Privacy Policy · Parkspot

This Privacy Policy explains how Parkspot.ai (“Parkspot”, “we”, “us”) collects, uses, shares, and protects information when you visit parkspot.ai, use the Parkspot mobile app, or use the Parkspot platform for cities and fleets (collectively, the “Service”).

This policy explains how we handle your personal data. Please read it alongside our Terms of Service.

1. Who we are

Parkspot acts as the data controller for personal data collected through this website, the Parkspot driver app, and the Parkspot enterprise platform, except for personal data that an enterprise customer (a city or fleet) sends through the Service on its behalf, where Parkspot acts as a data processor for that customer.

Privacy questions and rights requests: legal@parkspot.ai. We reply within 30 days.

2. What we collect

We collect only what we need. The categories below cover the website and the Parkspot driver app. The enterprise platform additionally processes whatever a customer chooses to upload or stream through it.

2.1 Account and contact data

Email address (required for an account or waitlist entry)
Display name and profile preferences (optional, in-app)
Authentication tokens (managed by your platform: Apple, Google, or email)
Support correspondence you send us

The website forms collect the following:

Waitlist (/drivers): your email address.
Contact (/contact): your name, email address and message. Cities also give an agency and, optionally, a job role; fleets give a company and, optionally, a fleet size. If you arrived from a link that names an industry, we record that too.
Coverage requests (/coverage): the street address or intersection you want covered, why that spot (optional), and your email address.
Camera hosting (/host): whether you are a resident or a business, the address where the camera would go (for a resident, that is your home address), your email address, and your description of the view, such as the floor, which way the window faces and the angle on the street. Businesses also give a business name and, optionally, a website.

Every form submission is stored in a Google Sheets workbook. Contact, coverage and hosting submissions are also emailed to our team inbox, and the waitlist, coverage and hosting forms send you a confirmation email.

2.2 App and usage data

Device type, OS version, app version, language, timezone
IP address (used transiently for rate limiting and abuse prevention)
Approximate or precise location (only after you grant permission, only to suggest nearby coverage)
App usage events (cameras checked, features used, navigation taps, favorites, searches): the events themselves carry no name, email address or coordinates, but they are linked to your account identifier, so we can see how an individual account moves through the app. For searches we record how long the query was and how many results came back, never the text you typed.
Crash logs, error reports, performance metrics (also linked to your account identifier)

2.3 Payment data

Parkspot Pro is bought through the App Store on iOS and Google Play on Android. Apple and Google take the payment and hold your billing details under their own privacy policies; we use RevenueCat to manage subscription state on both platforms. We receive a transaction reference and whether your subscription is active. We do not see or store your card number, CVV, or bank credentials.

Cancelling a subscription is done through the App Store or Google Play, not through us. Deleting your Parkspot account does not cancel it. See Delete Your Account.

2.4 Camera feeds (the important one)

Parkspot ingests live frames from publicly available city camera feeds and runs computer vision on them to identify open spots. We commit to the following, every time:

We do not store camera feeds. The live detector processes frames in memory and does not keep them. Separately, we keep a limited set of frames from public cameras, labelled by us, to train and test the detector.
We do not read or record license plates. We run no plate-recognition or face-recognition models; the detector classifies vehicles only. Frames come from publicly available cameras and are shown as the operator publishes them, without blurring.
We do not recognize faces. No facial-recognition models are run on any frame.
We do not link camera observations to any individual. Outputs are spot counts and bounding boxes, not identities.

2.5 What we do not collect

We do not collect biometric data, government IDs, financial account credentials, or any special category data under GDPR Article 9 (health, genetic, racial, political, religious, sexual orientation, trade-union membership, criminal history).

3. How we use your data and our legal bases

We use personal data only for the purposes below, on the legal bases shown:

Provide the Service: operate the app, suggest nearby coverage, run your subscription. Legal basis: performance of a contract.
Keep it secure and reliable: rate-limit abuse, investigate bugs, respond to incidents. Legal basis: legitimate interest.
Understand what’s useful: website analytics (Google Analytics, only if you accept it in the cookie banner) and app usage events (section 2.2) tell us which pages and features people use. Legal basis: consent for website analytics, wherever you are; for app usage events, consent (EU/UK/Switzerland) or legitimate interest (elsewhere).
Answer what you send us: reply to contact messages, assess coverage requests and camera-hosting offers, send the confirmation email, and prepare a host agreement if we go ahead. Legal basis: legitimate interest in replying to a request you made, or steps you asked us to take before a contract.
Run the waitlist: email you when the app opens. Legal basis: consent, which you can withdraw at any time by emailing us.
Communicate with you: service announcements, security alerts, replies to your questions. Legal basis: legitimate interest, or consent for non-essential marketing.
Comply with the law: respond to lawful requests, keep records we’re required to keep. Legal basis: legal obligation.

