Privacy notice
Last updated 3 September 2026
1. Who we are
Scan to Park is operated by BB AI Limited (company number 17441545), registered at Astute House, Wilmslow Road, Wilmslow, SK9 3HP. We are the data controller for the personal information described in this notice.
Our registration with the Information Commissioner’s Office is pending.
To contact us about anything in this notice, email [email protected].
2. What this notice covers
We hold information about three groups of people, and what we do differs for each:
- Drivers — people who pay a parking fee through our payment page.
- Car park users — people at a car park who hold an account on our dashboard.
- Website visitors — anyone who visits our marketing website.
Sections 3 to 5 deal with each in turn. Sections 6 onwards apply to everyone.
3. Drivers
3.1 What we collect
When someone pays a parking fee through our page:
| Information | Where it comes from |
|---|---|
| Vehicle registration, where the car park asks for it | The person making the payment |
| The duration selected, or the amount paid if the car park lets drivers choose their own amount | The person making the payment |
| Email address, and phone number if given | The person making the payment |
| Amount paid, date and time, the car park, and a reference code | Generated by us |
| Payment confirmation and card type | Our payment processor, Stripe |
| IP address and browser information | Automatically, when the page is used |
We never see or store your card number. Card details go directly to Stripe.
3.2 Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Taking your payment and sending your receipt | Performance of a contract with you |
| Passing the payment, and the vehicle registration where collected, to the car park so they know which vehicles have paid | Legitimate interests — the car park needs to know who has paid, and this is the whole point of the service |
| Recording the transaction for accounting, tax and audit | Legal obligation |
| Handling refunds, chargebacks and disputes | Legal obligation and legitimate interests |
| Preventing and investigating fraud | Legitimate interests |
| Answering your questions and resolving complaints | Legitimate interests |
Where we rely on legitimate interests, we have considered the effect on you. The information involved is limited, you would reasonably expect a parking fee payment to be shared with the car park you are using, and we do not use it for marketing.
3.3 We do not market to drivers
We do not send drivers marketing email, and we do not sell or rent driver information to anyone.
The car park receives your details and has its own privacy notice governing what it does with them afterwards, including any marketing it may send. That is the car park’s responsibility, not ours. If you want the car park to stop contacting you, ask them directly.
4. Car park users
4.1 What we collect
Name, job title or role at the car park, work email address, work phone number, a password (stored only as a secure hash), and a record of your sign-ins and the actions you take in the dashboard.
Where you complete a signup on the car park’s behalf, we also record which version of our terms you accepted, when, and the IP address and browser you used. We need this to show that the agreement was validly entered into.
Bank account details supplied for payouts belong to the car park rather than to you personally, but we treat them with the same care: they are encrypted and only the last four digits are ever displayed.
4.2 Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the dashboard, and administering the car park's account | Performance of a contract with the car park, and our legitimate interests in operating the service |
| Keeping the account secure, and maintaining an audit trail of changes to pricing, bank details and payouts | Legitimate interests, and legal obligation |
| Making payouts and issuing commission invoices | Performance of a contract and legal obligation |
| Service messages about your account, payouts and refunds | Performance of a contract |
| Optional weekly summary emails | Legitimate interests — you can turn these off at any time from your account or by using the unsubscribe link |
Service messages such as receipts, payout notices and refund confirmations are part of the service and cannot be switched off while the account is active.
5. Website visitors
We use Google Analytics on our marketing site to understand how people find and use it. This sets cookies and collects information about your device, your approximate location derived from your IP address, the pages you view and how you arrived.
Analytics only runs if you consent to it. Nothing is collected for analytics purposes until you accept it in our cookie banner, and you can change your mind at any time.
Our lawful basis is your consent, given through the cookie banner.
We do not run analytics on the parking payment page. See our Cookies Notice for the full detail of what is set and when.
6. Who we share information with
We use a small number of service providers. They process information on our instructions and cannot use it for their own purposes, except where noted.
| Provider | What for | Where |
|---|---|---|
| Stripe | Card payments, fraud prevention, refunds and disputes | UK / EEA / United States |
| Railway | Hosting the application and database | United Kingdom / EEA |
| Brevo | Sending receipts and account emails | European Union |
| Google Analytics | Website analytics, with consent only | United States |
| Sentry | Error monitoring, to find and fix faults | United States |
| Upstash | Rate limiting, to prevent abuse of the payment page | EEA |
Stripe is a payment services provider and is a controller in its own right for some of what it does, including fraud prevention and meeting its own regulatory obligations. Its privacy policy is at stripe.com/gb/privacy.
We also share:
- Parking fee transactions with the relevant car park, which is an independent controller of that information for its own purposes.
- Information with our accountant and professional advisers, where needed.
- Information with law enforcement, regulators or a court, where we are legally required to.
- Information with a buyer, if the business is ever sold, subject to the same protections.
We do not sell personal information.
7. Sending information outside the UK
Some of the providers above are based in the United States. Where information leaves the UK, we rely on one of:
- the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it; or
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for details of the safeguard used for any particular provider.
8. How long we keep things
| What | How long |
|---|---|
| Parking fee transaction records, including vehicle registration where collected | 7 years from the end of the tax year, for accounting and tax |
| Driver email and phone number | 7 years, as part of the transaction record |
| Car park user accounts | For as long as the car park's account is open, then 90 days |
| Terms acceptance records | 7 years after the agreement ends |
| Audit logs of dashboard activity | [2 years] |
| Bank details | For as long as the car park's account is open, then until the final payout has cleared |
| Support correspondence | [2 years] from the last message |
| Analytics data | [14 months] |
| Server and error logs | [90 days] |
We do not keep information longer than these periods unless we are required to, or unless it relates to an ongoing dispute or investigation.
9. How we protect it
Card details never reach our servers. Bank details are encrypted using AES-256-GCM and only the last four digits are ever shown. Passwords are hashed and cannot be read by us. Access to production data is restricted and logged. Data is transmitted over encrypted connections.
No system is perfectly secure, but if a breach occurs that is likely to affect your rights, we will report it to the ICO within 72 hours and tell you where we are required to.
10. Your rights
You have the right to:
- be told what we hold about you and why — that is what this notice does;
- get a copy of your information;
- have it corrected if it is wrong;
- have it deleted, where we no longer need it and no legal obligation requires us to keep it;
- restrict how we use it while a concern is being resolved;
- object to processing based on legitimate interests, including direct marketing;
- receive it in a portable format, where processing is based on consent or a contract;
- withdraw consent at any time, where we rely on it — this does not affect anything done beforehand.
We do not make any decision about you by automated means that produces a legal or similarly significant effect.
To exercise any of these, email [email protected]. We will respond within one month. We may ask you to confirm your identity first — usually the reference code from your receipt is enough.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, so we have a chance to put it right.
11. Children
The service is not intended for children. Payments must be made by someone aged 18 or over. We do not knowingly collect information from children.
12. Changes to this notice
We may update this notice. The current version and its date are shown at the top. Where a change materially affects how we use your information, we will tell affected car park users by email and post a notice on the website.
Contact: [email protected] · BB AI Limited, Astute House, Wilmslow Road, Wilmslow, SK9 3HP