Privacy policy

1. What information do we collect and why?

For the definition certain of terms used in this privacy policy, please refer to our Terms of use.

In short: The personal information we collect is the information that you provide to us.  We collect personal information that you voluntarily provide to us when you register on the Platform, express an interest in obtaining information about us or our products and Services, or otherwise when you contact us.

Personal Information Provided by you.

We collect your personal information for the purpose of providing our Services to both our Users and our Partners. For instance, we collect your personal information when you create an account on our Platform and when you communicate with us. Additionally, we may have to collect billing information in order to receive compensation for provided Services. The personal information that we collect depends on the context of your interactions with us and the Platform. The personal information we collect may include the following:

• names
• address
• age
• email addresse
• username
• password
• job title
• mailing addresses
• contact or authentication data

Sensitive Information.

We do not collect sensitive information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Platform or use our Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Platform or Services, and other technical information. This information is primarily needed to maintain the security and operation of our Platform and Services, and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies and similar technologies. The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).

• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

All personal information that you provide to us must be true, complete, and accurate,

and you must notify us of any changes to such personal information.

2. How do we process your information?

In Short: The purpose for the processing of your information is to provide, improve, and administer our Platform and Services, communicate with you, for security and fraud prevention, and to comply with applicable law. We may also process your information for other purposes with your consent. We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate the delivery of Services to the User/Partner. We may process your information to provide you with the requested service.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
• To protect our Platform and Services. We may process your information as part of our efforts to keep our Platform and Services safe and secure, including fraud monitoring and prevention.
• To identify usage trends. We may process information about how you use our Platform and Services to better understand how they are being used so we can improve them.
• To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

3. What legal bases do we rely on to process your personal information?

We are committed to comply with the relevant and applicable data protection legislation. This privacy policy is based on the Icelandic Act on the protection of privacy as regards the processing of personal data, no. 90/2018.

We process your personal information, in line with the aforementioned purpose, based on your consent. The personal information is provided by you when you contact us, visit or sign up on our Platform or use our Services.

4. When and with whom do we share your personal information?

Massif does not sell or transfer your personal data to third parties. We may share your personal data with third-party service providers who assist us in operating the Platform and delivering our Services (such as hosting and infrastructure providers). These providers are contractually bound to process your data only on our behalf and in accordance with applicable data protection law.

Within the Platform, information you share with your team or organisation is visible to the other members of that workspace, as intended by the collaborative nature of the Service. You control what you share within your workspace.

We will not share your personal data beyond the above unless required by law, court order, or with your explicit consent.

5. Do we use cookies and other tracking technologies?

We use cookies on our website to improve your browsing experience. The cookies are used for the following purposes:

• Keeping you signed in.
• Understanding how you use our website.
• Remembering your preferences and other settings.

There are four different types of cookies we use on our website, they are as follows:

• Necessary – Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.
• Preferences – Preference cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.
• Statistics – Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

You can both opt-in and opt-out from the usage of certain cookies. This does not apply to the cookies which are deemed “necessary”, as they are crucial to the functioning of our website.

6. Is your information transferred internationally?

Your information is either preserved with us or with companies which we hire and are located within the EEA, where the rules on data protection are identical to the ones in Iceland. Your information will not be shared with a third-party, unless it is based on law, court order, regulations, processing agreement or your consent.

7. How long do we keep your information?

In Short: We keep your information only as long as we need it to provide our Services. When you close your account, we delete it within 30 days, and from our backups within 90 days.

We retain your personal data and the content you store on the Platform for as long as your account is active and we need it to provide the Services. When you or your organisation close an account, or ask us to delete it:

• 
  you can export your data, including your location databank, at any time before deletion;
• we remove your data from our active systems within 30 days of the request; and
• copies held in our encrypted backups are purged on our normal backup cycle, within 90 days at the latest.

The only exception is information we are required by law to keep, such as billing and accounting records, which we retain only for the period the law requires and then delete.

8. How do we keep your information safe?

We use appropriate technical and organisational measures to protect your data, and we host it within the EEA.

We take all reasonable technical and organisational measures to protect your personal data, with special regard to the nature of the data. These measures include:

• access controls that limit data access to authorised personnel on a need-to-know basis;
• logical separation of each organisation's workspace and data;
• encryption of data in transit (TLS/HTTPS) 
• hosting entirely within the European Economic Area;
• regular backups; and
• logging and monitoring to detect and respond to security events.

We align our practices with recognised security standards and keep them under regular review. We only use compliant third-party services for data and storage. No method of transmission or storage is completely secure; we work continuously to protect your information and to strengthen our safeguards.

9. What happens in the event of a data breach?

If a breach affecting your data occurs, we act quickly and tell you without undue delay.
We maintain a process to detect, investigate and respond to personal data breaches. If a breach affecting your personal data occurs, we will notify the Icelandic Data Protection Authority (Persónuvernd) within 72 hours where required by law, and we will inform the affected Users and organisations without undue delay, in practice within 72 hours of confirming the incident, telling you what happened, what data was involved, and the steps we are taking to contain and remediate it.

10. Do we use your data or content to train AI models?

No. We do not use your content to train AI models.

Our Platform includes AI-powered features. These features process your content only to provide the Service to you. We do not use your content, including your location database, to train, develop or improve any AI or machine-learning model, and we do not use it for marketing. To improve our Platform we rely only on aggregated usage information, such as which features are used and error reports — never the contents of your database.

Where an AI feature relies on a third-party provider to process your content, that provider acts only on our behalf and is contractually prohibited from using your content to train its own models.



11. Do we collect information from minors?

No, we do not actively collect information from minors.

12. What are your privacy rights?

Massif would like to make sure you are fully aware of all of your data protection rights. Every User and Partner is entitled to the following:

The right to access – You have the right to request for copies of your personal data.

We may charge you a small fee for this service.

The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete.

The right to erasure – You have the right to request that we erase your personal data,

under certain conditions.

The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.

The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.

The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email:

Call us at: +354 822 2507

Or write to us: [email protected]

13. Do we make updates to this notice?

We keep our privacy policy under constant review and we post any updates on this web

page. This privacy policy was last updated in June 2026.

14. How can you contact us about this notice?

If you have any concerns or questions regarding this privacy policy, you can contact us at: support(att)massif.network