Privacy Policy

Last updated: 8 September 2026

1. Who we are

Eignasaga is an Icelandic digital service for homeowners and contractors. The data controller is Eignasaga ehf., Icelandic company reg. no. (kennitala) 450526-1260, Klukkurima 10, 112 Reykjavík, Iceland — eignasaga@eignasaga.is.

2. Data we collect

• Name and email address on registration
• National ID (kennitala) — optional, used to link you to properties in the national registry
• Property records you create
• Photos and documents you upload
• Messages sent through the marketplace
• Session tokens for authentication

3. How we use your data

• To provide the service and maintain your property history
• To send you verification emails and system notifications (e.g. password reset)
• To verify contractors via magic link

4. Legal basis (GDPR)

We process personal data on the basis of contract (Art. 6(1)(b) GDPR) when you use the service, and legitimate interests (Art. 6(1)(f)) where applicable.

5. Data sharing

We share data with third parties only where necessary to deliver the service:

• Neon (PostgreSQL database, AWS eu-west-2)
• Vercel (hosting and Blob storage)
• Resend (email delivery)

We never sell data to third parties.

6. Retention and account deletion

We retain your personal data while your account is active. You can download a copy of your data and permanently delete your account in Settings, or request deletion by emailing eignasaga@eignasaga.is. When an account is deleted we erase what identifies you: name, email, national ID (kennitala), password, sessions, notifications, messages, tender requests and contractor details.

Two things are excluded from deletion:

• The property history. Jobs, photos, documents and warranties recorded on a property are the history of the property itself, not of its owner, and are not deleted with the account (see section 7). Your name and user ID are removed from the property.
• The lookup log (an append-only record of lookups against the HMS property registry and related system actions): we must retain it for at least 7 years under our legal obligations and agreement with HMS (cf. GDPR art. 17(3)(b)).

7. The history stays with the property

Eignasaga is a permanent logbook for a property. Its value lies in the history being complete and following the property from owner to owner. The following rules therefore apply:

• Jobs lock. A job recorded on a property can be corrected or withdrawn for 24 hours after registration. After that the entry is locked and can be neither edited nor deleted. A job verified by a contractor locks immediately on verification.
• Change of ownership. When a new registered owner claims the property against the HMS property registry, they take over the property with its entire history. The previous owner loses access, their sales-report share links expire and the permissions they granted are revoked. The previous owner is notified of the transfer.
• Account deletion. If a registered co-owner is present in Eignasaga, the property passes to them. Otherwise the property becomes ownerless, with your name and user ID removed, until the next registered owner claims it. An ownerless property that nobody claims within 10 years is deleted together with its history.

Do not record information in the property history that you would not want to follow the property to its next owner. Contractor details in job entries (name and contact information) are retained as part of the property history on the basis of legitimate interests (GDPR art. 6(1)(f)).

8. Your rights

Under GDPR you have the right to:

• Access your personal data
• Correct inaccurate data
• Erasure (“right to be forgotten”)
• Restriction of processing
• Data portability

A data export (JSON) and permanent account deletion are available directly in Settings. To exercise your other rights, email eignasaga@eignasaga.is.

9. Complaints

If you believe we have violated data protection law, you may lodge a complaint with the Icelandic Data Protection Authority (personuvernd.is).

10. Contact

eignasaga@eignasaga.is