Privacy notice
What information Rizicon uses, why it is needed, and how to ask about your data.
Controller and contact
The Rizicon Team is responsible for operating this project and is the controller for public-site inquiries and beta-account administration. You can contact the team through the contact form, including to exercise your data-protection rights. This notice covers the public website and beta application.
A city remains responsible for personal data it determines how to use. A separately agreed city deployment requires its own allocation of controller and processor responsibilities. The public beta does not establish a data-processing arrangement for an organisation’s confidential or regulated records.
Contact inquiries
The contact form records your name, reply email, optional organisation, chosen topic, message and language, together with the privacy-notice acknowledgement and its timestamp. Submission and update times, handling status and administrator notes are retained to manage the inquiry. Providing the required contact fields is voluntary, but we cannot receive and answer the inquiry through this form without them.
Inquiries are stored in the Supabase database and are available only to authorised Rizicon administrators. We use the submitted address to respond; sending an inquiry does not subscribe you to marketing. Contact message contents are not sent to mapping or AI providers.
For a requested offer or service, the basis is taking steps at your request before a contract where Article 6(1)(b) GDPR applies. General questions and business representatives’ details are processed under our legitimate interests in answering inquiries and operating the service, Article 6(1)(f). The privacy acknowledgement records that the notice was presented; it is not marketing consent.
Accounts, workspace data and security
When you use the beta app, Supabase handles authentication and stores information needed for the functions you request, such as your email, user identifier, city membership, permissions and saved records. We process beta-account and security data under our legitimate interests in providing authorised access and protecting the project, Article 6(1)(f) GDPR.
The contact application does not save a separate IP address or user-agent history. It uses recent submission counts to limit spam. Infrastructure providers may process IP addresses, request metadata and security logs to deliver and protect the service. The relevant provider’s configuration and retention rules govern those infrastructure logs.
Maps and optional AI
Opening the application map connects your browser to Mapbox for map styles, tiles and related delivery or usage functions. Mapbox receives the network and device information associated with those requests. Public-site illustrations do not initialise the application map.
If you request an AI feature, the selected provider (OpenAI, Anthropic or Google, according to configuration) receives the submitted prompt and relevant crossing, suggestion or budget context through the application server. User-supplied API keys are stored in browser local storage and sent to the server when that provider is used. Do not include personal or confidential information without the appropriate authority and contractual safeguards.
Rizicon does not use contact inquiries to make automated decisions with legal or similarly significant effects. Crossing risk indicators concern infrastructure and remain subject to human review.
Service providers and international processing
Supabase provides database and authentication services. The application-hosting provider also processes data necessary to serve the site. AWS is an assumption in the future-hosting price calculation; that calculation does not identify the current website host. Mapping and optional AI providers are involved in the app functions described above.
Providers and their subprocessors may process information outside the European Economic Area. Supabase’s published data-processing terms include EU standard contractual clauses for transfers to which they apply. Processing locations and safeguards vary by provider and the function you use. Contact us for information about the providers involved in your use and the applicable transfer safeguards.
How long information is kept
Inquiries are retained while they are being answered and for necessary follow-up, with a retention period of up to 12 months after resolution. A legal obligation or a documented claim may require longer retention. Review and deletion are handled manually by an administrator.
Beta-account and saved workspace records are retained while needed for your access and requested functions. You can ask to close your account or delete your information through the contact form. Requests are assessed against applicable legal duties and the rights of others. Provider backups expire on their own retention cycle. Local browser settings remain until you remove them or their cookie lifetime expires.
Your rights
Depending on the applicable conditions, you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing depends on consent, you may withdraw it without affecting earlier lawful processing. We may ask for information needed to verify your identity.
Use the contact form and select a general inquiry to exercise your rights. We aim to answer without undue delay and within one month; GDPR allows an extension in specific cases, which must be explained to you. You may also lodge a complaint with the Slovak data-protection authority or another competent supervisory authority.