Privacy Policy

1. Information We Collect

1.1 Information you provide directly

• Account information: Name, phone number, email address, profile photo.
• Partner KYC: Aadhaar card, PAN card, GSTIN (for space owners only, stored securely in private storage with signed URL access).
• Vehicle information: Vehicle number plate and type (for drivers).
• Parking spot details: Address, photos, availability schedule (for partners).
• Payment details: UPI ID, bank account number, IFSC code (for partner payouts). We do not store your full card number.
• Communications: Messages sent through the in-app chat between drivers and parking partners.

1.2 Information collected automatically

• Device information: Device type, operating system version, unique device identifiers.
• Usage data: Pages visited, features used, time spent, booking history.
• Log data: IP address, app crashes (via Firebase Crashlytics), error reports.
• Push notification tokens: FCM token for delivering booking confirmations and alerts.

2. How We Use Your Information

• To create and manage your account and verify your identity.
• To process bookings, payments, and generate QR codes for parking entry.
• To calculate and transfer partner earnings (85% of each booking) to your registered bank account.
• To send booking confirmations, QR codes, receipts, and important notifications via push and email.
• To provide real-time parking availability on our map.
• To detect and prevent fraud, double-bookings, and unauthorized access.
• To improve our platform based on aggregate usage analytics.
• To respond to your support requests and feedback.
• To comply with applicable laws and regulations in India, including the Digital Personal Data Protection Act (DPDP Act, 2023).

3. Sharing Your Data

We do not sell your personal data. We share data only in these cases:

• Between Driver and Partner: When a booking is made, the driver's first name and vehicle type are shared with the parking partner for check-in verification. The partner's spot address and name are shared with the driver.
• Payment processors: Razorpay processes all payments. Your financial data is subject to Razorpay's Privacy Policy.
• Supabase: Our backend database and file storage provider, operating on secure servers with row-level security.
• Firebase (Google): Used for push notifications (FCM) and crash analytics (Crashlytics).
• Legal requirements: If required by law, court order, or government authority in India.

4. KYC & Identity Data (Partners only)

If you use the ParkIN24 Partner app, you are required to complete identity verification (KYC) before listing parking spots. This includes uploading Aadhaar and PAN documents.

• KYC documents are stored in a private, access-controlled storage bucket.
• Documents are never publicly accessible. Access is via short-lived signed URLs (1-hour expiry) visible only to you and our authorized verification team.
• We comply with the DPDP Act (India, 2023) for personal data handling.
• KYC data is retained for the duration of your account and up to 5 years after closure for regulatory compliance.

5. Payments & Financial Data

• All payments are processed by Razorpay, a PCI DSS-compliant payment gateway.
• ParkIN24 does not store full card numbers. We only store transaction IDs and payment status.
• Razorpay payment signatures are verified server-side via our Edge Functions using HMAC-SHA256 before any booking is confirmed. We never trust client-side payment callbacks alone.
• Partner payouts are processed to your registered bank account via Razorpay. Withdrawal requests are validated server-side (minimum ₹100). Bank details are encrypted at rest.

6. Location Data

• The Driver App requests location access to show you nearby parking spots on the map.
• We request foreground-only location access. We do not use background location tracking.
• Location data is used only to show relevant spots and is not stored on our servers beyond the active app session.

7. Data Retention

• Account data is retained for as long as your account is active.
• Booking history and transaction records are retained for 7 years as required by Indian tax law.
• KYC documents are retained for 5 years after account closure.
• Chat messages are retained for 90 days after the associated booking is completed or cancelled.
• You may request deletion of your account and associated data by emailing us (subject to mandatory legal retention periods).

8. Your Rights

Under the DPDP Act (India, 2023) and applicable laws, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correct: Request correction of inaccurate data.
• Delete: Request deletion of your data (subject to legal obligations).
• Grievance Redress: Lodge a complaint with us or the Data Protection Board of India.

To exercise these rights, contact privacy@parkin24.com. We will respond within 30 days.

9. Security

• All data is transmitted over HTTPS/TLS encryption.
• Database access is protected by Row-Level Security (RLS) policies in Supabase.
• All SECURITY DEFINER database functions use locked search paths to prevent SQL injection attacks.
• OTP requests are rate-limited to 5 per hour per phone number.
• We use Firebase Crashlytics for crash monitoring and proactive bug detection.

While we implement industry-standard security measures, no method of transmission over the internet is 100% secure. We encourage you to use strong authentication practices.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data: