Itefy Privacy Declaration

Updated

1. Who are we?

Itefy is owned and operated by Itefy AS, a Norwegian company. You can find key information about the company at Brønnøysundregistrene. Itefy is a registered trademark owned by Itefy AS.

2. What information are we collecting?

Cookies and tracking
This website sets no cookies and uses no third-party tracking — no advertising networks, no social media plugins, no Google Analytics. Visitor measurement is done with self-hosted, cookieless Plausible Analytics, which stores no personal data and does not track you across sites. Inside the Itefy application we set only the strictly necessary cookies needed to keep you signed in.

See more details about cookies

When signing up
When you sign up for our newsletter, a trial account or use our services as a customer, we collect your e-mailaddress, which is used as your unique username. We also ask for your name, country, timezone and preferred currency.

When becoming a customer
If you decide to begin a subscription, we will ask for a little more information regarding invoicing, such as a company name, address, phone numbers and to which e-mail address we should send a copy of your invoice. 

When you add a payment card, all information about the card is stored by Stripe, which is our payment partner. Itefy only stores a reference code to that information, and is never able to dig into that information itself.

When signing into our services
When you're signing into Itefy, either through the web interface or the mobile app, we temporarily save information about your IP adress and the device/browser you are using, mainly to ensure that you're the one that is signing in. This improves the security of the system, because it enables us to detect any abnormal logins.

3. Why are we collecting the information we collect?

As a principle, we strive to collect only the information we need to offer our services. We collect the information we need to be able to market, sell and provide our services.

4. Where is your information stored, and how is it handled?

Everything stays inside the EU/EEA. Itefy is a European company running on European infrastructure — your data is not transferred to the United States for hosting, and no third-party analytics service is involved at any point.

  • Application servers and databases: Hetzner, Nuremberg, Germany
  • Uploaded files (photos, documents): Amazon S3, Frankfurt, Germany
  • Outgoing email: Amazon SES, Ireland
  • Payments and card data: Stripe
  • Backups: Oslo, Norway
  • Visitor statistics: self-hosted on our own server — no analytics provider involved

Every Itefy account gets its own separate database rather than sharing tables with other customers. All information is stored on servers that are not directly reachable from the internet; only our application servers can reach the databases, and they are secured by best effort and by industry standards.

Some of the measures we take to secure all content and information are:

  • All traffic between our frontend services (web apps and mobile apps) is encrypted (HTTPS/SSL)
  • Each account is isolated in its own database
  • Mobile apps use unique tokens for each session (no common API token for all app installations)
  • All passwords are one-way-encrypted (secure hash+salt)
  • Failed login attempts are delayed and time limited
  • Only our application servers face the internet, and only with necessary ports open
  • Backup procedures are automated, and no backups are exposed to the internet
  • This website loads no third-party scripts, fonts or other external resources — your browser talks only to us

5. How can you access and change your information?

Go to your accounts at Itefy. On this page you will find the Itefy accounts you have access to. Click on My settings to check and change the information that is stored about you.

6. How long do we store your information, and how can I be "forgotten"?

Live data. When a subscription is cancelled the account is deactivated immediately and permanently deleted 60 days later. An expired trial is kept for 30 days after the trial ends and then permanently deleted. You can delete individual content yourself at any time, except log data.

Backups. Backups exist so we can restore the service after a failure, and are never used for anything else. Snapshots are kept on a tapering schedule: every snapshot for 14 days, then one per week up to three months, then one per month up to two years. The most recent snapshot of each server is always retained, so a decommissioned server keeps one final backup.

This means information from a deleted account can persist in older backup snapshots after it is gone from the live system. We do not delete individual records out of existing snapshots — a backup is a point-in-time copy and editing it would defeat its purpose. Deletions are applied to the live system straight away, backup copies age out on the schedule above, and if we ever had to restore from a backup we would re-apply any deletions made since it was taken.

You, as a user, can be deleted from our database on request to support@itefy.com . However, you can not be deleted if you’re an owner of an active account. In order to be deleted in such case, the ownership must either be transferred to another user, or the account must be cancelled.

7. How about the information you as a customer add to Itefy?

The information you as a customer adds to your Itefy account(s) is entirely yours, and thereby your responsibility. You can at any time change or delete content that is added, except log data. However, when cancelling an account, all information on that account will eventually be autmatically deleted, first from the live server and eventually from any backups.