Privacy policy

Who we are

Wayside is a self-guided driving tour app for Iceland. It is run by the company that runs Wayside, which is the controller of your personal data. Questions and requests: the contact address below.

What we collect, and why

• Your account: email address and password (stored hashed by our login provider). Used to sign you in and to keep what you have bought or unlocked. You can use the free guide without an account.
• Your location while a drive is running. It is used on your phone to start each story at the right place. To draw road directions, your current position and the next stop are sent through our server to openrouteservice (HeiGIT gGmbH, Germany). We do not store your location or your route.
• A device ID: a random number kept in a cookie on your phone. It links an access code or a purchase to this device, and lets us count how many phones use the app each day and which guide is open. It does not contain your name.
• Access codes you enter, and which partner company issued them, so we can show how long your access lasts.
• Purchases: what you bought and when. Payments are handled by Stripe; we never see or store your card details. Apple Pay is offered through Stripe.
• Scans of partner offers, if you open one, so a partner can see how often their offer is used. No personal details are shared with partners.

Stored only on your phone

Your settings (language, speaking speed, map style), your trip history and summary, and any guides you download for offline use stay in your browser’s storage on your phone. We cannot see them. Clearing your browser data removes them.

Legal basis

• To provide the service you asked for (your account, the guide, purchases): performance of a contract.
• Daily usage counts and partner-offer statistics: our legitimate interest in running and improving the app. They are counted per device, not per person.
• Keeping purchase records: our legal obligation under Icelandic bookkeeping law.

Who processes data for us

• Supabase: database and login.
• Vercel: hosting of the app.
• Stripe: payments, including Apple Pay.
• openrouteservice (HeiGIT gGmbH): road directions, from the position sent with each request.
• Map tiles from OpenStreetMap, OpenTopoMap and Esri: your phone downloads map images directly from them, which shows them your IP address.

Some of these companies are based in, or use servers in, the United States. Where data leaves the EEA, they rely on the EU–US Data Privacy Framework or the EU standard contractual clauses.

How long we keep it

• Account and purchases: until you delete your account. Purchase records are kept for 7 years, as bookkeeping law requires.
• Device usage counts: 13 months.
• Road-direction requests: not stored by us.

Your rights

You can ask to see, correct, export or delete your data, and you can object to our use of it. Delete your account from the Account page, or write to the contact address below. If you think we have handled your data wrongly, you can complain to Persónuvernd, the Icelandic Data Protection Authority (personuvernd.is), or to the authority in your own country.

Children

Wayside is meant for drivers and their passengers. We do not knowingly create accounts for children under 13.

Changes

If we change this policy we will update the date at the top. Bigger changes will be shown in the app before they apply.