Privacy at Telva.

1. Who is responsible

Telva ehf., ID no. 490626-0930, Suðurlandsbraut 6, 108 Reykjavík, Iceland, is the controller of personal data about visitors to telva.is and about people who contact the company. Email: telva@telva.is.

When a company uses Telva as its operating system, that company is the controller of the data it enters into the system or retrieves from its accounting system. Telva is then the processor and processes the data on the company’s instructions. Employees and customers of a company who want to exercise their rights regarding data in the system should contact that company.

2. Data the website processes

• Demo requestsName, company, email address, phone number if entered, type of business and the goals selected. Purpose: answer the request and book a demo. Basis: a request by the individual for information or a demo before a contract is made (Article 6(1)(b) of Regulation (EU) 2016/679).
• Access to manualsName, company, email address, phone number if entered and the name of the manual that was opened. Purpose: give access to the manuals and respond to companies that read them. Basis: Telva’s legitimate interest in responding to those who show interest in the system (Article 6(1)(f) of the same Regulation).
• Website analytics (Vercel Web Analytics)Vercel states that the measurement uses no third-party cookies, identifies visitors by a hash created from the incoming request, and discards the session automatically after 24 hours. Recorded data includes the page URL, referrer, geolocation, operating system, browser and device type. Purpose: understand how the site is used. Basis: Telva’s legitimate interest. See Vercel Web Analytics privacy documentation.
• Website speed (Vercel Speed Insights)Vercel states that the measurement is anonymous and not tied to any individual visitor or IP address. Recorded data includes the page, network speed, browser, device type, operating system, country and load measurements (Web Vitals). Purpose: understand how fast the site loads. Basis: Telva’s legitimate interest. See Vercel Speed Insights privacy documentation.
• Rate limitingThe sender’s IP address is read to limit requests to five per minute. It is kept only briefly in the server’s memory and is not stored with the request.

Requests from the website are written to a server log at Vercel, which hosts the website, and sent by email to telva@telva.is through Resend. The email stays inside Telva, in Telva’s email system, and only a reply from Telva staff goes to the sender. Telva sends no automatic confirmation to the email address entered.

3. Cookies and browser storage

The website sets no advertising or tracking cookies.

• After the manuals form is submitted, the browser stores the date of access in localStorage so the form need not be filled in again. It is not sent to Telva and disappears when the site data is cleared in the browser.
• The browser stores a flag in sessionStorage showing that the front page opening animation has already played. It goes nowhere and disappears when the tab is closed.
• A restricted data area, reachable only through a link from Telva, sets one necessary session cookie that keeps the access and expires automatically.
• The screensaver page /skjavari loads a font from Google Fonts. Google then receives technical information from the browser, such as the IP address.

4. Company data in the system

Telva processes the data a company enters into the system or retrieves from its own operating systems, such as its accounting system. The company decides which data goes into the system and for what purpose. Each company’s data is tied to that company and the access rights of its users, and users get access by role.

The database of the system at app.telva.is is currently hosted by Supabase in Stockholm (eu-north-1). Which parties process a company’s data depends on its setup, connections and the modules it uses. A fuller description of infrastructure and access control is on the page Öryggi (security, in Icelandic).

5. Connecting a Google or Microsoft mailbox

A company can connect its mailbox to Telva at Google (Gmail and Google Workspace) or Microsoft (Outlook and Microsoft 365), so that invoices, quotes, reminders and customer statements are sent from the company’s own email address. A user acting for the company grants the connection at Google or Microsoft.

• The permission is for sending email only: gmail.send at Google and Mail.Send at Microsoft. At Microsoft, Telva also requests Mail.Send.Shared, a permission to send from a shared mailbox the user has access to. Today Telva sends only from the mailbox that was connected.
• Telva also requests identity scopes (openid, email, profile) to confirm which email address is connected. At Microsoft, User.Read and offline_access are added so that sending works without the user being signed in at that moment.
• Telva does not request permission to read, search, modify or delete email, and retrieves no email from the mailbox.
• Telva sends only messages that a user of the company has prepared and confirmed in Telva after a preview. A test message is sent when the user presses a button. System emails from Telva continue to be sent from Telva itself, not from a company mailbox.

Telva stores the connected mailbox address, which provider it is with, the account identifier at the provider, who connected it and when, which permissions were granted, and the send permission itself (a refresh token). The token is encrypted with AES-256-GCM using a key derived separately for each company, and is bound to that company. The access token lives only in memory while mail is sent. Every action (connected, disconnected, test, refusal) is logged in the company’s data without tokens.

The messages Telva sends are prepared in Telva. Telva keeps a record of each send (sender, recipients, time and result) and stores the message encrypted in the company’s data.

A company administrator can disconnect the mailbox at any time in Settings. Telva then deletes the send permission from the system and revokes the grant at Google. If that fails, the user can remove Telva’s access in the security settings of their Google account. Microsoft does not offer revocation for applications through this route, so there Telva deletes the permission from the system and the user can additionally remove the access in the settings of their own Microsoft account. If the connection breaks, for example because the grant is revoked at the provider, Telva stops sending and tells the company in the system. Mail is then not sent from Telva’s own address instead.

For information received from Google APIs, the following statement applies, as Google requires:

Telva's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In short, Telva uses information from Google only to provide the sending feature visible in the user interface. It does not transfer the information to others except to provide that feature with the user’s consent, for security purposes, to comply with law, or in a merger or sale of assets with explicit prior consent. It does not allow humans to read the information unless the user has agreed specifically or security or law requires it. Telva does not sell it, does not use it for advertising and does not use it to assess creditworthiness. See the Google API Services User Data Policy.

6. Processors

These parties take part in Telva’s service in different ways. Which of them process a company’s data depends on its setup, connections and the modules it uses.

• VercelHosting and delivery of the website and the system, and website analytics
• ResendEmail, including the notification to Telva about requests from the website
• SupabaseData storage of the system
• CloudflareNetwork services
• Microsoft AzureConnection to Business Central
• AnthropicAI processing in the system
• GitHubSource code and releases
• Google WorkspaceTelva’s email system, where requests from the website arrive
• Google and MicrosoftOnly when a company connects its mailbox, as described in the mailbox section above

Some of these are US companies, so processing or access may take place outside the European Economic Area. Such a transfer must rest on a basis permitted by data protection law, such as standard contractual clauses or participation in the EU-U.S. Data Privacy Framework. Resend states in its data processing agreement that it participates in the framework. Telva provides further information on the protection of transfers on request.

7. How long data is kept

• Requests from the website are kept no longer than needed for the communication with the sender.
• Vercel Web Analytics: the visitor session is discarded automatically after 24 hours.
• Mail connection: the send permission is kept until the connection is disconnected. On disconnection it is removed from the system.
• Company data in the system: retention depends on each company’s setup and service agreement.
• Send records and encrypted messages: retention follows the retention of the company’s data in the system, as in the line above.

8. Your rights and complaints

A person whose data Telva processes has the right of access, rectification, erasure and restriction of processing, the right to object to processing based on legitimate interests, and the right to receive the data in a structured format. Where processing is based on consent, it may be withdrawn at any time.

Requests about rights go to telva@telva.is. A reply is given within one month of receiving the request. If the request concerns data a company entered into the system, contact that company, which is the controller of that data.

Anyone who believes processing breaches data protection law can complain to the Icelandic Data Protection Authority: personuvernd.is.

9. Changes to this policy

If the processing changes, this page is updated and the date at the top is changed. If the use of information from Google changes in a way the user has not already agreed to, consent is obtained again before the information is used in the new way.