting it and seeing totals of use.

• You can download your data and delete your account at any time under Data and privacy. The export is one JSON file with what belongs to your account: up to the newest 10,000 events and 10,000 records about offers, and up to the newest 1,000 visits and changes to your choice. If anything is cut off, the file says so.
• The data collection choice is above and also under Data and privacy. When you choose Essentials only, the collection of what belongs to Everything stops at once and mist_sid is removed.
• If you own a company on Torgið, the company has to be handed over or deleted before you can delete the account.
• You have the right to access data about you, to have it corrected or deleted, and to complain to Persónuvernd, the Icelandic data protection authority.

Questions about your data: Aþena hugbúnaður ehf., company ID (kt.) 460726-0690.

Email: framtak@fsp.is