Privacy
Last updated
Last updated
October 5, 2026
October 5, 2026
Unnur ehf. Privacy Policy
Effective from October 5, 2026
Unnur ehf. is committed to processing personal data lawfully, fairly and transparently, and to keeping it secure. This policy describes the processing of personal data in connection with Unnur Verkbókhald, the unnurverk.is website, the web app, the mobile app and communications with Unnur.
This policy is based on Act No. 90/2018 on Data Protection and the Processing of Personal Data and Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”).
1. Who is responsible for the processing?
Unnur may act as either a controller or a processor, depending on the nature of the processing.
Unnur as controller. Unnur determines the purposes and means of processing for its own business relationships, invoicing, access control, security, support requests, product development, usage analytics and marketing.
Unnur as processor. Unnur’s customer is generally the controller of the employee, project, location, accounting and other operational data they enter into the service. Unnur then processes the data on the customer’s behalf, in accordance with its instructions and the data processing agreement. Inquiries from individuals about such data should first be directed to the relevant employer or company.
The controller for Unnur’s own processing is:
Unnur ehf.
Company ID (kennitala): 620725-1100
Registered address: Stórholt 3, 603 Akureyri
Privacy contact email: hjalp@unnurverk.is
Privacy inquiries can be sent to the email address above.
2. What personal data is processed?
Depending on which parts of the service are used, processing may include the following data:
identification and contact details, such as name, national ID number, phone number, email address, job title and affiliation with a company;
company, customer and supplier information;
access details, roles, permissions and security information;
project data, project statuses, descriptions, work items, quotes and work orders;
time entries, absences, payroll-related information and approvals;
mileage, vehicle and location data when the relevant feature is used;
product, inventory, material and equipment rental information;
invoices, invoice lines, payment status and related accounting data;
images, attachments, receipts and other uploaded files;
emails and related metadata when email integration is enabled;
questions, answers, conversation history and tool results when the AI assistant is used;
device, browser, IP, session, event and error data;
usage data, such as screens visited, actions selected and features used;
communications with customer support, the sales team and other support.
Unnur asks users not to enter special categories of personal data, such as health information, political opinions, religious beliefs or trade union membership, unless their employer has assessed the processing as necessary and lawful and appropriate safeguards are in place.
3. Where does the data come from?
Data is primarily received:
from the user directly;
from Unnur’s customer, its account administrator or other users within the company;
from the user’s devices, with the device’s permissions where applicable;
from accounting systems, messaging providers, email services and other integrations enabled by the customer;
automatically when the service is used, for example in event logs and usage analytics;
from public registries or other lawful sources when needed for the service or the business relationship.
4. Purposes and legal basis
When Unnur is the controller, processing is based on the following purposes and legal bases:
Providing the service and managing the business relationship
Examples of processing: Account creation, authentication, service delivery, invoicing and communications.
Legal basis: Necessary for a contract with an individual, or legitimate interests in performing a contract with the company the individual works for.
Legal obligations
Examples of processing: Accounting, tax filings and responses to lawful requests from authorities.
Legal basis: Legal obligation.
Security and operational reliability
Examples of processing: Access control, event logs, abuse prevention, error diagnosis and backups.
Legal basis: Legitimate interests of Unnur and its customers in a secure service.
Customer support and product development
Examples of processing: Handling support requests, testing and improvements.
Legal basis: Contract and legitimate interests in providing and improving the service.
Usage analytics
Examples of processing: Measuring usage, performance and feature activity.
Legal basis: Legitimate interests, taking users’ rights into account; consent where required by law.
Marketing communications
Examples of processing: Inquiries, promotions and newsletters.
Legal basis: Consent or legitimate interests, as permitted.
When Unnur is a processor, the customer determines the legal basis for the processing and is responsible for informing its employees and other data subjects about it.
Is providing the data mandatory?
Data marked as required for account creation, authentication, contracting or invoicing must be provided so that Unnur can establish a business relationship and deliver the service. If it is not provided, Unnur may be unable to create an account or fulfil a contract. Data related to optional features, such as location, integrations and the AI assistant, is only processed when the relevant feature is enabled or used.
