This Privacy Policy explains what personal data ParkMana collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. Please read it together with our Terms of Use.
1. About this policy
ParkMana is developed and operated by the independent developer of ParkMana, an individual based in Malaysia (“ParkMana”, “we”, “us” or “our”). We are the data user (data controller) responsible for the personal data described in this policy.
This policy applies to the ParkMana Android app, the ParkMana web app at parkmana.app/app, the website at parkmana.app, and the ParkMana application programming interface that serves them (together, the “Services”). It does not apply to third-party apps, websites or services that the Services link to or open, such as Google Maps, Google Play, MyBayar PDRM or MyJPJ, which are governed by their own privacy policies.
This policy serves as our written notice under section 7 of the Personal Data Protection Act 2010 of Malaysia (“PDPA”). In this policy, “personal data” means any information that relates directly or indirectly to you and that identifies you or can be used to identify you.
2. Personal data we collect
The data we collect depends on how you use the Services. You can use many features as a guest, without an account.
2.1 Data you give us
- Account data. When you create an account: your email address, display name and password (stored only as a salted cryptographic hash). If you sign in with Google, we receive your Google account identifier, email address, name and profile picture from Google. You may also add a profile photo.
- Parking data. The car parks you save as favourites; the details of each stay, such as the car park, arrival and departure times, level, zone and pillar, notes, fare estimate and amount paid; and parking photos. Active stays and local history stay on your device unless you choose to upload them to your account, or you are a Premium member who has chosen automatic cloud backup.
- My car data. Car nicknames, photos, plate numbers, road tax and insurance expiry dates, service dates or mileage, and custom reminders. This information is stored only on your device and is not sent to us (see section 4).
- Community content. Ratings, reviews, review photos, rate corrections, signboard photos, suggested car parks, answers to questions such as “Is parking free here?”, and reports about other content.
- Communications. Feedback, support requests and emails you send us, including any information you choose to include.
- Purchase data. If you subscribe to ParkMana Premium, Google Play processes your payment. We receive a purchase token, the product purchased, the order identifier, and the subscription’s status and expiry date. We never receive your card or bank details.
2.2 Data collected when you use the Services
- Location. With your permission, we use your device’s precise or approximate location while you use the app to centre the map, list nearby parking, calculate walking routes and suggest where you parked. If you turn on Auto-detect parking, we also collect location in the background as described in section 3.
- Searches and routes. The text you search for, the places you select (including Google place identifiers), and the start and end coordinates of walking directions you request.
- Camera and photos. Photos you take or choose for a parking reminder, review or contribution. Photos may contain metadata such as the time and place they were taken. Reading the text on a pillar sign is performed on your device using Google ML Kit; the camera image is not sent to us for that purpose, and the temporary camera file is deleted after processing.
- Bluetooth and physical activity. Only if you turn on Auto-detect parking: the names of devices paired with your phone (so you can choose your car), whether that one device connects or disconnects, and whether Android reports you have switched between driving and walking.
- Notifications. A push notification token issued by Firebase Cloud Messaging, so that we can send service announcements to your device. If you sign in, we also record which accounts have signed in with the same token, to prevent spam and abuse. We also keep a 30-day record, kept on your device, of the notifications ParkMana has shown you.
- Device, log and usage data. A random guest identifier or your account identifier; IP address; device model, operating system and app version; language; the time and type of requests to our servers; errors and crash information; and counts of requests to map and search services, which we use to apply daily limits.
- Advertising and consent data. On the free tier, Google’s advertising services may collect device or advertising identifiers, IP address, approximate location, ad interactions and your consent choices (see section 7).
2.3 Data from third parties
- Google Sign-In, if you choose it: the account details listed in 2.1.
- Google Play: the status of your Premium subscription.
- Google Maps Platform: information about places, such as names, addresses and opening hours. This is information about places, not about you.
- Public datasets: weekly fuel prices from data.gov.my. No personal data is involved.
2.4 Whether you must provide data
An email address (or Google account) is required to create an account, and an account is required for My car, cloud history and Premium. Location, camera, Bluetooth, physical activity and notification permissions are voluntary. If you decline them, the related features will not work, but you can still search for parking manually and use the rest of the app. If you do not agree to this policy, please do not use the Services.
3. Auto-detect parking and background location
Auto-detect parking is an optional Android feature that is off unless you turn it on. When it is on, ParkMana collects location data to save your parking spot automatically, even when the app is closed or not in use.
- When location is read. Only at the moment ParkMana detects that you have parked: when your phone disconnects from the car Bluetooth device you chose, or when Android reports that you went from driving to walking. A single location reading is taken each time. ParkMana does not track your location continuously.
- Why background permission is needed. Because the reading happens while the app is closed, Android asks you to allow location “all the time”. If you do not allow it, ParkMana instead asks you to open its notification to finish saving your spot.
- How the reading is used. It is sent to our servers to find the nearest car park, then saved on your phone with your parking spot. It is not saved to our database, is not used for advertising, and is not shared with advertisers. Like any request, it may appear briefly in hosting and security logs, which are kept only for the period in section 10.
