Log in

Privacy policy

Last changed on 4 November 2026

How Mellow handles personal data: what we keep, why, how long, who helps us, and your rights.

Contents
  1. 1.Two roles
  2. 2.Rental owners and staff
  3. 3.Cookies and analytics
  4. 4.A rental's customers
  5. 5.AI features
  6. 6.How long we keep data
  7. 7.Sub-processors
  8. 8.Transfers outside the EEA
  9. 9.Your rights
  10. 10.Security
  11. 11.Changes to this policy
  12. 12.Contact

1.Two roles

Strange Solutions ehf. makes and runs Mellow. The GDPR (EU Regulation 2016/679) and Icelandic Act no. 90/2018 on data protection give us two roles.

Controller for the people we deal with ourselves: the owners and staff of the rentals that use Mellow, their billing contacts, and people who visit mellow.is or write to us. This policy is our notice to them.

Processor for each rental's customers: the people who book, check in, sign and pay. The rental is the controller of that data and decides why it keeps it. Read the rental's own privacy policy, and send your request to the rental. Section 9 says how we help.

2.Rental owners and staff

For these people we are the controller. We keep:

Data
Account: name, email, phone if given, role, language, a hash of the password, two-step sign-in settings
Why
To give you an account and to sign you in
Legal basis
Our contract with the rental (Art. 6(1)(b)), and our legitimate interest in giving its staff access (Art. 6(1)(f))
Data
Sign-in with Google or Microsoft: the email, name and account ID that the provider sends
Why
To sign you in, when you choose it
Legal basis
Legitimate interest (Art. 6(1)(f))
Data
Sessions: IP address, browser and trusted devices
Why
To keep accounts safe and to find misuse
Legal basis
Legitimate interest (Art. 6(1)(f))
Data
Who did what: who changed a booking, and when
Why
To show the rental its history, and for support
Legal basis
Legitimate interest (Art. 6(1)(f))
Data
Usage counts, where they are on (section 3)
Why
To see which screens staff use and where they get stuck
Legal basis
Legitimate interest (Art. 6(1)(f))
Data
Bug reports sent from the app, with a screenshot if one is added
Why
To find and fix faults
Legal basis
Legitimate interest (Art. 6(1)(f))
Data
Billing: the rental's name, kennitala, address, billing email and phone, and our invoices
Why
To bill the rental
Legal basis
Contract (Art. 6(1)(b)), and our duty under Act no. 145/1994 on bookkeeping (Art. 6(1)(c))
Data
Email to us, such as to hello@mellow.is
Why
To answer you
Legal basis
Legitimate interest (Art. 6(1)(f))

3.Cookies and analytics

mellow.is sets two cookies, both to keep a choice you made: lang (your language) and theme (light or dark). Each lasts one year. mellow.is has no analytics and no advertising.

The app sets cookies only to sign you in and to keep your choices:

Cookie
better-auth.session_token
What it does
Keeps you signed in
How long
7 days
Cookie
better-auth.two_factor
What it does
A sign-in that waits for its second step
How long
10 minutes
Cookie
better-auth.trust_device
What it does
A device you chose to trust
How long
30 days
Cookie
station
What it does
A shared desk computer that the rental set up as a station
How long
1 year
Cookie
kiosk
What it does
A kiosk tablet at the rental
How long
1 year
Cookie
aff
What it does
An affiliate's sign-in to the affiliate portal
How long
30 days
Cookie
lang, theme, sidebar, setup, guide, guidemarks, affguide, install
What it does
Your language, light or dark, and what you folded or closed
How long
1 year

Each of these cookies is needed for a service you ask for, or keeps a choice you made. Thus we ask for no consent.

Staff analytics. On the staff screens only, and only for a rental where we turn it on, Mellow sends usage counts to PostHog, which stores them in Frankfurt. The rental tells its staff before we turn it on. PostHog counts pages and clicks, and where on a screen staff click. It hides all text on the screen and the details of each element, and drops personal data. Each event carries a user ID, never a name or an email, and no IP address. Mellow turns off PostHog's screen recording. PostHog keeps its ID in the browser's storage, not in a cookie. The pages that a rental's customers see never load PostHog.

Bot check. Cloudflare Turnstile checks sign-in and some public forms for bots. It reads signals from the browser and the IP address.

4.A rental's customers

For a rental's customers we are the processor. Mellow keeps their data for the rental. It can include:

  • name, email, phone, country, address and date of birth
  • an ID number: a kennitala, or a passport or other ID number
  • driving licence details, and photos of the licence from online check-in
  • the booking: dates, cars, extras, flight number, notes and the price
  • payments: the payment provider's token, the card brand and the last four digits, never the card number
  • signatures on the rental agreement
  • messages between the customer and the rental, by email, SMS and WhatsApp
  • key box codes and, where the rental uses trackers, the position of the car

The rental decides why it keeps this data and for how long. Mellow uses it only to run the service for the rental, under the data processing agreement.

