Privacy policy

This policy explains what personal data we collect on onepaybutton.com, why, and what rights you have. OnePayButton is in development and not yet available; today this website only collects data through the waitlist form and when you email us.

1. Who is responsible for your data

The data controller is OnePayButton, founded by Berglind Saga B, based in Iceland. [To be completed before launch: legal entity name, registration number (kennitala), and postal address.]

Contact for any privacy question: hello@onepaybutton.com.

Iceland is part of the European Economic Area (EEA). The EU General Data Protection Regulation (GDPR) applies through the EEA Agreement and is implemented in Icelandic law by Act No. 90/2018 on Data Protection and the Processing of Personal Data.

2. What we collect

When you join the waitlist

• Your email address (required).
• Your name, country, what you would pay with or get paid in, and a message, only if you choose to give them.
• Which group you belong to (for example shopper, merchant, developer, or partner/investor).
• Your consent to receive updates, and the date and time you signed up.

When you email us

Your email address, name, and whatever you include in your message.

Technical data

Like any website, our hosting provider processes your IP address and basic request information (such as browser type and the page requested) to deliver the site, keep it secure, and prevent abuse. These logs are kept for a short period by the hosting provider.

We do not use advertising trackers or analytics cookies, and this website does not set cookies. If that changes we will update this policy and ask for consent where required.

3. Why we use it and our legal basis

• To manage the waitlist and send you updates about OnePayButton and early access. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time.
• To reply when you contact us, including partnership and investor enquiries. Legal basis: our legitimate interest in answering you, or steps you ask us to take before entering into an agreement (Art. 6(1)(f) and 6(1)(b)).
• To keep the website secure and prevent spam or abuse. Legal basis: our legitimate interest in operating a safe service (Art. 6(1)(f)).

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

4. Who we share it with

We only share data with service providers that help us run the website and the waitlist, such as:

• Our website hosting provider (Vercel Inc.).
• The email or form-processing service we use to receive and store waitlist submissions. [To be completed: name the provider(s) actually used, e.g. Resend, and any spreadsheet or CRM tool.]

These providers act on our instructions under data processing terms. Some may process data outside the EEA (for example in the United States). Where that happens, we rely on safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. We may also disclose data if the law requires it.

5. How long we keep it

We keep waitlist data until you unsubscribe or ask us to delete it, or until we close the waitlist, whichever comes first. [To be confirmed: a maximum retention period, e.g. 24 months after your last interaction.] Emails you send us are kept for as long as needed to handle your enquiry and any follow-up.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we process it;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting processing that happened before you withdrew it.

To use any of these rights, or to leave the waitlist, email hello@onepaybutton.com or use the unsubscribe link in any update we send. We will reply within one month.

You also have the right to complain to a data protection authority. In Iceland this is Persónuvernd (the Icelandic Data Protection Authority), www.personuvernd.is. If you live elsewhere in the EEA, you can contact your local authority.

7. Security

We use reputable providers, encrypted connections (HTTPS), and limited access to waitlist data. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

8. Children

The waitlist is not intended for anyone under 16, and we do not knowingly collect their data.

9. Changes to this policy

We will update this policy as OnePayButton develops, and in any case before the product launches. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you.