Privacy policy
Controller and contact
RONA is operated by Fares Altawil as an individual.
Hermann-Geisen-Straße 56
56203 Höhr-Grenzhausen
Deutschland
Support and privacy: support@rona-services.com.
What we process and why
We use your name, email, telephone number and account ID to provide accounts and requested services. You may provide provider profiles and branches, selected work photos, service requests, addresses, locations, chats, reviews and reports. Public provider details and permitted work photos can be seen by customers. Requests and conversations are restricted to authorized participants. We do not sell personal data or use advertising tracking.
Legal bases and your choices
Account and requested service processing is necessary to provide the service you request (Article 6(1)(b) GDPR). Protecting accounts, handling abuse reports and maintaining service security serve our legitimate interests (Article 6(1)(f)). Optional device permissions and consent-based features can be withdrawn in the app or system settings (Article 6(1)(a), where applicable), without affecting earlier lawful processing. Required registration fields are needed to create an account; GPS and phone notifications are optional. All-area and city search work without GPS permission.
Photos and location
Only photos you select are uploaded. Work photos are compressed, orientation corrected and stripped of EXIF/GPS, with at most five photos per provider. Nearby search uses location when you allow it. Request and branch addresses may be selected manually. Map tiles send your IP address and the displayed area to the map provider; address/reverse lookup sends search text or selected coordinates to Nominatim. RONA does not request background location.
Notifications
Optional notifications use Firebase Cloud Messaging and Apple APNs, including installation/device identifiers. With message previews off, notifications use generic text without message content. Turning previews on may send message text to these providers. Notification permissions can be changed in system settings. Chats and unread counts continue without push permission.
Service providers and transfers
Supabase processes authentication, database and selected photos. Resend delivers account confirmation/recovery emails. Firebase/Apple deliver notifications. Zoho processes support correspondence. OpenStreetMap/Nominatim provide maps and address lookup. The website host processes technical connection information needed to serve these pages. These providers may process data outside your country, including outside the EEA. Contact us for information about the applicable processors and transfer safeguards. Google Analytics and advertising are not enabled. Electronic payment is currently disabled, so RONA does not collect card details through this release.
Content safety
You can report messages, photos or reviews and block an abusive user. Reports are reviewed through the authorized moderation workflow; not every photo requires advance human approval. Google Cloud Vision screening is not currently activated in the verified service. Before activating it, this policy will explain the processed photos sent to Google, classification/fingerprint retention and the appeal route. Automated screening does not replace reporting or human handling of complaints.
Deletion and retention
Open My account → Delete my account, read the consequences, verify your current password and explicitly confirm. The server removes the account, profile, work photos, the departing author’s personal content, addresses/locations and push registrations. The other participant keeps their own data/history after the departing user’s identity and content are removed. Interrupted cleanup remains pending and can be retried; signing out or uninstalling does not delete an account. Active data is retained while needed for the account/service and removed through this workflow. Restricted recovery backups are separate from active data and are not erased by the app; the app does not automatically erase recovery backups. Contact support for the status of data in those separate copies; this page does not promise a fixed backup-erasure period. No blanket legal-retention duty or whole-system deletion deadline is claimed. Administrative responsibilities must be transferred through support before deleting an administrative account.
Your rights
You may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, or withdraw consent where used. Contact support and do not send passwords or login codes. You may complain to the competent data-protection authority. For deletion outside the app, use Request account deletion. Identity must be verified before acting; any specific data retained and its reason will be explained.