Privacy Policy
Last updated: 5 August 2026
This statement explains how Fustle ehf. ("Fustle", "we", "us") collects, uses, shares, and protects your personal data when you use our invoicing and payout platform. It meets the requirements of the EU General Data Protection Regulation (GDPR), Icelandic Data Protection Act No 90/2018 and relevant e‑Privacy rules.
1. Who We Are (Controller)
| Legal entity | Fustle ehf, kt. 630626-0640 |
| VAT number | 630626-0640 |
| Registered office | Ármúla 36, 108 Reykjavík |
| thjonusta@fustle.is | |
| Data‑protection officer | Maarit Kaipainen – thjonusta@fustle.is |
| Phone | +354 790 3656 (Weekdays 09:00–16:00) |
| Supervisory authority | Persónuvernd – Icelandic Data Protection Authority |
| Skipholti 37, 105 Reykjavík +354 510 9600 www.personuvernd.is |
2. What Personal Data We Collect
2.1 Data you provide
- Account details – name, email, phone, address.
- Identity – kennitala (personal ID), electronic‑ID assertions.
- Payout & tax – bank IBAN, pension‑fund choice, union membership (optional).
- Invoicing & financial – client names, invoice amounts, expense receipts.
2.2 Data we generate or log
- Usage logs – IP address, device/browser, pages visited, and time-stamps.
- Cookies – the consent controls on this site explain optional analytics and marketing technologies.
- Essential cookies keep the site secure and let you log in.
- Analytics (opt‑in) cookies help us improve UX. Disabled by default until you consent.
3. Why & How We Use Your Data
| Purpose | Examples | GDPR legal basis |
|---|---|---|
| Provide the Service | Account setup, invoicing, payroll processing, payouts, and support | Art 6 (1)(b) – contract |
| Legal compliance | Tax & accounting records, AML checks | Art 6 (1)(c) – legal duty |
| Security & fraud | Login monitoring, incident logs | Art 6 (1)(f) – legitimate interest |
| Product analytics | Aggregate traffic stats | Art 6 (1)(a) – consent |
| Direct marketing | Newsletters about new features | Art 6 (1)(a) – consent (opt‑in) |
Right to object: You can opt out of processing based on legitimate interest or withdraw optional analytics and marketing consent using this site's consent controls or by emailing us.
4. Who Receives Your Data
- Payment, identity, infrastructure, monitoring, and email partners – Supabase, Vercel, Sentry, Mailgun, Rapyd, and our electronic identity provider. All are subject to appropriate contractual and data-protection terms.
- Optional analytics and marketing partners – Google Tag Manager, Meta Pixel, Vercel Analytics, PostHog, and SiteBehaviour when configured. These tools load only after consent.
- Professional advisors & auditors – for statutory accounting.
- Public authorities – RSK, police or courts when legally obliged.
5. International Transfers
All primary storage is in the EEA. If we need to move data outside the EEA (e.g., US analytics vendor) we will use Standard Contractual Clauses and list the vendor under Who Receives Your Data.
6. Retention Periods
| Data category | Retention |
|---|---|
| Financial & accounting records | 7 years after the end of the fiscal year (Accounting Act 3/2006) |
| User account profile | Until you delete your account or 2 years of inactivity |
| Marketing consent logs | 5 years (accountability requirement) |
| Support tickets & chat | 3 years from closure |
| Usage logs | 12 months (or shorter if you disable analytics) |
We may keep backups for up to 30 days beyond these periods for disaster‑recovery.
7. Your Rights
You may access, rectify, erase, restrict, port, or object to our processing of your personal data. To exercise rights, email thjonusta@fustle.is. We will respond within 1 month (extendable by 2 months for complex requests). You can lodge complaints with Persónuvernd.
We do not knowingly offer services to persons under 18. If we learn that we hold data about a minor, we will delete it promptly.
8. Data Security
- Encrypted connections for data in transit.
- Role-based and row-level access controls.
- Access logging, monitoring, backups, and incident-response procedures appropriate to the service.
If a breach likely affects your rights, we will notify you and Persónuvernd without undue delay.
9. Changes
Material updates will be announced via email and an in‑app banner before taking effect when required. Previous versions are available on request.
10. Contact
Questions or requests?
Email: thjonusta@fustle.is
Phone: +354 790 3656
Fustle ehf, Ármúla 36, 108 Reykjavík
© Fustle ehf. All rights reserved.