Privacy Policy

Version 1 · effective 1 November 2026

Also available in: Deutsch · हिन्दी

1. Who is responsible

The controller is [To be confirmed], [To be confirmed], email support@parking.bytefy.in.

• Data protection contact: [To be confirmed]
• Representative in the EU (Art. 27 GDPR): [To be confirmed]
• Representative in the UK (Art. 27 UK GDPR): [To be confirmed]

2. What we collect

• Account: name, email, phone number, profile photo, country, language, sign-in method (Google, Apple, email or phone through Firebase Authentication).
• Identity verification: the result and level of your check. The check is done by our verification provider (Didit); we never receive or store your ID images or biometric data.
• Vehicles: registration, make, model, colour and type.
• Bookings: spaces, times, prices, booking history, check-in and check-out, arrival and departure photos, access events.
• Payments: amounts, refunds, receipts and invoices, payout and tax details for hosts (tax numbers are stored encrypted). Card details are handled by Stripe and never reach us.
• Listings: address, photos, description, rules, availability and prices.
• Communication: booking messages, reviews, reports, support requests and emails we send you.
• Device and usage: push notification tokens, app version, crash reports, and, only with your consent, product analytics.
• Location: when you allow it, your device location is used to show spaces near you. We use it to answer the search and do not store it in your profile.

3. Why we use it and on what legal basis

• To provide the service (account, bookings, payments, payouts, messages, support): performance of a contract, Art. 6(1)(b) GDPR.
• Identity verification, fraud prevention and safety (velocity limits, risk signals, moderation): our legitimate interest in a safe marketplace, Art. 6(1)(f), and legal obligations where they apply.
• Legal obligations (tax records, platform reporting under DAC7 and the UK rules, invoices, answering authorities, notices under the Digital Services Act): Art. 6(1)(c).
• Analytics and marketing: only with your consent, Art. 6(1)(a). You can withdraw it at any time in Account → Privacy.
• Crash reports: our legitimate interest in a working app, Art. 6(1)(f).

4. Who receives your data

• The other party to your booking: the host sees your name, vehicle and booking details; contact details only after confirmation. Drivers see the host's public profile.
• Service providers acting for us: Cloudflare (hosting, database and file storage), Google Firebase (sign-in, push notifications), Stripe (payments, payouts; Stripe is an independent controller for some payment and anti-fraud data), Didit (identity verification), Resend (email delivery), Sentry (crash reports), PostHog EU (analytics, only with consent), Google Maps Platform (maps and place search).
• Authorities where the law requires it, for example tax authorities.
• We do not sell personal data and do not share it for cross-context behavioural advertising.

5. International transfers

Some providers process data outside the UK and the EEA (in particular in the USA). We rely on adequacy decisions (including the EU–US Data Privacy Framework and the UK extension) or standard contractual clauses and the UK addendum.

6. How long we keep data

• Account profile: until you delete your account (after a 14-day grace period). Reviews you wrote stay online as "Former user".
• Booking messages: 12 months after the booking ends, longer only while a dispute is open.
• Arrival and departure photos: for as long as needed to handle disputes about the booking.
• Invoices and receipts: 8 years (Germany) or 6 years (UK) after the end of the year; accounting ledgers up to 10 years.
• Platform tax reporting records: 10 years (EU DAC7) or 5 years (UK), then deleted.
• Consent records: for as long as the consent applies plus 3 years.
• Data exports you request: 30 days.
• Email delivery logs: 180 days. Server and security logs: up to 90 days.

Records we must keep after you delete your account are kept with your name and contact details removed and are used only for the legal purpose.

7. Your rights

You have the right to access your data and receive a copy (Account → Privacy → Download my data), to have it corrected, deleted (Account → Privacy → Delete account) or restricted, to data portability, and to object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time without affecting earlier processing. Contact us at support@parking.bytefy.in. You can complain to a supervisory authority, for example the UK Information Commissioner's Office (ico.org.uk) or the data protection authority of your German federal state.

8. Automated decisions

Identity checks are decided by our verification provider with human review available on request. Fraud signals are reviewed by people before any account action. You can ask for a human review of any decision by contacting support.

9. Children

ParkTracer is for adults. We do not knowingly collect data from anyone under 18.

10. California residents

We collect the categories listed in section 2 for the purposes in section 3. We do not sell or share personal information and we honour Global Privacy Control signals. You can ask to know, delete or correct your personal information and will not be discriminated against for using these rights.

11. Changes

We tell you about important changes in the app before they take effect. The version and date of this policy are shown at the top of the page.