Privacy Policy

Last updated: October 15, 2026 · Effective: October 15, 2026 · Version 2.1

MyRedPark is a parking marketplace operated by Zopytech Ltd., incorporated under the Canada Business Corporations Act (CBCA) with its registered office in the Province of Ontario, Canada ("MyRedPark", "we", "us"). Zopytech Ltd. is the organization responsible (the "controller" or equivalent under applicable law) for the personal information described in this Policy. Privacy contact for all requests, questions, and complaints: support@zopytech.com. This Policy is a separate document from our Terms of Service; accepting the Terms is never a waiver of your privacy rights, and optional consents are always separate.

1. Information We Collect.

Depending on how you use the platform, we collect or process: (a) Account and contact information — name, email address, password (stored only salted and hashed), account role, and profile settings. (b) Vehicle information — nickname, make, model, year, colour, license plate, and province/state, when you register a vehicle; each booking keeps an immutable snapshot of the vehicle used. (c) Listing, property, and location information — listing/property addresses, coordinates, photos, descriptions, availability, pricing, access instructions, and (for hosts) the province/state and postal code used for pricing and tax determination. (d) Booking and reservation details — times, durations, rate plans, extensions, cancellations, arrival-code verification events, and session timing. (e) Payment, transaction, invoice, fee, and tax information — amounts, currency, status, fees, taxes, invoices, payout records, and references. Full card numbers and banking details are collected and stored by Stripe on its PCI-compliant infrastructure, never on MyRedPark servers. (f) Verification status and information — whether required checks were completed and their outcomes, processed through our verification providers (Stripe and, where enabled, Persona). We record the outcome and status, not your underlying identity documents. (g) Host and property content — listing photos, parking instructions, declarations (with version and timestamp), and listing content you submit. (h) Communications — chat messages between booking parties, support conversations, and listing reports (including the reporter's contact email, used only to investigate the report). (i) Property-access interactions — QR-code or property-code verification events where recorded for commercial properties, and arrival-code (OTP) confirmation events. (j) Device, usage, and technical data — IP address, browser or device information, push-notification tokens (where you enable notifications), notification preferences, email-delivery records, and a minimal deduplication record (event key, recipient, timestamp) for transactional emails. We do not build device-fingerprint profiles. Your IP address is additionally used, transiently and at country level only, to determine your approximate country so the marketplace can default listing results to your region; the result is held in memory or a session cookie for that purpose, is never a precise location, and your IP address is not permanently stored for regional detection. (k) Location information — search coordinates you provide (processed to return nearby listings), and, for hosts using the optional one-time proximity verification, an in-memory comparison of device location to the listing: we store only the outcome (verified or not, with a coarse distance band) and never store live GPS coordinates. We do not track background location on the website. (l) Information received from integrated providers — for example account or onboarding status from Stripe, or sign-in identifiers from Google if you use social sign-in. (m) Information you voluntarily submit — reviews, survey or support responses, and any other content you choose to provide. We do not collect a data category unless the platform or an integrated provider actually processes it, and we do not collect sensitive personal characteristics for risk or eligibility decisions.

2. Purposes and Legal Bases.

We process personal information to operate the marketplace: creating and securing accounts; publishing and displaying listings; processing bookings, holds, payments, extensions, renewals, cancellations, and refunds; calculating applicable taxes; verifying identity and payout eligibility where required; timing parking sessions and arrival verification; operating commercial property access (QR codes and property codes); sending transactional communications (booking, payment, session, renewal, security, and service notices); providing customer support and handling disputes, incidents, and reports; preventing fraud, abuse, and unauthorized listings; maintaining platform security and audit trails; meeting legal, tax, and accounting obligations; and improving the service using aggregated or de-identified information. Where a privacy regime requires a stated legal basis, we rely on: performance of our contract with you (bookings, payments, account operation); our legitimate interests in security, fraud prevention, dispute handling, and service improvement (balanced against your rights); compliance with legal obligations (tax, accounting, lawful requests); and your consent where required (for example optional marketing communications or certain optional verification features) — consent can be withdrawn at any time without affecting prior lawful processing. We do not send marketing email merely because you registered.

