Privacy Policy

Depending on how you use ParkMarket, we collect:

• Account details — name, email, phone number, address, and (optional) company name, provided at signup or via your profile page.
• Listing data — a space's location, photos, price, availability, and description, if you list a space as a Host.
• Booking data — dates, prices, and status of bookings you make or receive.
• Messages — content you send another user through ParkMarket's built-in messenger.
• Reviews — ratings and comments you leave about, or receive from, another user after a booking.
• Usage data — pages you view and basic technical data (e.g. approximate location from your browser, IP address in server logs) needed to run the site and show relevant listings.
• Google account data — if you sign in with Google, we receive your name, email, and profile photo from Google, nothing else.

We use your data to run the marketplace itself: creating and managing your account, showing your listing to Guests or a Guest's booking request to a Host, letting a Host and Guest identify and contact each other for a confirmed or pending booking, sending you notifications about your bookings and messages, and enforcing these terms (e.g. the message filter that blocks contact-info sharing).

Our legal basis is mainly performance of a contract (you can't use a two-sided marketplace without the other side being able to see who they're dealing with) and legitimate interest (keeping the platform working and safe). Where we ask for explicit consent — for example, marketing email, if we ever add it — we'll ask separately and you can withdraw it at any time.

We don't sell your data. We share it only as needed to run the service:

• The other party to a booking — a Host sees a Guest's name, phone, email, and address on a booking request (so they know who's asking before deciding whether to confirm), and vice versa.
• Supabase — our database and authentication provider, which stores account, listing, and booking data.
• Cloudflare — hosts the website and its infrastructure.
• Resend — sends transactional emails (booking notifications), once configured; not yet active.
• OpenStreetMap — used for address lookup and map display when you search or set a listing's location; this is a public, free service and no personal account data is sent to it.

ParkMarket does not yet process payments, so we don't collect or store any card or bank details today. Once in-platform payments go live through a licensed payment provider, this policy will be updated to describe exactly what payment data that provider handles — ParkMarket itself will never see or store your raw card number.

We keep account, listing, booking, message, and review data for as long as your account is active, since a booking's history (and the reviews built on it) is part of what makes the platform trustworthy. If you delete your account, contact us at info@parkmarket.ee and we'll delete or anonymize your personal data, except where we're required to keep records for legal or accounting reasons.

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data — most of this you can do yourself on your profile page.
• Request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
• Restrict or object to certain processing.
• Request a copy of your data in a portable format.
• Lodge a complaint with Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon) or your own country's supervisory authority.

ParkMarket uses one functional cookie (parkmarket_locale) to remember your chosen language — nothing else is stored client-side today. We don't currently use analytics or advertising cookies. If that changes, we'll update this policy and, where legally required, ask for your consent first.

Your data is stored with Supabase and protected by row-level access rules — for example, a user's profile fields are only ever exposed to the specific other party in an active booking, not to every user on the platform. No system is perfectly secure, but we take reasonable technical measures to protect your data.

ParkMarket is not intended for use by anyone under 18, and we don't knowingly collect data from children.

Our infrastructure providers (Supabase, Cloudflare) may process data outside Estonia, including outside the EU/EEA, using appropriate safeguards (such as EU Standard Contractual Clauses) where required.

We'll update the date at the top of this page whenever this policy changes, particularly once real payment processing is added.

Questions about this policy, or a request relating to your data? Reach us at info@parkmarket.ee. ParkMarket is operated by Hengineering OÜ, Estonia.