Privacy policy.

• Booking details: your name, email, phone number, country, dates, guests, room choices and any special requests.
• Payment details: handled by our payment provider, Paystrax. We receive only the result, the card brand, its last four digits and expiry, and a reference that lets us charge a stored card under our booking terms. We never see or store your card number.
• Messages: what you write to us, including questions to the Stofa concierge.
• Hotel accounts: for hotel partners, the account email and the company and payout details given in verification.
• Usage data: pages visited and basic device information, through cookie-free Vercel analytics and, only if you accept cookies, Google Analytics.

• To make and manage your booking and take payment: necessary for our contract with you.
• To send booking emails, and service messages such as a request to update a declined card.
• To answer your messages and run the concierge.
• To keep accounting records the law requires.
• To understand and improve the site: Google Analytics only with your consent.
• To send news and offers only if you opted in; you can unsubscribe at any time.

We share data only as far as each needs it:

• Your hotel, which receives your reservation and contact details to host you.
• Paystrax (Malta), our payment provider.
• Travia (Iceland), the system that passes reservations to hotels.
• Supabase (database, hosted in the EU) and Vercel (website hosting).
• Resend (email delivery).
• Anthropic, which provides the AI behind the concierge, for the messages you send it.
• Google, for Google Analytics, only if you accept cookies.

Some of these providers are based in, or use services in, the United States. Where data leaves the EEA we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We never sell your data.

Stofa uses cookies that are strictly needed for the site to work, such as keeping hotel partners signed in. Analytics cookies from Google are set only after you accept them in the cookie banner; you can change your choice at any time with the “Cookie settings” link in the footer.

Booking and payment records are kept for seven years, as Icelandic bookkeeping law requires. A stored card reference is deleted when its booking is settled or cancelled. Messages and enquiries are kept for up to two years, and analytics data for up to fourteen months.

You can ask for a copy of your data, have it corrected or deleted, object to or restrict how we use it, and take it with you. Where we rely on consent you can withdraw it at any time. Write to hello@stofaiceland.com; we reply within one month. Records the law requires us to keep cannot be deleted before their time.

You can also complain to the Icelandic Data Protection Authority (Persónuvernd), or to the data protection authority where you live.

We will update this policy when how we use data changes, and show the new effective date above.