Privacy Policy

Kerbie is operated by SYNTERNEX LTD (company number 17437894), a company registered in England and Wales.

Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

ICO Registration Number: ZC240408

For all data protection enquiries, contact us at: privacy@kerbie.app

Kerbie is a parking management app intended for drivers. You must be at least 18 years of age to create an account and use this service, as using Kerbie (including any paid subscription) forms a binding agreement.

We do not knowingly collect personal data from individuals under 18. If we become aware that a user is under 18, we will delete their account and all associated data without delay.

In compliance with the UK Children's Code (Age Appropriate Design Code), we apply privacy-by-default settings for all users and do not use personal data for profiling or targeted advertising.

Account data:

• Email address
• Hashed password (we never store your password in plain text)

Location data:

• Your current location (used to find nearby parking)
• Destination coordinates (used to calculate parking routes)
• Parking session coordinates

Parking session data:

• Location name, start and end times, duration
• Session history

Parking search records:

• A summary of the parking options shown to you for a search (location and our guidance), kept as a record of what the app displayed

Sign scan images:

• Photos of parking signs you upload for AI analysis
• AI-generated interpretation of the sign

Payment data:

• Payment details are processed securely by Stripe. We do not store your card details.

Enforcement reports:

• Location and description of warden activity you report

Feedback:

• Star ratings, category, and message content submitted via our feedback form

Device data:

• Push notification token (FCM), used to send parking expiry alerts to your device

We process your personal data under the following legal bases as defined by UK GDPR:

• Contract (Article 6(1)(b)): Processing necessary to provide the Kerbie service, including account creation, parking sessions, and sign scanning.
• Legitimate interests (Article 6(1)(f)): Improving our service, detecting fraud, and ensuring platform security.
• Consent (Article 6(1)(a)): Push notifications — you may withdraw consent at any time via your device settings.
• Legal obligation (Article 6(1)(c)): Compliance with applicable UK laws and regulatory requirements.

• To create and manage your Kerbie account
• To provide parking session management and expiry alerts
• To analyse parking sign images using AI
• To process your Kerbie Pro subscription payments via Stripe
• To generate PCN appeal letters (Kerbie Pro feature)
• To display nearby parking enforcement activity
• To respond to your feedback and improve the service
• To send transactional emails (password resets, receipts)
• To comply with legal obligations

When you scan a parking sign, the image is sent to Anthropic (Claude AI) and/or Google Cloud Vision for analysis. This processing occurs in real time.

Images are used solely for the purpose of interpreting the parking sign and are not used to train AI models. Images are not stored by Kerbie at all. They are processed in memory to extract the sign's text and discarded immediately afterwards — this is true whether or not the scan is linked to an active parking session. Only the extracted text and the resulting parking rules are saved to your account.

We process scan images because it is necessary to provide the sign-scanning feature you have asked us to perform (Article 6(1)(b)). If you would rather your images were not sent to these providers, simply do not use the scanner — every other part of Kerbie works without it.

Location data is considered sensitive personal data and is handled with care. We collect your location only when you actively use features that require it (e.g., finding parking or starting a session).

The personal link to your parking‑session location data is removed after 12 months, or immediately when you delete your account. The remaining de‑identified location and outcome data cannot be traced back to you and is retained to improve parking recommendations for everyone.

To improve our parking recommendations we also record usage and parking‑outcome events (for example, which spots were recommended and whether parking succeeded), which can include the location involved. The link between these events and your account is removed after 12 months, or immediately when you delete your account. The remaining de‑identified data cannot be traced back to you and is kept to improve the service for everyone.

We do not sell or share your location data with advertisers or data brokers.

We share your data only with the third-party service providers necessary to operate Kerbie:

When you search for a destination, the text you type and your approximate location are sent to our address-search providers (Nominatim and Photon) solely to return matching places — they do not receive your account details.

We do not sell your personal data to any third party.

Some of our service providers are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or transfers to countries with an adequacy decision.

You have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restriction — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — for any processing based on consent (e.g. push notifications)

To exercise any of these rights, contact us at privacy@kerbie.app. We will respond within 30 days.

You can also delete your account directly in the app via Profile → Delete Account. This deletes your account and immediately removes the link between you and your parking sessions, searches, scans and usage records. Three things survive deletion: your Stripe payment records, which Stripe (not Kerbie) retains independently under its own legal obligations; de-identified location and outcome data that can no longer be traced back to you; and, if you have used Community Spaces, any trust and safety report filed about your account, which is retained to prevent repeat contact with the person who reported you. All three are described in section 10.

Strictly necessary: Kerbie stores session tokens in your browser's local storage to keep you logged in. These are essential for the service to function and require no consent.

Analytics (optional, opt-in): with your consent, we use PostHog to understand how the app is used (pages visited, features used). Analytics never run unless you accept the consent prompt, and you can decline with no loss of functionality. To withdraw consent later, clear the site/app data for Kerbie or contact us at privacy@kerbie.app. Analytics data is not used for advertising and is never sold.

Error monitoring: we use Sentry to capture crashes and errors so we can fix them. Error reports have all text masked and media blocked — they do not contain what you typed or viewed.

We do not use advertising cookies and we do not sell or share data with advertisers or data brokers.

Push notifications require explicit consent from your device operating system and can be withdrawn at any time via your device settings.

We take the security of your personal data seriously:

• All data is encrypted in transit using TLS (HTTPS)
• Passwords are hashed using bcrypt (cost factor 10)
• Database access is restricted to authorised services only
• Authentication uses short-lived signed JWT access tokens (15 minutes) plus refresh tokens (30 days), and all tokens are invalidated when you reset your password
• Our infrastructure is hosted on Railway with regular security updates

If you believe your account has been compromised, contact us immediately at privacy@kerbie.app.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, where changes are significant, notify you by email.

Your continued use of Kerbie after any changes constitutes your acceptance of the updated policy.

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK's data protection regulator:

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first at privacy@kerbie.app.