Privacy policy

This policy explains what Repair Control LTD does with personal data — on this website, and in the Repair Control application at app.repair-control.com. It is written to be read rather than to be survived, and it says where things actually are rather than describing an industry in general.

Who we are

Repair Control LTD is the data controller for the personal data described below, except where this policy says otherwise. It is a company registered in Ireland.

• Email: contact@repair-control.com
• Phone: +353 87 440 8778
• Registered office: 614 Mount Kenneth Place, Dock Road, Limerick, V94 D2P9, Ireland

Write to us at that address about anything in this policy, including any of the rights set out at the end of it.

This website

Nothing is collected until you do something. Visiting a page on repair-control.com sets no cookie, loads no third-party script and sends nothing to anyone. The fonts are served from our own domain rather than from Google, so even reading a page makes no request to a third party.

Three things change that, and only one of them is automatic.

Analytics, and only with consent

We would like to know which pages are read, using Google Analytics 4. The tag is not loaded at all unless you accept it in the banner — not loaded and told to store nothing, but not requested from Google in the first place. Decline and your browser never contacts Google on our behalf.

If you accept, Google Analytics sets cookies (_ga and _ga_ followed by an identifier, both lasting up to two years) and records the pages you view, roughly where you are from your IP address, and which of our buttons you press. We do not use it for advertising and we do not combine it with anything else.

You can change your mind at any time from the Cookies link in the footer of every page. Withdrawing deletes those cookies and stops the tag loading on your next visit. The lawful basis is your consent.

What is stored on your device

• rc-cookie-consent — a single entry in your browser's local storage recording whether you accepted or declined. It is how we avoid asking twice, it contains nothing else, it never reaches our servers, and it is set whichever way you answer. This one is strictly necessary and needs no consent.
• _ga, _ga_… — Google Analytics, only if you accepted. Up to two years.

There is nothing else. No advertising, no tracking pixels, no social plugins, no session recording.

The contact form

If you send an enquiry we receive what you typed — your name, email address, and whichever of company, phone, crew size, machine count and message you filled in — and it reaches us as an email. We use it to answer you. The lawful basis is our legitimate interest in responding to people who ask us things.

Your IP address is used to rate-limit the form so it cannot be abused to send mail. It is held in memory only, for at most an hour, and is never written to a database.

Registering for an account

Registering creates an organisation and your account in it. We store your name, your work email, your organisation's name, the plan you chose and a hash of your password — never the password itself. We send you an activation link, and later account notices such as a confirmation when you change your email address. The lawful basis is performance of a contract with you.

The application

Once you are using Repair Control, two different relationships apply at the same time, and the distinction matters for your rights.

We are the controller for your account. Your name, email address, role, password hash, and when you were last active. Also whether you have a pending email change, and the token that confirms it.

You are the controller for what you put in it, and we are your processor. The customers you record, their contact names, addresses, emails and phone numbers, your machines and where they are, your engineers' notes, the photographs, video, audio and documents you upload, and the signatures captured on work orders. We hold and process that on your instructions, to provide the service, and for nothing else. We do not sell it, we do not mine it, and we do not use it to train anything.

The assistant

When an engineer asks the assistant about a fault, the photograph and the description are sent to Amazon Bedrock, Amazon Web Services' model hosting service, along with a summary of that machine's own records — its parts, its recent visits, its bulletins. AWS states that Bedrock does not use inputs to train its models and does not share them with model providers. We do not send it your customer contact details.

Maps

Machines are located on a Google map. When an admin searches for an address, that search and the resulting place lookup happen in your browser, directly with Google — there is no server-side key and the query does not pass through us. Google's handling of it is covered by their own privacy policy. We keep only the resulting place identifier, the formatted address and the coordinates.

Where your data is held

In the United States. Our servers, database, uploaded files and the assistant all run in Amazon Web Services' us-east-1 region in Northern Virginia. This is a transfer of personal data outside the European Economic Area. AWS is certified under the EU–US Data Privacy Framework and we rely on that, together with AWS's standard contractual clauses, as the transfer mechanism.

Email is the exception: it is sent through smarthost.ie, in Ireland.

Who else sees it

We use these processors, and no others:

• Amazon Web Services — hosting, the database, uploaded files, and the assistant (Amazon Bedrock). United States.
• Google — Analytics, only with your consent, and Maps, which your browser contacts directly. Ireland and the United States.
• smarthost.ie — outbound email and our domain. Ireland.

We do not sell personal data, we do not share it for advertising, and nobody buys a list from us.

How long we keep it

• Account and application data — for as long as the account is open, and deleted on request when it is closed.
• Contact enquiries — kept as email for as long as the conversation is useful, and no longer than two years.
• Analytics — as configured in Google Analytics, at most fourteen months.
• Rate-limiting IP addresses — in memory only, at most one hour, and lost whenever the service restarts.

Your rights

Under the GDPR you may ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing we base on legitimate interests, and ask for your data in a portable form. Where we rely on consent — analytics — you can withdraw it at any time, and withdrawing is as easy as giving it was.

Application data exports in full, and that is a feature rather than a favour: assets, part history, documents and tutorials all come out. The record is yours.

Write to contact@repair-control.com and we will answer within one month.

Complaints

If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the Irish supervisory authority, the Data Protection Commission, at dataprotection.ie.

Changes

If this policy changes materially we will say so on this page and update the date at the top. We will not quietly broaden what we collect.