Privacy in Skýjadrif

Who is responsible

Skýjadrif is run by Datatech ehf., reg. no. 420115-0240, Suðurlandsbraut 54, 108 Reykjavík, Iceland. Send privacy questions and requests to hjalp@datatech.is or call +354 571 9300.

Datatech is the controller of the data about you as a user: your account, your invoices and the security records. For the content you store, Datatech is the processor. We store it, show it to you and give it back, and process it for no other purpose. Clause 9 of the Skýjadrif terms is the data processing agreement for it.

If the account belongs to a company, for example your employer, the company is the controller of the content stored there and Datatech processes it on the company's behalf.

What we keep

• Your account: name, email address, phone number, Icelandic ID number (kennitala) for invoicing, language, and when the account was last used. We do not store your password, only a value computed from it that cannot be turned back into the password. Recovery codes are stored the same way.
• Your files and information about them: names, folders, size, dates, older versions, favourites and tags. For photos and videos we make thumbnails and read camera data, such as when a photo was taken and on which camera. Location data from photos is not stored.
• Computers you connect: the computer's name, the operating system, the program version, which folders are backed up, and the status of the last backup, that is how many files were checked, sent or failed.
• Share links: when a link was opened, whether that succeeded, and which browser was used.
• Activity log: sign-ins, settings changes, deletions, shares, connected computers, and every time Datatech staff open the account. Each entry records the browser and the IP address, which is stored only as a computed value. You can see the entries under Activity log in your settings.
• Subscription and payments: your plan, invoices and payment status.
• Errors: when something breaks we record the error message, the page, the browser and which account was involved, so the error can be fixed.
• Visits to public pages, such as sign-in and sign-up, are counted without cookies. We record the page, where the visitor came from, the country and the type of device. A visitor is identified only by a value that changes every day, so visits are not linked from one day to the next.

Why, and on what legal basis

• To provide the service: storing, showing and returning your data, backing up computers, and sending you email and SMS about your account, for example before a trial ends. The legal basis is our contract with you.
• To invoice and collect payment. The legal basis is the contract and the Icelandic Bookkeeping Act no. 145/1994.
• To protect your account and the service, with the activity log, limits on sign-in attempts and monitoring for abuse. The legal basis is our and your legitimate interest in a secure service.
• To fix errors and improve the service, with error records and visit counts. The legal basis is legitimate interest.

We do not sell data about you, use it for advertising or build profiles of you. Skýjadrif sets no cookies from advertisers or analytics companies. No content from your files is sent to AI or any other analysis outside the service. If we offer anything like that later, it will only run where it has been chosen, and this policy will be updated first.

The Skýjadrif Afritun program

The program backs up the folders you choose and reads no other files on the computer. Files travel encrypted over the internet straight into storage. The program never sees your password: you connect the computer by signing in in your browser and confirming with an authenticator code.

The program regularly tells us how it is doing: its version and, for each folder, whether the backup succeeded and how many files were checked, sent or failed. That is how we can tell you when a computer has not finished a backup in three days.

The program sends no usage analytics or crash reports to anyone else. Its error log stays on the computer. The key that connects the computer to your account is stored on the computer and protected by Windows. You can disconnect the computer at any time, in the program or under Devices in your settings on the web.

The program is available from the Microsoft Store. Microsoft handles the download and updates under its own privacy policy. We send Microsoft no information about you.

Whole-computer backup

If you use whole-computer backup, the computer's user folders and fixed drives are backed up every four hours into storage that belongs to that computer alone. Backups are encrypted on the computer before they are sent.

Datatech keeps a copy of the key the backups are encrypted with, so the computer can be restored even if it is lost or destroyed. We use the key only when you ask for a restore or when the law requires it.

Older backups are thinned out by fixed rules. We keep the 12 newest, one a day for 30 days, one a week for 12 weeks and one a month for 12 months.

Where data is stored and who processes it with us

Your data is stored inside the European Economic Area. These companies process it for us, each only what its task needs, and each is bound by a data processing agreement:

• Supabase: database and sign-in. Frankfurt, Germany.
• Wasabi: storage of files and backups. Amsterdam, the Netherlands.
• Vercel: hosting of the website and the service. Frankfurt, Germany.
• Resend: sending email.
• Upstash: rate limiting. Holds only an account identifier or a computed value of an IP address, and only for a short time.
• 1819: sending SMS. Iceland.
• Payday: invoicing and bank payment claims. Iceland.

Supabase, Wasabi, Vercel, Resend and Upstash are US companies. Where data leaves the EEA, for example an email on its way to you or a sign-in that Vercel checks at the server nearest to you, the transfer relies on the EU standard contractual clauses or the EU-US Data Privacy Framework.

We will tell you before a new sub-processor is added, as clause 9 of the terms says.

Others receive data about you in two cases only: if an invoice goes to debt collection, Inkasso receives your contact details and the details of the claim (clause 12 of the terms), and when the law or a court order requires us to hand data over.

How long we keep data

• Files you delete go to the trash and leave it after 30 days, or at once if you empty it. While an account is locked for non-payment the countdown stops until it opens again.
• After that, a locked backup copy of the file can remain in storage for up to 90 days. It protects data from being deleted in an attack, for example by ransomware, and no one can reach it through Skýjadrif. Thumbnails go at once.
• Older versions of files the program backs up are kept for as long as the file exists.
• A trial that does not become a subscription: the data is deleted 61 days after the trial ends, and only after we have warned you and named the date.
• When a subscription ends you get time to download your data. It is never deleted without notice, and never because of non-payment.
• Invoices are kept for seven years from the end of the financial year, as the Bookkeeping Act requires.
• The activity log and share-link access records are kept while the account exists and deleted 12 months after its data has been deleted.
• Sign-in attempts are kept for 12 months, error records for 90 days and visit counts for 400 days.

Security

All traffic is encrypted, and files are also encrypted in storage. Two-factor authentication is required for every user. Datatech staff cannot reach your content except in the cases clause 4 of the terms describes, and every such action shows in your Activity log. If a security breach affects your data, we will tell you within 72 hours of becoming aware of it.

Read Datatech's security policy

Your rights

Much of this you can do without contacting us: change your name and phone number in settings, download all your data at once, delete files and disconnect computers.

You have the right to know what data we hold about you and to get a copy, to have wrong data corrected, to have data erased, to restrict processing, to object to processing based on legitimate interest, and to receive your data in a machine-readable format. Send your request to hjalp@datatech.is. We confirm who you are before acting and answer within a month.

If the account belongs to a company, we refer requests about its content to the company, which is its controller, and help it answer.

If you think your data is not being handled correctly, you can complain to the Icelandic Data Protection Authority (Persónuvernd) at personuvernd.is.

Changes

We update this policy when the service changes. We announce material changes by email before they take effect.