Húsamús

Privacy Policy

Last updated: 21 July 2026

This Privacy Policy explains how Húsamús ("we", "us", "our") collects, uses, and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data.

1. Data controller

Húsamús is the data controller for personal data collected through husamus.is. Contact: privacy@husamus.is.

2. What we collect

  • Account data: phone number, name, email (optional), address (optional).
  • Listing data: photos, descriptions, prices, location, category.
  • Messages: chat messages between buyers and sellers.
  • Technical data: IP address, browser type, device information, referring URL.
  • Usage data: pages viewed, listings clicked, searches performed.

3. Legal basis for processing

  • Contract (Art. 6(1)(b) GDPR): operating your account and processing your listings.
  • Legitimate interests (Art. 6(1)(f)): fraud prevention, security, and improving the Service.
  • Consent (Art. 6(1)(a)): optional marketing communications and non-essential cookies.
  • Legal obligation (Art. 6(1)(c)): compliance with Icelandic law.

4. Sub-processors

We share data only with the following processors, under GDPR-compliant contracts:

  • Supabase (EU region): database and authentication hosting.
  • GatewayAPI (Denmark, EU): SMS delivery for OTP login.
  • Lovable / Cloudflare (EU edge): application hosting and content delivery.
  • Lovable AI Gateway: AI-assisted listing suggestions from uploaded photos (images are processed transiently and are not used to train third-party models).

5. Retention

  • Account data: kept while your account is active; deleted within 30 days of account closure.
  • Listings: 30 days from posting (renewable). Expired listings are anonymised after 12 months.
  • Messages: 24 months from last activity.
  • OTP codes: automatically deleted after 10 minutes.
  • Log data: 90 days.

6. Your rights

Under GDPR you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request erasure ("right to be forgotten").
  • Request restriction of processing.
  • Data portability — receive your data in a machine-readable format.
  • Object to processing based on legitimate interests.
  • Withdraw consent at any time.
  • Lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).

To exercise any of these rights, email privacy@husamus.is.

7. Cookies

We use strictly necessary cookies for authentication and site functionality. We use optional analytics cookies only with your consent. See our FAQ for details.

8. Security

We use industry-standard measures including TLS encryption in transit, hashed OTP codes, and access controls. No system is 100% secure — we will notify affected users and Persónuvernd within 72 hours of any qualifying data breach.

9. International transfers

Personal data is stored within the EU/EEA. If any processor transfers data outside the EEA, we use Standard Contractual Clauses approved by the European Commission.

10. Changes

We will notify registered users of material changes to this policy by email or an in-app notice at least 30 days before changes take effect.