Privacy Policy

⚠️ DRAFT — not published. This document is awaiting review by counsel. See docs/LEGAL_REVIEW.md.

Data controller: RAYDIYL OOD (РАЙДИЙЛ ООД), company number 208797056, 13 Slavyanska Street, Burgas, Bulgaria

Data protection contact: office@rydeal.bg

This document describes what personal data Rydeal Inspect processes, why, where it is stored, and what rights you have. It is written to match what the system actually does, rather than from a template.

1. Who we are

The controller of your personal data is RAYDIYL OOD (РАЙДИЙЛ ООД), company number 208797056, registered at 13 Slavyanska Street, Burgas, Bulgaria.

For anything concerning your personal data, write to office@rydeal.bg.

2. What data we collect

Your account. Email, name, phone number, language, country and time zone. If you sign in through an external provider such as Google, we receive your identifier with that provider.

Inspection requests. Vehicle details, a location point, the address text you typed, your notes to the specialist, and a link to the listing if you provided one.

Offers and bookings. Who offered what, at what price and within what window; the state of the booking and how it changed over time.

Inspection evidence. Photos and video captured by the specialist, together with the time of capture and GPS coordinates, plus a checksum of each file that makes substitution detectable in a dispute.

Reports and ratings. The specialist's findings, their severity and repair estimates; the mutual reviews between you and the other party.

Payments. The ledger entries for each booking — amounts, currency, type of movement. Your card details never pass through our servers; they are handled directly by Stripe.

If you are a specialist. Your profile (bio, company, company number, VAT number), the areas you cover, your equipment and specialisations, and the identity and qualification documents you upload when applying.

If you left an email for the waiting list. Your email and the point you searched for, so we can write to you when we cover that area. Nothing else.

Technical data. Your IP address is used for rate limiting — protection against abuse and spam. Administrative actions on your account (an erasure requested by an administrator, for example) are recorded with the IP address and browser so they remain traceable.

3. Why we process it, and on what basis

• To run the service — to publish your request, show it to suitable specialists, and carry it through to a booking, an inspection, a report and the ratings both sides leave.
• To process payments and to pay the specialist once the report has been delivered.
• To write to you about substance — confirmations, new offers, a delivered report. These emails are part of the service, not marketing.
• To prevent fraud and abuse — rate limiting, verification of applying specialists, and detectability of substituted evidence.
• To meet legal obligations — accounting and tax.
• To understand how the product is used — only if you accepted analytics (see section 10).

⚠️ Requires review by counsel: the precise legal basis under Art. 6 GDPR for each purpose above. We will not assert a basis before a lawyer confirms it.

Which specialists see your request is determined by their coverage area and availability, and the choice of whom to book is yours.

4. Who we share it with

We do not sell personal data. We share only what is necessary, with the following:

And the other party to the transaction. The specialist working on your booking sees the vehicle details, the location and your notes; you see their profile and their report. That is not a leak — that is the service.

5. Where the data lives

The database is in Frankfurt, the files are in a European region of Cloudflare, errors and analytics are in the European installations of Sentry and PostHog, and our servers are in Sofia.

One exception, stated plainly: when you type an address into the search field, every character you type is sent to Google so that it can suggest addresses. That means Google receives the text of the address you are searching for. We cannot hide it and we will not bury it. If you would rather avoid this, you can set the location without using the suggestions.

6. How long we keep it

Account data — for as long as the account exists. On erasure, section 8 applies.

Accounting data — under art. 12 of the Bulgarian Accountancy Act (Закон за счетоводството), counted from 1 January of the reporting period following the one the records relate to:

• accounting registers and financial statements, including documents for tax control and audit — 10 years;
• all other carriers of accounting information — 3 years.

⚠️ Requires review by counsel: any other retention period — including how long we keep inspection evidence after a booking is closed. We will not state a period we cannot justify.

7. Your rights

You have the right of access to your data, of portability (a machine-readable export), of rectification, of erasure, of restriction, and to object to processing.

Export and erasure already exist as functions — they are not a promise. Write to office@rydeal.bg to exercise them.

If you believe we process your data unlawfully, you may complain to the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, Sofia, kzld.bg.

8. What erasure actually does

We are specific here, because "we delete everything" is a sentence no transaction marketplace can honestly say.

Destroyed:

• your email — replaced with a technical placeholder of the form deleted-<id>@deleted.invalid, which leads nowhere;
• name, phone number, profile picture;
• your password (its hash) and any links to external sign-in providers;
• every active session — access ends immediately, not whenever the token would have expired;
• all notifications;
• the free text in your requests — your notes to the specialist and the address you typed;
• the text of the reviews you wrote;
• your identity documents, if you applied as a specialist.

Retained, deliberately:

• the rating on the reviews you wrote — otherwise one party leaving would silently rewrite the other party's score;
• accounting records — because of the statutory period in section 6;
• the location point and vehicle details on requests that led to a booking — they belong to the transaction itself;
• the inspection evidence — the photos and video are the property of the buyer who paid for them. If a specialist deletes their account, the report stays with the buyer.

If you are a specialist, your profile is anonymised to a placeholder name and suspended, so a deleted specialist can never resurface in matching.

9. Security

Files live in a private bucket — there is no public address for them. They are reached only through signed links, issued after a permission check, valid for minutes rather than days.

Passwords are stored only as a hash, never in readable form. Error reports pass through a filter that removes personal data before they leave the system, and our tools are explicitly configured not to collect IP addresses or cookies of their own accord. When an account is erased, its sessions are terminated in the same transaction.

No system is invulnerable. If a breach affecting your rights occurs, we will notify the КЗЛД and you as GDPR requires.

10. Cookies and similar technologies

We use exactly four things and nothing else:

1. A session cookie — so you stay signed in. Strictly necessary; the service does not work without it.
2. Your stored consent choice — so we do not ask about analytics on every page load. Strictly necessary.
3. Product analytics (PostHog) — loaded only after you have accepted it. With no choice recorded it does not start at all, and if you choose "necessary only" it does not start either.
4. Unfinished request and last city — stored only in your browser, on this device: the request for up to 7 days or until you publish or clear it, the city until you clear your browser data. We don't send them until you publish. Strictly necessary for a feature you started yourself.

There are no advertising cookies, no cross-site tracking, and no third-party pixels.

11. Changes and contact

If we change this policy, we will publish the new version on this page. For a material change, we will notify users who have an account by email.

Questions, or requests for access, export or erasure: office@rydeal.bg.