On this page
Who we are
Parking Master is a parking management and point-of-sale service for companies that run car parks (our "customers"). It is operated by Parking Master, Asia International Market, Zindabazar, Sylhet. Write to us at privacy@parkingmaster.app.
Our role
- We are the controller of account data: the names, emails, mobile phone numbers and sign-in details of the owners and staff who use Parking Master.
- For the records each customer keeps about the cars that use its car parks (plates, visits and payments), the customer is the controller and we process those records for it. If you parked at a car park and have a question about its records, ask that car park's operator; we help them answer.
What we collect
- Account details: the name and email of each owner and staff member, a password stored only as a hash, the company's and each site's name, and the name staff are shown by on receipts.
- Mobile phone number: an owner's, given when signing up (we are making it required for new sign-ups); any account holder's own, added or changed while signed in; and an owner's that we enter when we set up a company for them from our own console. It is stored in one form, +880 and the ten-digit number. We send no text messages: a number is never checked by SMS.
- Vehicle and visit records: the plate typed at the gate, the vehicle type, entry and exit times, the site, the booking number, and any change to them, such as a corrected plate or a voided stay.
- Money records: each payment (amount, method, who collected it and when), cash shifts and cash movements, and a record of each receipt printed.
- Devices: the terminal's name, platform and app version, when it was last seen, and a random identifier the app creates when it is installed. It is not derived from the hardware. The app holds three Android permissions: internet access, network-state access (to tell whether the terminal is online), and an internal permission Android uses between the app's own parts, which no other app can hold. It asks for no location, camera, contacts or phone identifiers, and uses no advertising identifier.
- Security data: the IP address and app or browser details of each sign-in session; the IP address recorded with administrative changes in the audit trail; and the IP address used, briefly, to slow down repeated failed sign-ins and abusive request rates. Our host also keeps request logs.
- Error reports: when the app or the service fails, a report of the error, the app version, the platform and operating system version, the install identifier, and the company and user it happened for. Before it is stored, email addresses are removed from the error text, and plates and phone numbers in it are replaced by a short one-way code.
- On the terminal: the app keeps its sign-in token in the device's secure keystore, a local copy of the cars currently inside a site (their plates and amounts) so the gate keeps working, and a log of crashes waiting to be sent.
Why we use it
To provide the service (check-in, checkout, receipts, cash shifts and reports), to keep accounts secure, to keep the accounting records customers need, and to find and fix errors. We do not sell data, show advertising, or use analytics or tracking, in the app or on this website.
A mobile phone number is used only to contact the account holder about their account and the service: support, billing and security. It is never used for marketing and never sold. It is seen by the account holder, in the app, and by us, in our own console: a company's page there shows its owners' numbers, and a company's data export includes its members' numbers. No one in a company sees another member's number.
Who processes it for us
- Cloudflare, Inc. hosts the service (Cloudflare Workers), stores its data (the D1 database and Durable Objects), and keeps its request logs. This website is hosted on Cloudflare too, and holds no data.
- Google distributes the Android app through Google Play, under Google's own privacy policy.
- Apple distributes the iPhone app through the App Store, under Apple's own privacy policy.
- Resend, Inc. (in the United States) sends our emails. Today that is the sign-up verification email: Resend receives the recipient's email address and the message, which carries the 6-digit code, and delivers it. We keep the code itself only as a keyed hash, never the code, and it expires after 10 minutes.
- Telegram: when the service records an error, a short alert is sent to our own Telegram chat so we can fix it. It carries the environment, the error code, the address pattern of the request (never the address itself), a request reference, the app version, and the first line of the error after scrubbing. It never carries a company, user or site identifier, a name, an email, a password or token, or a request's contents. A plate in the error text appears only as the short one-way code described above.
How long we keep it
These periods were decided on 24 October 2026 at 15:36:07 (UTC+6), except the audit period, which carries its own date. Where a period is not yet enforced automatically, it says so.
IP addresses (request and security logs): 30 days.
Automatic enforcement of this period is being implemented (target 2026-11-07). Until then, deletion requests sent to privacy@parkingmaster.app are completed by hand within 30 days.
Vehicle plates and per-visit records (entry and exit times, and any photo or receipt detail naming a plate): 12 months after the visit. Then ANONYMISED: the plate removed or irreversibly replaced. Counts and totals are kept.
Automatic enforcement of this period is being implemented (target 2026-11-07). Until then, deletion requests sent to privacy@parkingmaster.app are completed by hand within 30 days.
Money records (payments, receipts, shift cash, ledgers): 6 years, for accounting and tax. Their plate details are anonymised at 12 months like the rest. Amounts, dates and receipt numbers are never altered.
Automatic enforcement of this period is being implemented (target 2026-11-07). Until then, deletion requests sent to privacy@parkingmaster.app are completed by hand within 30 days.
Audit and accounting records, including who performed an action: 6 years, like money records. Names and emails in audit snapshots are kept with them. IP addresses in audit records follow the 30-day rule above.
Decided on 24 October 2026 at 16:16:48 (UTC+6).
Automatic enforcement of this period is being implemented (target 2026-11-07). Until then, deletion requests sent to privacy@parkingmaster.app are completed by hand within 30 days.
Account details (owner and staff names, emails, mobile phone numbers): kept while the account is active; anonymised within 30 days of a deletion request; an account unused for 24 months gets an email notice, then is anonymised 30 days later unless it is used.
Automatic enforcement of this period is being implemented (target 2026-11-07). Until then, deletion requests sent to privacy@parkingmaster.app are completed by hand within 30 days.
The consent record (ToS version and time) is kept with the account and anonymised with it.
Automatic enforcement of this period is being implemented (target 2026-11-07). Until then, deletion requests sent to privacy@parkingmaster.app are completed by hand within 30 days.
Backups age out within 30 days, so a deletion is complete everywhere within 60 days at most.
Automatic enforcement of this period is being implemented (target 2026-11-07). Until then, deletion requests sent to privacy@parkingmaster.app are completed by hand within 30 days.
Your rights
You can ask us for a copy of your account data, ask us to correct it, or ask us to delete it. To delete an account, see Delete your account. For any other request, write to privacy@parkingmaster.app.
Security
All traffic is encrypted in transit. Passwords are stored only as hashes. Each staff member sees only what their role allows, and each company's data is kept apart from every other company's.
Changes
When this policy changes, we update this page and the date at its top.