5. Location data
Location data is only collected when the customer has enabled the relevant feature and the user has granted the necessary permission on their device. Collection may relate to time tracking, mileage or material logging. When active location collection stops, the service should not continue to collect location.
The customer, as employer and controller, is responsible for having an adequate legal basis, giving employees clear information and ensuring proportionality when using location data.
6. AI and automated processing
Unnur uses AI for specific features, including reading and structuring invoice data and in an optional assistant.
When the assistant is enabled, at the user’s request and within their permissions, it can retrieve relevant data from Unnur and send the following to an AI provider:
the text of the user’s question and conversation history;
necessary results from authorized queries, such as information about projects, employees, time entries, invoices, inventory or quotes;
technical instructions that enable the model to respond.
Unnur uses the commercial APIs of AI providers. Unnur may change AI providers or models over time, but only uses providers whose terms do not allow data sent through their APIs to be used for model training, and that only retain such data for a limited period for abuse monitoring and security. The AI providers in use at any time are listed among the sub-processors in Unnur’s data processing agreement.
The assistant can make mistakes. It does not make autonomous decisions that have legal or similarly significant effects on individuals. Changes to data are either carried out by the user in the regular interface or presented as suggestions that the user must review and confirm.
Users should not enter sensitive personal data or confidential information into a conversation unless it is necessary for the task and permitted under the customer’s instructions.
7. Usage analytics, error diagnostics and cookies
Unnur uses technical measurements to ensure functionality, diagnose errors and understand how the service is used. These may include user ID, company ID, device type, IP address, URL, actions in the interface and technical error data.
PostHog is used for usage analytics in the web app and mobile app, hosted in a European region. The web app uses in-memory storage instead of persistent cookies. Input fields are masked in recordings and defined financial values are hidden. Users can request to opt out of usage tracking where such an option is available.
Grafana is used for operational monitoring, metrics and event logging, hosted in a European region. Google Firebase Crashlytics may receive technical crash and device data from the mobile app.
On the public website unnurverk.is, Google Analytics, Google Tags, Meta Pixel and Chatwoot may be used. Where cookies or similar technologies are not strictly necessary, consent is obtained in accordance with applicable rules. Users can withdraw consent or adjust their browser settings, but this does not affect the lawfulness of prior processing.
8. Google user data (Gmail integration)
Unnur offers an optional email integration. If an authorized user at a customer connects a Google Workspace or Gmail account, Unnur accesses data from that mailbox through Google’s APIs, via our email integration provider Nylas. Access is only granted when the user signs in with Google and approves the requested permissions, which include reading and sending email. Unnur never sends email from the connected mailbox unless a user chooses to send it. Access can be revoked at any time.
Data accessed. Depending on how the feature is used, Unnur may access:
the name and email address of the connected Google account;
email messages in the connected mailbox, including their content and metadata such as sender, recipients, subject and date;
attachments in those messages;
emails that users write and send from Unnur, including recipients, content and attachments.
How the data is used. Google user data is only used to provide user-facing features of the email integration:
to show the connected mailbox to the users the customer has granted access within Unnur;
to let users link emails to projects, customers and suppliers;
to save attachments the user selects to a project;
to send emails and replies from the connected mailbox when a user writes and sends them in Unnur;
to send invoices, quotes and other documents from the connected mailbox when a user chooses to send them from Unnur;
when the customer has enabled the AI assistant, to answer a user’s question about their email, or to draft an email or reply, at the user’s request. The assistant does not send email itself; a draft is only sent if the user reviews and sends it (see section 6).
Storage. Unnur stores a copy of emails that users link to projects, including content and metadata, and attachments that users choose to save. Other messages are fetched from Google when viewed and are not stored permanently by Unnur. Access tokens are stored encrypted.
Sharing. Unnur does not sell Google user data and does not use it for advertising, retargeting or profiling. Google user data is only shared with Nylas, which provides the connection to Google, with the hosting providers listed in section 9, and with the AI provider when a user asks the assistant about an email or to draft one, in each case only to provide the feature. It is otherwise only disclosed where required by law. Unnur staff do not read Google user data unless the user has given explicit consent, it is necessary for security purposes, or it is required by law.