3. How We Share Information.

We share personal information only as needed to operate the service, with: (a) Other users, as required for a booking — Hosts see the Driver's name, booking details, and (once payment is authorized) the vehicle's make, model, colour, and license plate; Drivers see the Host's name and listing details. A listing's exact address and coordinates are revealed to a Driver only once payment is authorized, and access or entry instructions only after payment is completed. Listings are otherwise displayed publicly with an approximate location only. Counterparties never see each other's email address. (b) Stripe — payments, payouts, connected-account onboarding, identity-related checks, and tax calculation, under Stripe's own terms and privacy policy. (c) Verification providers — Persona, where identity verification is enabled for a feature. (d) Infrastructure providers — hosting, database, and security providers that process data on our behalf under contractual safeguards. (e) Mapping and geocoding providers — OpenStreetMap-based services (Nominatim/Photon) that receive the search or address queries needed to return locations. (f) Communications providers — Resend (transactional email delivery) and push-notification providers (where you enable notifications). (g) Professional advisers, insurers, and authorities — where required or permitted by law, regulation, legal process, or to protect rights, safety, and the integrity of the platform. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising. We have no advertising providers integrated.

4. International Processing.

MyRedPark is operated from Canada. Some service providers (including Stripe and infrastructure or communications providers) process information in the United States and possibly other countries. Where information is processed outside your jurisdiction, it may be subject to the laws of those jurisdictions, including lawful access by authorities. We use contractual and organizational safeguards appropriate to the transfer. We do not claim that all data remains in Canada.

5. Retention and Deletion.

You can delete your account at any time from your profile. When a deletion request is accepted, your access is disabled immediately and your sessions are revoked; eligible personal data is scheduled for permanent deletion or irreversible de-identification after a 30-day retention window, executed by an automated process whose completion or failure is recorded in an admin audit trail. Financial records tied to bookings, payments, payouts, taxes, invoices, disputes, and fraud prevention are retained as required by law, without keeping unnecessary profile information; stored license plates are scrubbed while historical booking and payment records are retained as required. To prevent abuse of one-time introductory offers, we keep a minimal eligibility record for up to 90 days after the later of an offer redemption or account deletion: a keyed-HMAC-protected identity key (never your raw email, card, or government-ID data), the offer type, redemption and deletion timestamps, and the cooldown window. When a listing is deleted, we retain only a minimal record of the host's declaration (version, acceptance timestamp, authorization type) and verification outcome — the listing's exact location and photos are not retained in that archive. Email-verification and password-reset tokens are short-lived, single-use, and stored only as hashes. A reporter's contact email is retained only while the report is open and is permanently deleted when the report is resolved. Account deletion does not immediately remove records that must be retained for financial, tax, dispute, fraud-prevention, security, or other legal obligations.

6. Your Privacy Rights.

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal information; to object to or restrict certain processing; to withdraw consent; and to complain to a regulator. To exercise any right, contact support@zopytech.com (or use in-app support) — we respond through the support process and may need to verify your identity first. (a) Canada (PIPEDA and provincial laws, including Quebec Law 25): you may request access to and correction of your personal information, withdraw consent (subject to legal or contractual restrictions), and complain to our privacy contact and to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, as applicable. Quebec users: you may also have rights to data portability and to information about automated decision-making; we do not make solely automated decisions with significant effects. Our privacy contact (support@zopytech.com) acts as the person responsible for the protection of personal information. (b) European Union / United Kingdom (GDPR / UK GDPR): where these laws apply, you have the rights of access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with your supervisory authority; our legal bases are described in Section 2. (c) California and other US states (CCPA/CPRA and similar laws): you may have rights to know, access, correct, delete, and opt out of sale or sharing of personal information, and to non-discrimination for exercising them. We do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes requiring an opt-out under those laws. Exercising privacy rights is never a condition that requires giving up other legal rights, and we will not discriminate against you for exercising them.

7. Security.

Sessions are server-managed and revocable, passwords are salted and hashed (PBKDF2), transport is encrypted over HTTPS, payment data is handled by Stripe on PCI-compliant infrastructure, and administrative actions are recorded in audit trails. No method of transmission or storage is perfectly secure; we maintain safeguards appropriate to the sensitivity of the information.

8. Children.

The platform is not directed to children, and accounts require the legal capacity to enter a binding agreement. We do not knowingly collect personal information from children.

9. Changes to This Policy.

We may update this Policy prospectively. The current version and effective date are always published in the app. For material changes we will provide notice through the app or by email before they take effect. Previous versions' acceptance records are retained where required.

10. Contact.

Privacy contact for all requests, questions, and complaints: support@zopytech.com, or in-app support from your account.