We do not: sell your personal data; share it with advertisers or ad networks; profile you for purposes unrelated to delivering the Service; use your data to train computer-vision or AI models, ours or any subprocessor’s.

4. Computer vision and our no-training commitment

Our spot-detection models are trained on publicly available imagery and on synthetic data we own. They are not trained on user data, user inputs, or live feeds processed for active customers.

Where we use third-party AI services (for example, model hosting), we maintain Zero Data Retention agreements where the provider supports them. Where ZDR is not available for a specific feature, we will name that feature and require your opt-in before you use it.

5. Subprocessors

We use a small number of infrastructure providers to operate the Service. Each is contractually bound to process data only on our instructions and to maintain appropriate security.

Vercel Inc.: website hosting and cookieless analytics. United States. Transfer safeguard: EU–US Data Privacy Framework (certified).
Google LLC (Google Analytics 4): website analytics, loaded only after you accept in the cookie banner. United States. Transfer safeguard: EU–US Data Privacy Framework (certified).
Google LLC (Google Workspace / Sheets): storage of website form submissions (waitlist, contact, coverage, host). United States. Transfer safeguard: EU–US Data Privacy Framework (certified).
Resend, Inc.: form confirmation and notification emails, waitlist confirmations and account notices. United States. Transfer safeguard: EU–US Data Privacy Framework (certified), with Standard Contractual Clauses in its data processing addendum.
Google LLC (Google Cloud): hosting of the Parkspot API and the account database used by the mobile app. United States. Transfer safeguard: EU–US Data Privacy Framework (certified).
Modal Labs, Inc.: computer-vision inference on frames from public cameras. United States. It receives camera frames only, never account or form data; frames can show people and vehicles in the street. Transfer safeguard: Standard Contractual Clauses in its data processing addendum.
RevenueCat, Inc.: subscription state management for the iOS and Android apps. United States. Receives your Parkspot account identifier so a purchase can be matched to your account. Transfer safeguard: Standard Contractual Clauses in its data processing addendum.
PostHog, Inc.: product analytics for the mobile app (which features are used, and how people move through the app). United States. Events are linked to your Parkspot account identifier (see section 2.2). Transfer safeguard: EU–US Data Privacy Framework (certified).
Functional Software, Inc. (Sentry): crash reporting and performance monitoring for the mobile app. United States. Crash reports carry your account identifier so we can tell whether a fault affects one person or everyone. Transfer safeguard: EU–US Data Privacy Framework (certified).
650 Industries, Inc. (Expo): delivery of push notifications to your device. United States. Transfer safeguard: EU–US Data Privacy Framework (certified).
Google LLC (Google Maps Platform): map tiles and rendering inside the mobile app. United States. Receives location data in order to draw the map around you. Transfer safeguard: EU–US Data Privacy Framework (certified).
Apple Inc. and Google LLC: App Store and Google Play billing. They are the merchants for Parkspot Pro and hold your payment details under their own policies; we never receive them.

We give 30 days’ notice before adding or replacing a subprocessor that processes personal data. To subscribe to changes or request the current list with DPA links, email legal@parkspot.ai.

6. Cookies and analytics

The website sets no cookies of its own. Here is everything it stores or measures:

Your analytics choice: kept in your browser’s local storage under the key parkspot-analytics-consent (“granted” or “denied”). It is not a cookie and is never sent to us. It stays until you clear this site’s data in your browser.
Vercel Web Analytics and Speed Insights: cookieless page-view counts and Core Web Vitals. They set no cookies.
Google Analytics 4: loads only after you click Accept in the cookie banner. Until then the Google Analytics script is not downloaded and nothing is sent to Google. Once you accept, it sets two cookies, _ga and _ga_<id> (the id is our GA measurement ID without the “G-” prefix), each lasting 2 years. It records the pages you view, how far you scroll, which sections and videos you see, the links and buttons you click, and whether a form was sent (not what you typed in it). Google signals and ad personalization are turned off.

The cookie banner appears to every visitor until they choose, with Accept and Decline as equal options. To change your choice, use Cookie settings in the footer of any page. If you decline after accepting, we delete the _ga cookies and stop Google Analytics.

Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as a decline: Google Analytics is not loaded and no analytics cookies are set.

