What data we process

Controller

The controller of the processing is the seller of the service. Send questions and requests for access to, correction or deletion of data to the email address below.

Seller

DB consulting ehf.

Registration number (kennitala)

600722-1070

Address

Mánatúni 6, 105 Reykjavík

Email

hallo@altalandi.is

VAT number

145531

Your text and the text bank

The text you send goes to the language model providers that do the work (for example through OpenRouter) and is processed under their terms.

Text from free use is kept. Texts you send free of charge, on the front page without signing in or within your account's free daily allowance, are kept in a text bank together with the results. We use the bank to improve the service: to review and correct translations, test new versions, and train and tune the models that Altalandi uses.

Personal data is removed. Before text goes into the bank, we replace Icelandic ID numbers (kennitala), email addresses, phone numbers, card numbers, bank account numbers and API keys with markers such as [kennitala]. Names and other details that cannot be found with certainty may remain, so do not send sensitive personal data in free use.

You can opt out. Choose “Don't keep my texts” in the text box's menu on the front page (your browser remembers the choice), or “Ekki geyma texta úr ókeypis notkun” (don't keep text from free use) under Settings; that setting applies to the whole account, including the API and the command-line tool. In a single API call, you send "contribute": false.

Text from paid use is not kept. Texts paid for from credit are not kept unless you specifically allow it, in your account or with "contribute": true.

Legal basis and retention. Keeping text from free use is based on Altalandi's legitimate interest in improving the service (Article 6(1)(f) of the General Data Protection Regulation, cf. the Data Protection Act No. 90/2018), and you can object to it at any time as described above. Keeping text that you specifically allow is based on your consent. Texts are deleted from the bank after three years. You can ask for a particular text to be deleted sooner by sending us the request ID (it starts with r_). Keeping text from free use covers texts sent from 7 October 2026 onwards; older texts were not kept without consent.

Text you send through the ChatGPT connection is not kept in the text bank, even if you have allowed text to be kept elsewhere in your account. We log usage and keep an operation ID and a fingerprint of the input to prevent double processing and double charging. The fingerprint is computed with a secret key; neither the input nor the result is stored to be sent again on a repeated request. Language model providers still process the text as described above.

Accounts

• Username and password: passwords are stored only as hashes (PBKDF2), never as plain text.
• Sign-in with Google: if you choose this option, we receive your Google account ID and email address. We ask Google for nothing else, and we do not use the email address for marketing.
• API keys: only a hash of the secret part is stored. The key that altalandi login fetches is saved on your computer, but we do not hold it in readable form.
• Passkeys: we store only the public part of the key, the name it is given, whether it is synced between devices, and when it was added and last used. The private key stays on your device and never reaches us. You delete passkeys under Settings.
• Connected apps (for example ChatGPT): when you connect an app to your account, we record the connection: which app, which API key you chose, the permissions you approved (to fix text, to see the status of fixes), whether the connection may use credit, and when it was made. The connection's access and refresh tokens are stored only as hashes. While you sign in and approve, we keep the app's connection request, tied to your browser by a secret key that we store only as a hash; the request is valid for 15 minutes and expired requests are deleted regularly. You can disconnect an app at any time under Connections, and its connection then stops working immediately. Disconnecting does not delete usage and accounting records already created, nor the record that the connection existed.

Usage and security

For each call we record the time, the key, the account, the IP address, the length of the text, which language models were used, the number of tokens, the estimated cost and how the call ended. This information is needed to calculate usage, settle credit and detect misuse. Sign-ups, sign-ins (including failed ones) and the creation and revocation of keys are recorded with the IP address. IP addresses are deleted after 90 days; everything else is kept for the cost and accounting history.

Payments

Payments are made on Kling's payment page (kling.is). Altalandi never sees card numbers. We keep only the IDs that Kling assigns to the customer and the payment method, and the card's label (for example “Visa •••• 4242”), so that you can see which card is saved. Credit transactions are recorded so that you can see where your credit went.

Cookies

We use only necessary cookies: a sign-in cookie for the development site and a short-lived cookie that protects sign-in with Google. No advertising or tracking cookies are used.

Your rights

You have the right to see the data connected to your account, to have it corrected, or to have your account deleted. You can delete keys under API keys. Send a request to hallo@altalandi.is. You can also contact the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).