Privacy Policy

Information you provide directly:

• Account registration: full name, email address, password.
• Profile: phone number, profile photo.
• Listings: parking spot address, photos, pricing, and description.
• Bookings: vehicle licence plate, booking dates, payment method preference.
• Communications: messages you send to SpotLoop support or other users.

Information collected automatically:

• Location. With your permission, we collect your device's precise GPS location to show nearby parking spots. You can disable this at any time in your device settings; the Platform will fall back to your entered city or address.
• Usage data. Pages visited, search queries, clicks, session duration, and referring URLs, collected via cookies and server logs.
• Device information. Browser type and version, operating system, IP address, and device identifiers.

Information from third parties:

• Google OAuth. If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive your Google password.
• Payment processors. Stripe processes your payment information directly. We receive only a transaction reference, amount, and status — we never store your full card number, CVV, or bank account details on our servers.

We use your information to:

• Create and manage your account.
• Display nearby parking spots based on your location or search query.
• Facilitate bookings between Hosts and Renters.
• Process payments and issue refunds or credits.
• Send booking confirmations, receipts, and access instructions.
• Communicate platform updates, policy changes, and security alerts.
• Detect and prevent fraud, abuse, and unauthorized access.
• Improve the Platform through analytics and user research.
• Comply with legal obligations.

We do not sell your personal information to third parties. We do not use your information for targeted advertising.

We share your information only in the following circumstances:

• Between Hosts and Renters. When a booking is confirmed, we share the Renter's first name and vehicle plate with the Host, and the Host's access instructions with the Renter. Full contact details are not shared unless both parties consent.
• Service providers. We use Supabase (database and authentication), Stripe (payments), and similar vendors to operate the Platform. These vendors process data on our behalf under data processing agreements and are prohibited from using your data for their own purposes.
• Legal requirements. We may disclose information if required by law, court order, or government authority, or where we believe disclosure is necessary to protect the safety of any person or to prevent fraud.
• Business transfers. If SpotLoop is acquired or merged, your information may be transferred to the acquiring entity. We will notify you before your information becomes subject to a different privacy policy.

We use cookies and similar technologies to keep you signed in, remember your preferences, and analyse how the Platform is used. Essential cookies are required for the Platform to function; analytics cookies are optional.

You can control cookies through your browser settings. Disabling cookies may prevent some features from working correctly, including staying signed in.

We retain your account information for as long as your account is active. If you delete your account, we delete your personal information within 30 days, except where we are required to retain it for legal or accounting purposes (for example, transaction records for tax compliance, which we keep for 7 years as required by the Canada Revenue Agency and applicable US tax law).

We use industry-standard security measures including encrypted connections (HTTPS), encrypted data storage, and access controls. Passwords are hashed and never stored in plain text. Payment data is handled entirely by PCI-DSS compliant processors (Stripe) and never stored on our servers.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we will notify you promptly in the event of a breach that affects your personal information, as required by applicable law.

Depending on where you live, you may have the following rights regarding your personal information:

• Access. Request a copy of the information we hold about you.
• Correction. Ask us to correct inaccurate information.
• Deletion. Ask us to delete your account and personal data.
• Portability. Request your data in a machine-readable format.
• Withdrawal of consent. Withdraw consent for location access or optional communications at any time.

Canadian residents have rights under PIPEDA (Personal Information Protection and Electronic Documents Act) and applicable provincial privacy legislation. California residents have rights under the CCPA (California Consumer Privacy Act).

To exercise any of these rights, contact us at privacy@spotloop.ca. We will respond within 30 days.

The Platform is not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please contact us and we will delete it promptly.

SpotLoop is based in Canada. Our service providers, including Supabase, Stripe, and others, may process your data in the United States or other countries. Where data is transferred outside Canada, we ensure appropriate safeguards are in place, including contractual clauses that meet Canadian and applicable international standards.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Platform at least 14 days before the changes take effect. Your continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer at: