Privacy Policy

Zeropark Smart Parking ("Zeropark," "we," "us," "our") operates the Zeropark smart parking marketplace platform ("Platform"), serving two categories of individuals:

• Users — drivers who discover and book parking spots.
• Providers — individuals or businesses who list parking spots for booking.

This Privacy Policy explains what personal data we collect from Users and Providers, why we collect it, how it is used, stored, shared, and protected, and what rights you have over it. It applies across our web app, mobile app, and admin-facing tools.

By using the Platform, you consent to the data practices described in this Policy, to the extent required under applicable Indian data protection law, including the Digital Personal Data Protection Act, 2023.

We process personal data for the following purposes, consistent with collecting basic identity information (email, phone number, and related details) to offer and improve our services:

1. 1Account creation & authentication — Email/phone verification, OTP delivery, login, session management.
2. 2Core marketplace functionality — Matching Users with nearby Providers, resolving pricing, creating and managing reservations, generating QR codes for check-in/check-out.
3. 3Payments & payouts — Processing reservation and subscription payments via Razorpay; calculating and disbursing Provider payouts.
4. 4Communication — Transactional messages (booking confirmations, receipts, OTPs), and — where you have opted in — promotional messages.
5. 5Trust & safety — Fraud detection, abuse prevention, enforcing the Acceptable Use Policy and Community Guidelines, admin review of flagged listings/users.
6. 6Service improvement — Understanding usage patterns to improve search relevance, app performance, and feature design.
7. 7Legal & regulatory compliance — Tax records, dispute resolution, responding to lawful government or law-enforcement requests.
8. 8Provider contact unlock feature — Sharing a Provider's registered contact details with a User who has unlocked that Provider (within free quota or via paid subscription), and vice versa, strictly for coordinating a booking.

We do not sell personal data to third parties for their independent marketing purposes.

Under the DPDPA, we process personal data on the basis of:

• Consent — obtained at account registration, permission prompts (e.g., location access), and opt-in checkboxes for marketing communications.
• Legitimate use — for purposes such as fraud prevention, service functionality, and responding to a request you have made (e.g., processing a booking you initiated).
• Legal obligation — retention of transaction and tax records as required under Indian law.

You may withdraw consent at any time (see Section 8), though this may limit or disable certain features (e.g., disabling location access will disable nearby-spot search).

We share personal data only as necessary, with the following categories of recipients:

We do not share full payment credentials (card numbers, CVV, UPI PIN) with any party other than Razorpay, which processes them directly.

6.1 Provider business information (spot address, pricing, amenities, photos) is publicly displayed on the discovery map and spot detail pages to Users, as this is the core function of a spot listing.

6.2 Provider payout details (bank account/UPI) are used solely for disbursing earnings and are handled with the same security controls as User payment data.

6.3 Where a Provider is a registered business, GST or business registration details (if collected) are used for invoicing and tax compliance only.

7.1 We apply industry-standard technical and organisational measures, including:

• Password hashing (bcrypt), JWT-based stateless authentication, and role-based access control (User/Provider/Admin).
• Encryption in transit (TLS/HTTPS) for all API traffic.
• Database access restricted to authorised backend services; no direct public database access.
• Payment data never stored on ZeroPark servers — handled exclusively by Razorpay.

7.2 No system is completely secure. In the event of a data breach affecting personal data, we will notify affected individuals and the relevant authority (e.g., the Data Protection Board of India, once constituted) as required under applicable law.

Subject to applicable law (including the DPDPA), you have the right to:

• Access the personal data we hold about you.
• Correct or update inaccurate or incomplete data (available directly via account settings for most fields).
• Withdraw consent for optional processing (e.g., marketing communications, location access).
• Request erasure of your account and associated personal data, subject to legally mandated retention (see our Data Retention Policy).
• Nominate another individual to exercise your rights in the event of death or incapacity, where supported by law.
• Grievance redressal — raise a complaint with our Grievance/Data Protection Officer (Section 10) before approaching the Data Protection Board of India.

To exercise these rights, contact privacy@zeropark.in. We will respond within the timeline prescribed by applicable law.