Privacy Policy

Kerbie is operated by Razart Hasaj, trading as Kerbie, a sole trader based in the United Kingdom.

Business address: Suite RA01, 195-197 Wood Street, London, E17 3NU

ICO Registration Number: ZC164069

For all data protection enquiries, contact us at: privacy@kerbie.app

Kerbie is a parking management app intended for drivers. You must be at least 17 years of age to create an account and use this service, in line with the UK minimum driving age.

We do not knowingly collect personal data from individuals under 17. If we become aware that a user is under 17, we will delete their account and all associated data without delay.

In compliance with the UK Children's Code (Age Appropriate Design Code), we apply privacy-by-default settings for all users and do not use personal data for profiling or targeted advertising.

Account data:

• Email address
• Hashed password (we never store your password in plain text)

Location data:

• Your current location (used to find nearby parking)
• Destination coordinates (used to calculate parking routes)
• Parking session coordinates

Parking session data:

• Location name, start and end times, duration
• Session history

Parking search records:

• A summary of the parking options shown to you for a search (location and our guidance), kept as a record of what the app displayed

Sign scan images:

• Photos of parking signs you upload for AI analysis
• AI-generated interpretation of the sign

Payment data:

• Payment details are processed securely by Stripe. We do not store your card details.

Enforcement reports:

• Location and description of warden activity you report

Feedback:

• Star ratings, category, and message content submitted via our feedback form

Device data:

• Push notification token (FCM), used to send parking expiry alerts to your device

We process your personal data under the following legal bases as defined by UK GDPR:

• Contract (Article 6(1)(b)): Processing necessary to provide the Kerbie service, including account creation, parking sessions, and sign scanning.
• Legitimate interests (Article 6(1)(f)): Improving our service, detecting fraud, and ensuring platform security.
• Consent (Article 6(1)(a)): Push notifications — you may withdraw consent at any time via your device settings.
• Legal obligation (Article 6(1)(c)): Compliance with applicable UK laws and regulatory requirements.

• To create and manage your Kerbie account
• To provide parking session management and expiry alerts
• To analyse parking sign images using AI
• To process your Premium subscription payments via Stripe
• To generate PCN appeal letters (Premium feature)
• To display nearby parking enforcement activity
• To respond to your feedback and improve the service
• To send transactional emails (password resets, receipts)
• To comply with legal obligations

When you scan a parking sign, the image is sent to Anthropic (Claude AI) and/or Google Cloud Vision for analysis. This processing occurs in real time.

Images are used solely for the purpose of interpreting the parking sign and are not used to train AI models. Images are not stored by Kerbie beyond the session in which they are uploaded, unless you have an active parking session associated with the scan.

By using the sign scanner, you consent to your image being processed by these third-party AI services. You may choose not to use this feature if you do not consent.

Location data is considered sensitive personal data and is handled with care. We collect your location only when you actively use features that require it (e.g., finding parking or starting a session).

The personal link to your parking‑session location data is removed after 12 months, or immediately when you delete your account. The remaining de‑identified location and outcome data cannot be traced back to you and is retained to improve parking recommendations for everyone.

To improve our parking recommendations we also record usage and parking‑outcome events (for example, which spots were recommended and whether parking succeeded), which can include the location involved. The link between these events and your account is removed after 12 months, or immediately when you delete your account. The remaining de‑identified data cannot be traced back to you and is kept to improve the service for everyone.

We do not sell or share your location data with advertisers or data brokers.

We share your data only with the third-party service providers necessary to operate Kerbie:

We do not sell your personal data to any third party.

Some of our service providers are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or transfers to countries with an adequacy decision.

You have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restriction — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — for any processing based on consent (e.g. push notifications)

To exercise any of these rights, contact us at privacy@kerbie.app. We will respond within 30 days.

You can also delete your account directly in the app via Profile → Delete Account, which removes all your personal data immediately.

Strictly necessary: Kerbie stores session tokens in your browser's local storage to keep you logged in. These are essential for the service to function and require no consent.

Analytics (optional, opt-in): with your consent, we use PostHog to understand how the app is used (pages visited, features used). Analytics never run unless you accept the consent prompt, and you can decline with no loss of functionality. To withdraw consent later, clear the site/app data for Kerbie or contact us at privacy@kerbie.app. Analytics data is not used for advertising and is never sold.

Error monitoring: we use Sentry to capture crashes and errors so we can fix them. Error reports have all text masked and media blocked — they do not contain what you typed or viewed.

We do not use advertising cookies and we do not sell or share data with advertisers or data brokers.

Push notifications require explicit consent from your device operating system and can be withdrawn at any time via your device settings.

We take the security of your personal data seriously:

• All data is encrypted in transit using TLS (HTTPS)
• Passwords are hashed using bcrypt with a cost factor of 12
• Database access is restricted to authorised services only
• Authentication uses signed JWT tokens with a 7-day expiry
• Our infrastructure is hosted on Railway with regular security updates

If you believe your account has been compromised, contact us immediately at privacy@kerbie.app.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, where changes are significant, notify you by email.

Your continued use of Kerbie after any changes constitutes your acceptance of the updated policy.

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK's data protection regulator:

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first at privacy@kerbie.app.