- Places that aren’t parking. Locations you save, such as home or work, stay on your phone and are used only to ignore stops there.
- Ending a stay. If your car’s Bluetooth reconnects, or Android reports that you are driving, ParkMana records the time on your phone and ends the earlier stay at that time.
- End parking when I leave (optional). ParkMana asks Android to watch an area of 300 m, 500 m or 1 km around where you parked, and Android tells ParkMana when you leave it. Android performs this monitoring on your device; no location is sent to us for it.
- Turning it off. Switch off Profile → Settings → Auto-detect parking, or tap Turn off auto-detect on its notification. Nothing then runs in the background. You can also withdraw the permissions in Android settings at any time.
4. Data kept only on your device
Some features are designed so that the data never leaves your phone or browser. We cannot see or recover this data:
- My car details and car photos, and the reminders for road tax, insurance, servicing and custom reminders. These are kept separately for each account that signs in on the device. Signing out hides them and stops their reminders; deleting your account in the app erases them.
- Guest parking sessions, local parking history and reminder photos you have not uploaded.
- Places that Auto-detect ignores, your notification history and your app preferences.
- Sign-in tokens. On Android these are encrypted with the Android Keystore.
If you uninstall the app or clear its data, this information is lost unless you have uploaded it to your account.
5. How we use your personal data
We use personal data for the following purposes:
- To provide the Services: showing nearby parking, comparing prices, estimating fares, giving walking directions, saving your spot, sending reminders and fare alerts, syncing your history, and operating your account.
- To provide Premium: verifying subscriptions with Google Play, restoring purchases and awarding Premium earned through contributions.
- To run the community features: publishing reviews and photos, reviewing and approving contributions, correcting the parking catalogue and acting on reports.
- To keep the Services secure and reliable: authenticating you, applying daily usage limits, detecting and preventing fraud, spam and abuse, and diagnosing errors.
- To improve the Services: understanding which features work, fixing problems and improving parking data. Where possible we use aggregated or de-identified data for this.
- To communicate with you: account emails such as password resets, replies to your feedback, important notices about the Services or this policy, and service announcements by push notification.
- To show advertising to users of the free tier, subject to the consent you give (see section 7).
- To comply with law and to establish, exercise or defend legal claims.
We do not use your personal data for automated decisions that produce legal or similarly significant effects for you. If we wish to use your personal data for a purpose that is materially different from those above, we will ask for your consent first.
6. Consent and legal bases
Under the PDPA, we process your personal data with your consent, which you give by using the Services after being informed of this policy and by granting device permissions, and where processing is otherwise permitted by law, such as to perform our contract with you, to comply with a legal obligation, or to protect your vital interests.
If you are located in a jurisdiction that requires a legal basis for processing, such as the European Economic Area or the United Kingdom, we rely on: performance of a contract (providing the Services and Premium); legitimate interests (security, abuse prevention, service improvement and community moderation, balanced against your rights); consent (location, Auto-detect parking, personalised advertising and push notifications, which you can withdraw at any time); and legal obligation.
7. Advertising and cookies
- Who serves ads. Free-tier users see ads served by Google AdMob in the Android app and Google AdSense in the web app. Premium members do not see ads.
- Consent. Where required, Google’s consent tools ask whether ads may be personalised before ads are requested. You can change your choice at any time from Ad privacy choices in the app, where shown.
- What we do not share. We do not send your precise GPS location, Auto-detect readings, parking notes, car details or photos to advertisers. Google may infer an approximate location from your IP address.
- Your device settings. On Android you can reset or delete your advertising ID in Settings → Privacy → Ads. On the web you can manage personalisation at Google’s My Ad Center.
- Cookies and browser storage. The website and web app use browser storage that is strictly necessary to keep you signed in and remember your preferences. Google AdSense uses cookies or similar technologies to serve and measure ads. We do not use third-party analytics cookies. You can block or delete cookies in your browser settings, but parts of the web app may then stop working.
Learn more in How Google uses information from sites or apps that use its services.
8. How we share personal data
We do not sell your personal data, and we do not share it with third parties for their own marketing. We disclose personal data only as follows:
8.1 Service providers
We use the following service providers, who process personal data on our behalf or provide services the app relies on, under their own terms and safeguards:
| Provider | Purpose | Data involved |
|---|---|---|
| Google Maps Platform | Maps, place search and walking directions | Search text, place identifiers, coordinates |
| Google Sign-In | Signing in with a Google account | Authentication requests and account details |
| Google Play Billing | Premium subscriptions | Purchase and subscription records |
| Firebase Cloud Messaging (Google) | Push notifications | Notification token, message content |
| Google AdMob, AdSense and consent tools | Advertising on the free tier | See section 7 |
| Google ML Kit | Reading pillar signs | Runs on your device; images are not sent to us |
| Render | Hosting our servers and database | All data stored in your account, and server logs |
| Cloudflare | Content delivery, DNS and protection against attacks | IP address and request data |
| Resend | Sending account emails | Email address and email content |
8.2 Other users and the public
Your display name, profile photo, ratings, reviews, review photos and approved contributions are visible to other users and may be visible to anyone. Please do not include faces, vehicle number plates, receipts or other personal information in public content. Information you choose to send using Share spot is sent through the app you pick, to the people you choose.