AI and machine learning. Unnur does not use Google user data to develop, improve or train generalized AI or machine learning models, and our AI provider does not use data sent through its API for model training.
Revoking access and deletion. An administrator can disconnect the account at any time in Unnur’s settings. Unnur then revokes access at Google and deletes the stored access tokens. Access can also be revoked from the Google account at myaccount.google.com/permissions. Emails linked to projects and saved attachments are part of the customer’s project data and are retained as described in section 11; they can be deleted at any time by the customer or on request to hjalp@unnurverk.is.
Limited Use. Unnur’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
9. Recipients and service providers
Unnur does not sell personal data and does not use it to build advertising profiles for third parties.
Data may be shared with:
hosting and data storage providers, including DigitalOcean and Amazon Web Services;
security, operational monitoring and usage analytics providers, such as Grafana, PostHog and Google Firebase;
communications and authentication providers, such as Google and Twilio;
AI and document processing providers, as listed in the data processing agreement;
integration providers enabled by the customer, for example messaging providers, accounting systems and email services;
advisers, auditors or public authorities when required by law or a lawful request.
Service providers that process personal data on Unnur’s behalf are bound by contract, confidentiality and appropriate security requirements. A more detailed list of sub-processors is available in Unnur’s data processing agreement.
10. Transfers outside the European Economic Area
The service’s core data is stored in European regions. However, some service providers, particularly AI, communications and analytics providers, may process or retain limited data outside the EEA, including in the United States.
Such transfers only take place on a recognized basis under Chapter V of the GDPR, such as an adequacy decision, the European Commission’s standard contractual clauses and, where appropriate, supplementary safeguards. Information about the relevant safeguards can be obtained by contacting Unnur.
11. Retention period
Personal data is not retained longer than necessary:
account and business relationship data is retained for the duration of the business relationship and thereafter for as long as necessary for legal claims or legal obligations;
accounting data that Unnur retains as controller is kept for the period required by accounting law, generally seven years from the end of the relevant financial year;
data that Unnur processes on behalf of a customer is retained according to the customer’s instructions and the data processing agreement;
assistant conversations are stored in Unnur until the user deletes them or the customer instructs deletion; copies at the AI provider are only retained for a limited period under the provider’s terms;
security, event and diagnostic data is kept for a limited period according to the internal retention schedule and risk;
support requests are retained while being handled and thereafter for as long as necessary to trace service and defend legal claims;
copies of deleted data may temporarily remain in secure backups until overwritten in the regular backup cycle.
When the retention period ends, data is deleted or anonymized.
12. Security
Unnur applies appropriate technical and organizational measures in proportion to risk, including:
encryption of data in transit;
access control, roles and authentication;
separation of customer data;
backups and recovery procedures;
event logging, operational monitoring and error diagnostics;
secrets management and restriction of staff access;
updates, vulnerability management and regular security reviews;
confidentiality obligations for those with authorized access.
No system is entirely risk-free. If a security breach occurs, it is handled in accordance with documented procedures and legal notification obligations.
13. Individuals’ rights
When Unnur is the controller, an individual may, where the legal conditions are met, request:
access to their personal data;
rectification of inaccurate or incomplete data;
erasure of data;
restriction of processing;
portability of their data;
to object to processing based on legitimate interests;
to withdraw consent without affecting the lawfulness of processing before withdrawal;
information about appropriate safeguards for transfers outside the EEA.
Requests can be sent to hjalp@unnurverk.is. Unnur may request information to verify the requester’s identity.
If a request concerns data that Unnur processes on behalf of a customer, it should generally be directed to the relevant employer or company. Unnur assists the customer in handling the request in accordance with the data processing agreement.
An individual may lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), personuvernd.is, if they believe the processing of personal data violates the law.
14. Changes to this policy
Unnur reviews this policy when changes occur in the service, processing or legislation. The latest version is available at unnurverk.is/personuvernd. Material changes will be announced with reasonable notice, for example in the service or by email.
15. Contact
Questions, comments and requests regarding privacy can be sent to:
Unnur ehf.
Stórholt 3, 603 Akureyri
hjalp@unnurverk.is