7. How long we keep your data

Account email and profile: for the life of your account. Deleted within 30 days of account closure; encrypted backups roll off within 90 days.
Waitlist email (no account): until you ask us to delete it, or 24 months from your last interaction, whichever is sooner.
Camera frames: the live detector processes them in memory and does not write them to disk. Frames kept to train and test the detector stay in that training set only while it uses them.
IP address (rate limiting): held in memory for up to 60 seconds, then discarded.
Website analytics (Google Analytics, only if you accept): Google keeps the event data for 2 months, then deletes it. The _ga cookies expire after 2 years, or sooner if you decline or clear them.
Payment records: kept by our payment processors for the period required by applicable tax and consumer-protection law (typically 7 years).
Support correspondence and form submissions (contact, coverage and camera-hosting forms, held in Google Sheets and our inbox): 24 months from last contact, then deleted.

When the law requires us to keep data longer (tax, dispute, security incident), we keep only what’s strictly required and delete the rest.

8. Your rights

Depending on where you live, you have some or all of these rights:

Access: get a copy of the personal data we hold about you.
Correction: fix inaccurate data.
Deletion: ask us to erase your data (subject to legal obligations we cannot waive).
Portability: get your data in a machine-readable format.
Object or restrict: stop specific processing or marketing.
Withdraw consent: wherever we rely on consent, you can withdraw at any time without affecting prior processing.
Complain: to your local data-protection authority. We’d rather you came to us first; we’ll do our best to fix the problem.

To exercise any right, email legal@parkspot.ai. We respond within 30 days. No charge for reasonable requests.

9. International data transfers

Our infrastructure operates globally. When personal data leaves your region (for example, EU to United States), we use appropriate safeguards:

EU–US Data Privacy Framework for transfers to DPF-certified US subprocessors.
UK Extension to the EU–US DPF (UK–US Data Bridge) for UK transfers to DPF-certified US subprocessors.
Standard Contractual Clauses under European Commission Decision 2021/914 Module 2, where DPF does not apply.
UK International Data Transfer Addendum to the EU SCCs.

Copies of the safeguards in place for any specific transfer are available on request from legal@parkspot.ai.

10. Security

TLS 1.2+ on all traffic. HSTS enabled on parkspot.ai and www.parkspot.ai.
Encrypted storage at rest. Secrets in managed secret stores, never in source code.
Least-privilege access controls and audit logging on production systems.
Content Security Policy with frame-ancestors none, form-action self and object-src none. Website form submissions go through Next.js server actions, which check the request origin.
Regular dependency scanning and security testing.

Breach notification. If a personal-data breach is likely to result in risk to your rights, we notify you and the relevant supervisory authority within 72 hours, in line with GDPR Article 33 and equivalent state laws.

Report a suspected vulnerability to legal@parkspot.ai. We treat good-faith disclosures with care.

11. European users (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the following supplements this Privacy Policy under Regulation (EU) 2016/679 (GDPR) and the UK GDPR.

Controller. Parkspot is the controller for the personal data described above. For data sent to Parkspot by an enterprise customer (a city or fleet) on behalf of its own users, that customer is the controller and Parkspot is the processor.

Legal bases. The bases on which we process your data are listed in section 3 above (contract, legitimate interest, consent, legal obligation).

Your rights. Access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and the right to complain to your local supervisory authority, all listed in section 8 above. The list of EU supervisory authorities is at edpb.europa.eu/about-edpb/about-edpb/members_en. The UK supervisory authority is the Information Commissioner’s Office (ico.org.uk).

No automated decisions with legal effects. We do not make decisions producing legal effects about you using automated processing alone. Spot suggestions in the app are informational and do not, by themselves, restrict your rights or cause legal consequences for you.

International transfers. See section 9 above.

12. California users (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below.

Right to know what categories of personal information we collect, the sources, the purposes, and the categories of third parties we share with.
Right to delete personal information we have collected about you, subject to exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. There’s nothing to opt out of.
Right to limit use of sensitive personal information. We do not use sensitive personal information for any purpose that would trigger this right.
Right to non-discrimination for exercising any CCPA right.

On this website we treat a Global Privacy Control signal as a decline of analytics cookies (see section 6). To exercise any other right, email legal@parkspot.ai. Authorized agent requests accepted with written authorization.

13. Children

Parkspot is intended for users aged 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted data to us, email legal@parkspot.ai and we’ll delete it.

14. Changes to this policy

We update this policy when our practices change. Material changes are notified by email (for accountholders) and by a notice on the Service for at least 30 days. The “Effective” date at the top of this page always reflects the current version. We will tell you about material changes before they take effect.

15. Contact

Questions about this policy, your data, or to report a security issue: legal@parkspot.ai. General support: support@parkspot.ai.