SwiftSpot Privacy Policy

SwiftSpot ("SwiftSpot," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our parking and storage marketplace platform, website, mobile application, and related services (collectively, the "Services").

This Policy explains our practices; it does not provide blanket consent to every future use. We seek consent where required and collect, use or disclose personal information without consent only where applicable law permits. Optional marketing and location permissions can be refused without consenting to unrelated uses.

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us, including:

• Account Information: Name, email address, phone number, password, and profile photo
• Identity Verification: For host payouts, identity verification is completed directly inside Stripe (Stripe Connect). Stripe collects and verifies government ID, tax, and bank details on its platform. SwiftSpot receives account status and limited Connect account identifiers from Stripe, not your ID document images or full bank account numbers from that flow. We may also collect verification documents you upload to SwiftSpot when we request them for trust and safety.
• Payment Information: Credit card details, bank account information, and billing addresses (processed securely through Stripe)
• Listing Information: Property details, photos, descriptions, availability, and pricing for parking spots and storage spaces
• Storage Information: For storage bookings: item categories, dimensions, and stored item descriptions (no inventory tracking)
• Communication Data: Messages, reviews, ratings, and other communications through our platform; booking issue reports, uploaded evidence, decisions and appeals where submitted
• Support Requests: Information provided when contacting customer support; accepted agreement text and hashes, consent records, schedules, settlement and payment references needed to administer bookings and disputes

1.2 Information Automatically Collected

When you use our Services, we automatically collect certain information:

• Device Information: IP address, browser type, operating system, device identifiers, and mobile network information
• Usage Data: Service records needed to operate and secure bookings remain necessary. Optional first-party product analytics may include page and listing views, searches, and Direct Book steps; on the website they are recorded only after you choose all cookies, and in the iOS app only after you turn on Share optional product analytics in Settings. When Google Analytics 4 is configured and you choose all cookies, Google also processes website usage and device information for analytics
• Location Data: Precise location when you grant device or browser permission for location features; general location may be derived from an IP address. You can withdraw device or browser location permission
• Cookies and Tracking: Information collected through cookies, web beacons, and similar technologies

1.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Social media platforms when you connect your accounts
• Payment processors and financial institutions
• Identity verification services
• Hosts who enter a customer name, email or phone number, reservation dates, space and outside-payment records, including for a customer without a SwiftSpot account; account holders who invite team members or authorized drivers; and the people who respond to those invitations

2. How We Use Your Information

We use your personal information for the following purposes:

2.1 Service Provision

• Create and manage your account
• Process bookings and payments
• Facilitate communication between hosts and renters
• Provide customer support and respond to inquiries
• Verify identity and prevent fraud

2.2 Platform Improvement

• Analyze product usage and improve our Services when you opt in to optional analytics; essential service and security records remain available for operating the Services
• Develop new features and functionality
• Conduct research and analytics
• Personalize your experience

2.3 Communication and Marketing

• Send transactional emails and notifications
• Provide promotional offers and marketing communications (with consent)
• Send service updates and policy changes

2.4 Legal and Safety

• Comply with legal obligations and regulatory requirements
• Enforce our Terms of Service and policies
• Protect against fraud, abuse, and security threats
• Resolve disputes and investigate violations

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

3.1 With Other Users

We share certain information to facilitate transactions:

• Host and renter contact information for confirmed bookings
• Public profile information and reviews
• Listing details and availability

Hosts receive the request and customer details needed to review booking inquiries and prepare invitations before confirmation. When team access is available, invited team members use their own accounts and receive only the data and actions permitted by their assigned role and listings. This may include booking and customer details, messages, arrival details or earnings summaries. Assignment and consequential actions are recorded; revocation removes future access without erasing records needed for accountability and existing obligations.

A booking owner may invite a named authorized driver. After acceptance, the driver can receive the permitted arrival information, such as the address, vehicle information and access notes, for that booking. This does not give the driver control of payments or refunds. Grant and revocation records support security and disputes.

Host-entered customer records support reservation management, contact and payment recordkeeping; an outside-payment entry is the Host's assertion, not Stripe verification. A Host must have authority to provide the information, give any required privacy notice, and limit it to the arrangement. Entering a contact does not create marketing consent. You may contact privacy support for access, correction or deletion review even if you have no account or did not enter the information yourself.

3.2 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform:

• Payment processors (Stripe) for payments, payouts, and host identity verification through Stripe Connect
• Cloud hosting providers for data storage and processing
• Sentry, when configured and optional browser diagnostics are accepted, for error categories and limited locations within deployed script files. The integration filters error content and does not intentionally include account details, page query strings or access credentials; the provider may also receive network metadata needed to receive the report. Contact privacy support for the active processing location, retention and safeguards
• Communication providers for email, SMS and push notifications
• Google, when optional Google Analytics 4 is configured and you choose all cookies, for website analytics as described in the Cookie Policy
• PostHog, when configured and you opt in to optional analytics, for booking steps, confirmation and repeat-booking measurement across the website and iOS app. We use random or pseudonymous identifiers and limited categories; this integration does not send contact details, precise locations, access codes, card details or booking-link tokens. Session recording and automatic interaction capture are not enabled by this integration. Withdrawing consent stops new collection and suppresses queued events when the withdrawal reaches SwiftSpot; it does not automatically erase events already delivered.

When Sentry is configured for server-side error and performance monitoring, diagnostic records can include request and error context, technical identifiers, an account identifier, a correlation identifier and a booking reference. We use these records to investigate service reliability and security. Server monitoring is separate from optional browser diagnostics; disabling default identity forwarding does not remove all personal information from request or error context. Contact privacy support about the provider handling and rights applicable to your records.

