Privacy at Riparim

Login and account

Riparim uses Supabase for login and user account management. When you log in by email, Supabase processes your email address, password and, if provided, your name.

If you choose “Log in with Google”, Supabase and Riparim receive your Google account ID, email address, its verification status and basic profile information such as your name. We use this data to log you in, associate your account and check access to your own submissions. The requested Google permissions are limited to openid, email and profile.

Riparim also verifies the Google identity on the server. The Supabase session data is then stored in the login cookies. Submissions from an earlier ChatGPT login are linked only when the previous access is verified and the email address matches.

Cookies and login protection

For login, Riparim uses technically necessary cookies to store and renew your session. A short-lived cookie secures the Google login flow and is removed when you return to the site.

To protect against too many login attempts, Riparim processes hashed identifiers derived from the IP address and, where applicable, the email address, along with attempt counters. This protection data and the internal session associations have expiry times and are cleaned up during subsequent operation.

Your preference for a light or dark appearance is stored locally in your browser.

Display language

The display language, German, Albanian or English, is selected through the page URL. There is no automatic language redirect based on the browser language. A language preference for your account is stored only when you register or explicitly change it. It concerns presentation and does not grant access rights. Password recovery does not change the language preference of other accounts.

Reviews and private proof of visits

When you submit a review, we store the selected workshop, visit date, vehicle, work performed, display name, stars and review text. We also store the proof type and, where applicable, your notes, uploaded files and review notes.

The administration checks the review and proof manually. After approval, display name, vehicle, work, visit date, stars and review text are displayed publicly. Your proof files and notes about the evidence are accessible to your account and the responsible administration.

You can redact personal details in evidence before uploading it; the workshop, date and work must remain identifiable for the review. General search filters such as brand, location and service appear in the search URL. When you open WhatsApp, the message text, which you can check, is passed to WhatsApp; you send the message there yourself.

Notifications about your submissions

When a review is approved or additional proof is requested, we send a transactional message to the account address verified by the login service. We use the email sending service configured for Riparim for this. A verified link to an earlier ChatGPT login can determine the associated contact address. No message is sent without a verified contact address.

The message contains only the status and a link to the protected account area. Private proof, vehicle details, review text and internal review notes are not passed on as email content. The configured sending service processes the recipient address, sender and message content to send the email.

We store a technical sending event and, temporarily for necessary safe retries, the verified address and unchanged message content. After handoff to the email service, the address and content are removed from this local sending table. Deleting a submission or account removes the associated local sending events. Messages already accepted by the email service cannot thereby be recalled from the email inbox.

Proof of ownership and business profiles

If you claim a workshop profile, we store your account association, the workshop concerned, your private ownership explanation, any evidence links, the application status and review notes. This proof is visible only to your account and the responsible administration. The administration checks it independently and approves or rejects the application with a reason.

Verified business owners can submit contact details, opening hours including exceptions, services and a description as a draft. Only approval transfers these details to the public workshop profile. Until then, the most recently approved details remain visible. Deleting an account removes private applications, drafts and business associations; independently maintained catalogue profiles and their approved business details remain.

Services and storage

The website runs on the hosting infrastructure configured for Riparim. Submissions and review notes are stored in a database, and proof files in private file storage. Supabase processes the data required for your user account and login.

Google Maps and Places

Workshop profiles contain their own opening hours and Riparim reviews. Google Maps and directions open only when you click an external link. Google’s terms then apply, and Google receives connection data including your IP address.

Our server continues to use Google Places to verify workshop identity. Riparim stores the Google place identifier and its own matching information. Opening hours come from approved workshop submissions; Google reviews, hours and photos are not loaded in profiles.

Further information is available from Google and in the authentication service information from Supabase.

Optional usage analytics with PostHog

Only with your explicit consent do we use PostHog in the EU to analyse public page visits and the journey workshop search → published profile → contact click. We record the page address without query parameters or fragments, language, public workshop identifier, contact type and visit duration. PostHog receives technically necessary connection data such as your IP address; geographic enrichment is disabled.

Your choice is stored locally in your browser for 180 days. Only after approval do we store a random browser identifier and a visit identifier with a 30-minute inactivity limit. We do not link these identifiers to your account. Account management, login, administration, forms, messages and private proof are not recorded. Automatic click capture, session recordings and person profiles are disabled.

Consent is optional and can be withdrawn at any time under Analytics settings. Declining or withdrawing leaves all features available. Withdrawal stops further capture and removes analytics identifiers from this browser; events already sent remain until the PostHog project's retention period ends.

Deletion and retention period

Submissions remain stored until you delete them under “My reviews”. This function removes the entire submission, including the review, private proof and associated files, from active storage.

You can change your account name under “Settings”. New reviews use your account name. Existing reviews use it the next time you edit them under “My reviews”. If no valid name exists, “Anonym” appears; your email address is never published as a fallback name.

Google and email accounts can be deleted under “Settings” after renewed identity verification and explicit confirmation. This removes the Supabase account, all associated reviews and visits, private proof files, session associations and verified links to earlier ChatGPT submissions. Your Google account remains. Administrative access requires an orderly handover by the administration beforehand.

Once deletion starts, access is blocked immediately. If part of the deletion fails, you can retry the cleanup in the same browser within seven days; after that, the administration can help you continue. For this, we store a hashed identifier that authorises deletion only and a protected, technically necessary cookie. A deletion that has not yet started requires renewed identity verification after ten minutes. Minimal blocking identifiers are retained so that old sessions or earlier ChatGPT logins cannot regain access.

Deleting a submission and logging out do not remove your Supabase user account. For questions about storage or help with account deletion, write to ramizloki82@googlemail.com.