8.3 Legal reasons
We may disclose personal data if we believe in good faith that it is reasonably necessary to comply with a law, regulation, court order or lawful request from a public authority; to enforce our Terms of Use; to detect or prevent fraud, security or technical issues; or to protect the rights, property or safety of ParkMana, our users or the public.
8.4 Business transfers
If ParkMana is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.
8.5 With your consent
We may share personal data for other purposes with your consent.
8.6 Aggregated information
We may share aggregated or de-identified information that cannot reasonably be used to identify you, for example the number of drivers who reported that a car park’s rates changed.
9. International transfers
Our servers are hosted by Render, and our service providers operate in several countries. Your personal data may therefore be transferred to and processed in Singapore, the United States and other countries outside Malaysia. Those countries may not have data protection laws equivalent to the PDPA. Where we transfer personal data, we do so as permitted by the PDPA and take reasonable steps to ensure that the recipient protects it to a standard comparable to this policy.
10. How long we keep personal data
We keep personal data only for as long as needed for the purposes in this policy, or as required by law:
| Data | How long we keep it |
|---|---|
| Account data, favourites and cloud parking history | Until you delete them or delete your account. Free accounts keep their latest 10 stays in history. |
| Reviews and approved contributions | While they remain relevant to the parking catalogue. If you delete your account, they are kept under the name “Deleted Account” without your other details. |
| Feedback and reports | As long as needed to handle them; identifying details are removed when you delete your account. |
| Premium purchase records | For as long as required for accounting and tax purposes under Malaysian law, currently up to 7 years. |
| Accounts signed in on the same device | Until you delete your account. |
| Daily usage counts | 30 days, then deleted automatically. |
| Server, security and access logs | Up to 14 days, under our hosting provider’s log retention, unless needed longer to investigate abuse or a security incident. |
| Database backups | Up to 7 days, after which deleted data can no longer be recovered from them. |
| Auto-detect location readings | Not saved to our database; only in short-lived logs as described above. |
Search results and walking routes from Google are used for the current request and are not copied into our permanent parking catalogue. A Google place identifier may be kept to link a contribution to its location.
11. Your rights and choices
Subject to the PDPA and other applicable law, you have the right to:
- Access the personal data we hold about you, and receive a copy of it;
- Correct personal data that is inaccurate, incomplete, misleading or out of date;
- Withdraw consent to our processing of your personal data, in whole or in part;
- Ask us to stop processing that is causing, or is likely to cause, substantial and unwarranted damage or distress;
- Prevent processing for direct marketing;
- Data portability: ask us to transmit your personal data to another data controller, where technically feasible and compatible in format; and
- Delete your account and associated cloud data.
Many of these can be exercised directly in the app: edit your profile in Profile → Edit profile; remove favourites, reviews and cloud history; manage permissions in Profile → Settings → Permissions or Android settings; turn notifications off in Profile → Settings → Notifications; and delete your account in Profile → Settings → Account & data (see account deletion).
For other requests, contact us using the details in section 17. We may need to verify your identity before acting, and we will respond within 21 days as required by the PDPA, or tell you within that period if we need more time. We may charge a fee for access requests where permitted by law, and may refuse a request where the law allows us to, in which case we will explain why. Withdrawing consent may mean that some features can no longer be provided. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.
If you are located outside Malaysia, you may have additional rights under your local law, such as the right to object to processing or to complain to your local data protection authority. Contact us to exercise them.
12. Security
We take practical technical and organisational measures to protect personal data from loss, misuse, unauthorised access, disclosure, alteration and destruction. These include encrypting data in transit with HTTPS, storing passwords only as salted hashes, verifying Google sign-in tokens on our servers, encrypting sign-in tokens on Android with the Android Keystore, rate-limiting sensitive requests and restricting administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and affected users where required by law.
13. Children
The Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal data from children under 13. If you are under 18, you should use the Services only with the consent and supervision of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.
14. Third-party services and links
The Services contain links to, and open, services that we do not control, including Google Maps for directions, Google Play for subscriptions, MyBayar PDRM and MyJPJ for summonses, and apps you use to share your parking spot. Your vehicle plate number is not passed to those services. Their own privacy policies apply, and we are not responsible for their practices.
15. Changes to this policy
We may update this policy from time to time, for example when we add features or when the law changes. The effective date at the top shows when it last changed. If we make a material change, we will notify you in the app or on this website before it takes effect, and where required by law we will ask for your consent again. Continuing to use the Services after a change takes effect means you accept the updated policy.
16. Language
This policy is available in English and Bahasa Melayu. If there is any inconsistency between the two versions, the English version prevails to the extent permitted by law.
17. Contact us
For questions about this policy or to exercise your rights, contact:
ParkMana: Data Protection
Email: [email protected]
You can also use Profile → Submit feedback in the app. Please do not send passwords, access tokens or other sensitive information.