The kennitala. Article 13 of Act no. 90/2018 allows the use of a kennitala when it has an objective purpose and is needed for a safe identification. A rental uses it to identify the driver and on invoices.

5.AI features

Some features send data to an AI provider to get an answer. Mellow does not keep the conversations of the Cow assistant.

  • The Cow assistant, when the rental turns it on: the question, the labels on the screen, and the booking details it looks up, such as the customer's name and email, the drivers' names and the notes. Never an ID number, a date of birth or a licence number.
  • Licence scan: the photo of the licence. The answer is the licence number, the country, the expiry date and the date of birth.
  • Translation: the text of one message.
  • Inbox summaries and sorting, when the rental turns them on: the message thread, the booking facts and the plate.
  • Car scan, when the rental turns it on: photos of the car, its plate and its dashboard.

The provider is Anthropic. Inbox sorting also uses TypeSafe. Both are in the US: see section 8. Neither one uses the data to train its models. Anthropic deletes inputs and answers within 30 days, except content it flags for a breach of its usage policy.

6.How long we keep data

Data
Licence photos
How long
Deleted 90 days after the booking ends: returned, closed, cancelled or no-show. A replaced photo is deleted at once.
Data
Check-in, manage booking and payment links
How long
They stop working 30 days after the return (check-in and manage booking) or after 30 days (payment).
Data
Bookings, payments and invoices
How long
As long as the rental keeps them. Icelandic bookkeeping law makes the rental keep accounting records for seven years. To erase a customer, the rental anonymises them: names, contacts, ID number, date of birth, messages and files go, and the booking and payment rows stay.
Data
A rental's data after it leaves Mellow
How long
30 days for its export, then deleted.
Data
Staff sessions
How long
7 days. A trusted device: 30 days.
Data
Mellow's own monitoring records
How long
Monitor events: 30 days. Error records on the Status page: 90 days.
Data
Cloudflare's logs
How long
7 days: logs, traces and error reports
Data
Staff analytics at PostHog
How long
At most 7 years, as PostHog's plan sets: 1 year on its free plan, 7 years on its paid plans.
Data
AI inputs and answers at Anthropic
How long
Deleted within 30 days, except content flagged for a breach of Anthropic's usage policy.
Data
WhatsApp messages at Meta
How long
30 days at most.
Data
Our invoices to rentals
How long
Seven years, under Act no. 145/1994 on bookkeeping.
Data
Inbox messages and sent mail
How long
No time limit: email, WhatsApp and SMS messages with their media, and sent mail with its full text. They stay until the rental erases the customer, which deletes that customer's messages and sent mail.
Data
Bug reports and their screenshots
How long
No time limit. They stay until Mellow's staff remove the report. The GitLab record of a report holds no personal data.
Data
Email to us
How long
We keep mail sent to us for as long as we need it to answer you and to keep a record of our dealings with you. We delete it when it is no longer needed for that, or when you ask us to, unless the law requires us to keep it, such as bookkeeping records for seven years.

7.Sub-processors

These companies process personal data for Mellow. Each one gets only what its job needs.

Service
Cloudflare
What it does
Runs the app and this website. Database, file store, queues, sending and receiving mail, and the Turnstile bot check.
Data it receives
All data in Mellow
Where
Stored in the EU. The app runs in Milan. A front service at the nearest Cloudflare data centre keeps car types, prices and key checks for 50 seconds, and never customer data. The network that carries the traffic is worldwide.
Service
Resend
What it does
Sends mail from a rental's own email domain
Data it receives
Name, email and the content of the mail
Where
Sent from the EU. Stored in the US.
Service
Anthropic
What it does
The AI features in section 5
Data it receives
As section 5 says
Where
Stored in the US
Service
TypeSafe
What it does
AI Inbox sorting, and matching columns in a file import
Data it receives
Customer messages and booking facts, when Inbox sorting is on. Otherwise no personal data.
Where
US
Service
PostHog
What it does
Staff usage counts
Data it receives
Staff user ID, role, rental, pages and masked clicks. No name, email or IP address.
Where
Frankfurt. Some processing in the US.
Service
Google Workspace
What it does
Mellow's own mailboxes, and sign-in with Google
Data it receives
Email to and from us. For sign-in: the email, name and Google ID.
Where
Google's data centres worldwide
Service
Microsoft
What it does
Sign-in with Microsoft
Data it receives
The email, name and Microsoft ID
Where
The Microsoft region of each account. Personal accounts: Microsoft Ireland.
Service
Payday
What it does
Our invoices to rentals
Data it receives
The rental's name, kennitala, address, billing email and phone
Where
An Icelandic company. Hosted in Ireland, on Microsoft Azure.
Service
Stefna ehf. (Rental Relay)
What it does
Sends the rental the tolls, parking fees and fines of its cars. Only for a rental that orders the Rental Relay add-on.
Data it receives
The rental's name and kennitala, the plates of its cars, and which booking had a car at a given time. No customer name or contact details.
Where
An Icelandic company.

Services a rental connects. A rental can connect its own account at these services. Mellow then sends them data for the rental, on the rental's instructions. The rental has its own agreement with each one.

Service
Rapyd
What it does
Card payments, refunds, deposits and card terminals
Data it receives
Customer name, email and country, the booking reference and the amount. Card details go straight to Rapyd.
Where
Rapyd Europe hf., in Iceland. Processing also in the US, Israel, the UK and other countries.
Service
Meta (WhatsApp)
What it does
WhatsApp messages with customers
Data it receives
Phone number, name, messages and media
Where
Meta's data centres worldwide
Service
Keycafe
What it does
Key boxes
Data it receives
Customer name, email and mobile, and the dates of access
Where
Mainly the EU. Some of its providers are in the US, Canada and other countries.
Service
dkPlus
What it does
The rental's accounting: invoices
Data it receives
Customer name, kennitala, email and country, and the invoice lines
Where
Iceland
Service
Caren
What it does
The move from Caren, and the link to Caren during the move
Data it receives
Bookings with customer details, read from Caren
Where
Iceland
Service
Samgöngustofa
What it does
The kilometre tax report
Data it receives
The plate and the odometer reading
Where
Iceland

SMS goes through a box with a SIM card at the rental. The rental's own mobile operator carries the messages.

These services get no personal data: Aviationstack (counts of arriving flights), the arrivals page of Isavia, GitLab (bug report records with the page address and the time), and an uptime check.

8.Transfers outside the EEA

Some services in section 7 store or process data outside the EEA, mainly in the US. Each transfer has one of these bases:

  • Anthropic: the EU Standard Contractual Clauses, in its data processing addendum, which its commercial terms include.
  • TypeSafe: the Standard Contractual Clauses, in its data processing terms, which its customer agreement includes.
  • Cloudflare, Resend and PostHog: the EU-US Data Privacy Framework, and the Standard Contractual Clauses in each one's DPA.
  • Google: the Data Privacy Framework first, and the Standard Contractual Clauses where it does not apply.
  • Microsoft: the Standard Contractual Clauses.
  • Meta (WhatsApp): the Data Privacy Framework, and the Standard Contractual Clauses as an alternative.
  • Rapyd: the Standard Contractual Clauses.
  • Keycafe: where data goes to a country without an EU adequacy decision, the Standard Contractual Clauses (Module 2) in Keycafe's DPA apply. They take effect when the rental accepts Keycafe's terms for its own Keycafe account, through which Mellow sends the key access. Canada's adequacy decision can apply where Keycafe acts through its Canadian company. Keycafe lists its sub-processors in Schedule 6 of its terms.

9.Your rights

You have the right to:

  • get a copy of your data
  • have wrong data corrected
  • have your data erased
  • limit how we use your data
  • get your data in a file you can take elsewhere
  • object to a use that rests on our legitimate interest
  • take back a consent you gave

Write to privacy@mellow.is. We answer within one month. We can ask you to show who you are.

If you rent from a rental that uses Mellow, send your request to that rental, because it is the controller. If you write to us, we pass your request to the rental and help it answer.

You can complain to Persónuvernd, the Icelandic Data Protection Authority, at personuvernd.is.

10.Security

Mellow's database and files are stored in the EU, and data travels only over encrypted connections. Each rental sees only its own data. Two-step sign-in is there for every account. Our staff open a rental only for support, are asked for a reason, and Mellow logs each visit.

If a breach puts personal data at risk, we tell the rental without undue delay. The rental can then tell Persónuvernd within 72 hours, where the law requires it.

11.Changes to this policy

We update this policy when Mellow changes, such as when we add a sub-processor. The date at the top shows the last change. Before an important change, we email the owners of the rentals' accounts.

12.Contact

  • Strange Solutions ehf., kennitala 690822-0570
  • Address: Holtsvegur 6, 210 Garðabær, Iceland
  • VAT number: 154686
  • Data protection: privacy@mellow.is

Mellow has not appointed a data protection officer, as the law does not require one for Mellow. Send questions about personal data to privacy@mellow.is.