3.2.1 Optional AI support

When an AI provider is configured for Spot Assistant, your chat message and conversation history are sent to that provider to generate a reply. Relevant page and account context may also be included. For signed-in users this can include your first name, booking or listing names and addresses, booking dates, payment schedules and payment status. Supported providers include Google Gemini, OpenAI and Anthropic; the configured provider determines which service receives the request. This does not mean every provider receives your information.

AI suggestions can be inaccurate and do not decide your cancellation, refund or legal rights. Use the booking actions and contact support for a reviewed decision. You can use the contact form or support email instead of Spot Assistant. Avoid entering payment card numbers, identity documents or unrelated sensitive information in chat. Contact privacy support for the provider, processing locations, retention and safeguards relevant to your records; this Policy does not promise that a provider has no retention or training use.

When an eligible Host requests a reply draft in Host Messages, SwiftSpot sends Groq the latest visible Renter question and selected listing facts, with linked booking status, dates, timezone and currency where relevant. This draft feature does not send conversation history, contact profiles, addresses, payment details or private arrival instructions. SwiftSpot filters recognizable contact details and access credentials from the question, but filtering may not remove every personal detail. The Host reviews and can edit the draft before sending a message; preparing or inserting a draft does not send it. Hosts can write replies themselves instead.

The host draft pilot uses Groq-hosted GPT-OSS 120B with inference zero data retention enabled. Groq may retain usage metadata and process data outside your country; this setting does not promise Canadian-only processing. SwiftSpot does not save the prepared draft as a message unless the Host sends it. Sent messages follow our normal communication retention practices.

3.3 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes, court orders, or government requests
• Enforce our Terms of Service and protect our rights
• Protect the safety and security of our users and the public
• Investigate fraud, security breaches, or policy violations

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.

4. Data Security

We use access controls, account authentication and secure payment processing to protect personal information. The protections required depend on the sensitivity of the information and applicable law. No method of transmission or storage guarantees absolute security. Contact privacy support to report a concern.

5. Data Retention

We retain your personal information for as long as necessary to:

• Provide our Services and maintain your account
• Comply with legal obligations and regulatory requirements
• Resolve disputes and enforce our agreements
• Prevent fraud and ensure platform security

Where British Columbia PIPA applies, personal information used to make a decision directly affecting you must be retained for at least one year after that use so you have a reasonable opportunity to obtain access. Other lawful retention needs may last longer. When information no longer serves a lawful retention purpose, it must be destroyed or anonymized in accordance with applicable law. Account deletion does not automatically erase required contract, payment or dispute evidence.

Account deletion removes or anonymizes account details but can retain necessary booking, transaction, message, review and dispute records, including identity needed for those records. The deletion safeguard may first create a database backup. Backup copies have separate restricted access and cleanup processes; deletion from the live account does not immediately remove every backup or provider copy. Contact privacy support for a review of retained information and applicable deletion or correction rights.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

6.1 Access and Portability

You can request access to your personal information. The account export includes profile data, renter bookings, reviews, favorites, recent searches and a limited recent message history. It may not contain every retained record; contact privacy support for a fuller access request, booking agreements or settlement records.

6.2 Correction and Update

You can update your account information at any time through your profile settings or by contacting us.

6.3 Deletion

You may request deletion of your personal information by contacting us at [email protected]. We will process your request in accordance with applicable data protection laws. Please note that we may retain certain information as required by law, for fraud prevention, or for legitimate business purposes such as resolving disputes or enforcing our agreements.

6.4 Opt-Out

You can opt out of marketing communications at any time by following the unsubscribe instructions in our emails or updating your preferences.

6.5 Exercising Your Rights

To exercise these rights, please contact us at [email protected]. We will respond within the timeframe required by applicable law. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice; we will explain any consequences for services that require the information. You can raise a privacy complaint with us and, where applicable, with the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada. An internal review does not remove that right.

7. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to enhance your experience and collect usage information. For detailed information about our use of cookies, please see our Cookie Policy.

You can control cookie settings through your browser preferences, though disabling certain cookies may affect the functionality of our Services.

8. International Data Transfers

Service providers may process personal information outside your province or country, including in the United States, where local authorities may have lawful access. Cross-border processing does not remove our responsibility for safeguards required by applicable privacy law. Contact privacy support for information about the providers and countries relevant to your records.

9. Children's Privacy

The SwiftSpot iOS app may be downloaded from the App Store according to Apple's age rating. That rating is a store label. It is not a licence to create an account or complete a booking.

You must be at least 19 years of age to create a new account, book parking or storage, or list a space. If we learn that a new account does not meet this requirement, we will review access and personal information in accordance with applicable law. Existing booking, refund, retrieval and mandatory legal rights are preserved; this eligibility change does not itself cancel a booking or erase required records.

10. Third-Party Links and Services

Our Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our platform.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on our website
• Sending email notifications to registered users
• Providing in-app notifications

Where a new purpose or practice requires fresh consent under applicable law, we will seek that consent. Publishing a revision or continued use does not itself provide consent to unrelated new processing.

12. Contact Information

Address privacy questions, access or correction requests, withdrawal of consent and complaints to our Privacy Officer through the support contact below. You may also contact the applicable privacy regulator:

13. Governing Law

Applicable privacy laws govern our practices, including British Columbia's Personal Information Protection Act and, where applicable, federal PIPEDA. This Policy does not limit statutory access, correction or complaint rights in any applicable jurisdiction.