This policy describes how Corveria ehf. handles personal data on corveria.com. It is written to be read, and it only says what the site actually does: there is no analytics and no tracking of visitors, and therefore no cookie banner.
1. Data controller
The controller is Corveria ehf., reg. 590526-1260, 101 Reykjavík, Iceland. Processing is governed by the Icelandic Data Protection Act no. 90/2018 and the EU General Data Protection Regulation (GDPR). Privacy inquiries are answered at [email protected].
2. What we process and why
corveria.com is a brochure site with no user accounts. Processing of personal data is limited to four cases.
2.1 Inquiries through the contact form
When you send us an inquiry through the form on this site, we process your name, email address and the content of your message. The purpose is to answer you and, where relevant, prepare a quote or a contract. The legal basis is steps taken at your request prior to a contract, and our legitimate interest in answering inquiries (Article 6(1)(b) and (f) GDPR, cf. Article 9 of Act no. 90/2018).
2.2 The chat with Anna
The chat on this site is Anna, an assistant Corveria builds and runs itself at annasvarar.is. What you type in the chat is processed for one purpose: answering you. Conversations are stored on Anna’s infrastructure within the EEA, and language models from Anthropic and OpenAI generate the replies — see section 4 on transfers. Don’t put sensitive personal data in the chat; it doesn’t need it to answer. The legal basis is our legitimate interest in answering visitors.
2.3 Server access logs
The server hosting this site records IP addresses and technical details of each visit, as every web server does. The logs are used solely to run the site securely and to diagnose failures or attacks, on the basis of legitimate interest. They are not used to monitor visitor behavior.
2.4 Settings in your browser
The site stores your choice between day and night mode in your browser (localStorage), and text you start writing in the idea field until it is sent (sessionStorage). The chat window stores a conversation identifier so your conversation survives page changes. This information stays in your browser and is never sent to us.
3. Processors
We use few, named processors:
4. Transfers outside the EEA
The site’s hosting, our email and the storage of chat conversations stay within the EEA. Three things can leave it:
- Chat messages can be processed by Anthropic and OpenAI in the United States when replies are generated. The transfer rests on EU Standard Contractual Clauses (SCC) together with a transfer impact assessment. The chat’s search and ranking models run at AWS in Frankfurt, within the EEA.
- Web3Forms runs on servers in the United States. Contact form messages are forwarded to us, not stored there, and the service’s technical logs are deleted regularly.
- Site traffic passes through Cloudflare’s global network, which protects the site against attacks. Cloudflare processes connection data, including IP addresses, and is certified under the EU-US Data Privacy Framework.
5. Retention
We keep nothing longer than its purpose requires:
6. Your rights
You have the right to access the personal data we process about you, to have it corrected or erased, to restrict processing, to object to processing based on legitimate interest, and to receive your data in a machine-readable format. Send your request to [email protected] and we will respond without undue delay, and within one month at the latest.
You can also lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd), personuvernd.is.
7. No analytics, no tracking cookies
corveria.com uses no analytics service and sets no cookies for tracking or marketing. What is stored in your browser (section 2.4) is functionality the site needs, and none of it reaches a third party. That is why there is no cookie banner on this site: there is nothing to consent to.
8. Changes
If the processing changes — for example with a new service on the site — we update this policy here and change the effective date at the top of the page. This policy is effective from 17 July 2026.