Privacy policy

Who is responsible?

The data controller is Partikuls, a French simplified joint-stock company, SIREN 538 555 988, with its registered office at 1 venelle Louis Gallien, 44300 Nantes, France. Partikuls operates Rihla and determines the uses of data described here.

For any question about personal data, contact Khelil Benosman at khelil@partikuls.com, or write to the postal address above, for the attention of “Rihla — personal data”.

What data, for what purposes?

You can read public stories without creating an account.

Your account and sign-in

Your email address, an account identifier and session information let you sign in and access your workshop. If you choose Google, we receive your Google identifier, email address and basic profile information (name and photo). We do not request access to Gmail, your contacts or your calendar. An email address is required to open an account; Google sign-in is optional.

Your profile and journals

We store your handle, public name and biography, as well as the stories, stops, coordinates, constraints, image links, licences and versions you save. A public name is required; it can be a pseudonym. The biography and images are optional. Other required fields are indicated in the editor: without them, the journal cannot be saved or published.

Operation and security

Technical providers process connection and request data: IP address, date, browser, requested pages or services, authentication events and errors. These are used to deliver the site, prevent abuse and diagnose incidents. Place queries are sent only when you initiate a search. Rihla does not automatically collect your device’s location.

Your requests to Partikuls

We use your contact details and correspondence to reply and handle your requests about the service or your data. Do not send passwords or sign-in links.

Your newsletter subscription

If you choose to subscribe, we store your email address, the date of your consent, the version of the text accepted and the source of the subscription. Subscribing is optional and independent of your account. It is based on your consent (GDPR Article 6(1)(a)). For now, subscriptions are stored in our Supabase database in Paris; no newsletters are sent and no data is transferred to a mailing tool. You can withdraw your consent at any time by writing to khelil@partikuls.com.

The language chosen when subscribing to the newsletter is also stored to identify the consent text accepted and your preferred language.

Accounts, editing, publication, exports, adaptations and search are based on performance of the requested service (GDPR Article 6(1)(b)). Protecting the site, resolving incidents and defending rights are based on Partikuls’ legitimate interest in providing a secure service (Article 6(1)(f)). Handling requests to exercise rights fulfils our legal obligations (Article 6(1)(c)).

Rihla does not sell your data, use it for targeted advertising or make decisions with legal effects on you solely through automated processing.

What other people can see

Your public profile includes your handle, public name, biography and publications, even if you have not yet published a journal. Your sign-in email is not included and your Google photo is not displayed automatically.

Your drafts are accessible to your account and, when technically necessary, to people authorised to administer the service. Publishing a journal requires your action: its story, coordinates, your signature and its licence then become readable, exportable and accessible to search engines and automated tools. Previously published versions remain available. An adaptation keeps its source reference and attribution.

Publish only information you wish to make public. Pay particular attention to private addresses, overnight locations and information about other people. If a journal concerns you but you are not its author, you can contact us with the page link.

Where necessary, a deletion request also covers older versions and attribution in adaptations. Depending on the situation, we remove the content or delete the personal information concerned. A reuse licence does not override personal data rights. We cannot directly erase copies already exported by third parties; we take the reasonable measures required to inform them of an applicable request.

Who is involved in the service?

Internal access is restricted to authorised Partikuls personnel. The following providers perform their respective functions:

• Supabase: accounts, authentication, profiles, journals and newsletter subscriptions. The project database is located in Paris.
• Vercel: application hosting and technical logs. Server functions are located in Paris; the distribution network is international.
• Resend: sending sign-in links, including your email address, message content and delivery status. The sending domain is configured in the Ireland region. Open and click tracking are not enabled.
• Google sign-in: if you choose this option. Google then knows that you use this sign-in method for Rihla and also applies its privacy policy.
• Google Workspace: hosting Partikuls’ contact mailbox for correspondence you send us by email. See the Google Workspace data processing terms.
• OpenStreetMap Foundation: map tiles are loaded through your browser. The provider receives your IP address and the requested map areas. See its privacy policy.
• Photon, operated by komoot: place search sends your query through the Rihla server, without forwarding your email, account identifier or device IP address. The provider sees the server’s IP address. See the komoot policy.
• Hosts of images chosen by authors: these external images are loaded directly by your browser. Their hosts may receive your IP address and technical request information.

Hosting the database and functions in Paris does not mean all processing stays within the European Union. Site distribution, support and some subprocessors involve processing abroad, including in the United States. The data processing agreements of Supabase, Vercel and Resend include the European Commission’s standard contractual clauses to govern the relevant transfers. Contact us for information or a copy of the applicable safeguards.

Data may also be disclosed to competent authorities where a legal obligation requires it. The content you publish is, by definition, available to recipients worldwide.

For how long?

Account, profile and drafts

These are retained while you use your account and deleted when it is closed. After three years without a sign-in, Partikuls reviews whether retention is still necessary. Before closing an inactive account, we give you 30 days’ notice to keep your account or export your journals.

Publications, versions and attribution

These are retained as long as their distribution and attribution remain necessary for the requested publishing service. A withdrawal or account closure request triggers a review of the personal data concerned, including in adaptations. This retention does not prevent you from exercising your right to erasure.

Newsletter subscription

This is retained until you withdraw your consent. Partikuls reviews the need for retention after three years without contact from you and deletes subscriptions that are no longer necessary.

Technical logs and sign-in emails

Supabase platform logs are retained for seven days. Vercel runtime logs are retained for no more than 30 days, depending on hosting options. Resend retains messages and delivery logs for 30 days. Rihla does not build an advertising browsing history.

Place searches

Results may be reused in a technical cache for 24 hours without being associated with your account. This period relates to reuse: entries are replaced on revalidation or cache deletion and do not form a personal history of your searches.

Backups and requests about your data

Daily Supabase database backups and Resend backups follow a seven-day rotation; deleted data may therefore remain temporarily in these backup copies. Correspondence about a request is retained until it has been handled. After permanent deletion from Partikuls’ mailbox, Google Workspace applies its technical deletion cycle, which may take up to 180 days under its processing agreement. In a dispute or where retention is legally required, only necessary records are archived with restricted access until the dispute is resolved and the applicable appeal period has expired. We will explain any exception affecting your request.

Cookies and storage in your browser

When you sign in, a cookie stores your chosen language for up to one hour so you return to that language after authentication. It is deleted when you return from sign-in and is not used to track you.

Rihla uses cookies necessary for authentication and maintaining your session. Supabase sign-in cookies (prefix sb-) have a maximum technical lifetime of 400 days, renewed when updated. Session validity also depends on server checks. Signing out deletes the Rihla session cookies in this browser. You can also remove them through your browser settings; you will then need to sign in again.

No advertising cookies or third-party audience measurement tools are integrated into Rihla. Fonts are served with the site. External services you use, including Google, have their own storage and privacy rules.

How can you exercise your rights?

You can request access to your data, rectification, erasure or restriction of processing under the conditions set out in the GDPR. You also have the right to portability of the relevant data and may object, on grounds relating to your particular situation, to processing based on legitimate interests.

The workshop lets you edit your signature and export your profile and journals. For other data, to close your account or remove published information, write to khelil@partikuls.com. Include the account email or the relevant content link and your request. If we have reasonable doubts about your identity, we will ask only for the information necessary to verify it.

We respond within one month. For complex or numerous requests, this period may be extended by two months; you will be informed within the first month, with the reasons for the extension. Any limitation on your request will be explained.

You can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

If the service changes

We update this page when data uses change. Significant changes will be brought to your attention through the service or by email where necessary. The date at the top identifies the current version.