Privacy Policy

1. Summary

We are a SEA airport parking marketplace. We collect only what needed to book and operate shuttle: email, entry/exit dates, license plate (optional), QR code, and Stripe payment identifiers (not card numbers). We use cookies for analytics (GA4 G-4SKF0GEB3N), essential auth (seatac_session), and affiliate attribution (CJ PID 8013741).

2. What we collect

• Contact: email from checkout or OTP login at `/auth` via operator@seatacpark.com, stored in `bookings.email`, `affiliate_clicks.email`, `users.email`.
• Booking: lot_id, entry_at, exit_at, days, license_plate, subtotal, discount, total, QR code `SEA-LOT-TIMESTAMP` (e.g., SEA-1-1234567890), promo_code, promotion_id, commission, payout_amount, user_id.
• Payment: Stripe Checkout – we store `stripe_session_id`, `payment_intent`, `stripe_payment_status`, `refund_amount`. Card number never touches us – handled by Stripe (`https://js.stripe.com`) SAQ-A. See Stripe privacy.
• Device: IP (via Vercel `x-forwarded-for`), User-Agent, cookies, GA4 events (page view, search, click).
• Affiliate: clicks logged to `affiliate_clicks` with source_id (1=ParkON,2=APR), external_id, lot_id, entry/exit, email, clicked_at, with UTM `utm_source=seatacpark` + CJ PID 8013741 + sid.
• Auth: OTP via email, session cookie `seatac_session` HttpOnly 30d, OAuth Google/Microsoft if you use `/auth` – we only request email, name, avatar.
• Location: approximate distance calc via Haversine, not precise tracking unless you share via map move.

3. How we use

• To create pending booking hold, create Stripe Checkout Session, confirm via webhook `checkout.session.completed`, send QR via Resend `bookings@notify.parkatsea.com` (or QStash queued).
• To show your bookings at `/account?email=` or authenticated `/api/auth/me`.
• To calculate availability `MIN(inventory)-COUNT(bookings)` and pricing rules.
• To log affiliate clicks for commission via CJ Affiliate (PID 8013741), Impact.
• To improve: GA4 page views, search rate limit 60/min, book 10/min, admin 30/min.
• To contact support, refunds.

4. Sharing

We share minimal data only with processors needed:

• Stripe (payments): email, amount, metadata booking_id, QR. See stripe.com/privacy. Storage: US.
• Resend (email): `bookings@notify.parkatsea.com` sends QR. Stores email events, webhook_events.
• Upstash (QStash queue + Redis): queues email jobs, caches affiliate search 1h, rate limit fallback.
• Vercel (hosting): edge logs, cron inventory-check `0 14 * * *`.
• Supabase Postgres (db): lots, inventory, bookings, users, sessions, affiliate_cache.
• Parking lot operators: email, license plate, entry/exit, QR – to provide shuttle and entry.
• Affiliate partners (ParkON, APR via CJ PID 8013741, Way, SpotHero via Impact/CJ): external_id, entry/exit, UTM + sid – for commission; booking completes on their site per their privacy.
• Google Analytics GA4 G-4SKF0GEB3N + Tag Manager: page views, not PII. IP anonymized.
• Legal if required (subpoena).

We do NOT sell your data.

5. Cookies and tracking

• seatac_session HttpOnly, 30d, auth.
• seaTacEmail localStorage, your saved email for faster checkout.
• _ga, _gid GA4 13 months.
• affiliate click sid URL param, not cookie, 30-45d via CJ/Impact cookie set by partner domain on click.
• Necessary: CSRF, rate limit map in-memory.

You can block GA4 via opt-out or DNT, but site still works.

6. Retention

• Bookings: kept 7 years for tax/accounting (US), then anonymized. QR keeps 1 year after exit.
• Affiliate clicks: 1 year.
• Email events: 90 days.
• Inventory: rolling 60 days.
• GA4: 14 months.

7. Your rights

Depending on state (CCPA/CPRA WA) you can:

• Access your bookings via `/account?email=your@email` or request export.
• Request deletion: email `support@parkatsea.com` with subject DELETE + email. We delete users, sessions, anonymize bookings except where tax law requires keep.
• Opt-out of marketing (we send only transactional booking QR unless you opt in).
• Opt-out of GA4: GA opt-out.
• For Stripe data, contact Stripe as data processor.

8. Security

• HTTPS HSTS `max-age=63072000 includeSubDomains preload` via Vercel.
• CSP: script-src self + cdnjs + gtm + js.stripe.com, frame-src js.stripe.com hooks.stripe.com.
• Passwords not stored (OTP + OAuth), admin token hashed SHA256 + timingSafeEqual.
• Stripe handles card data SAQ-A, we store only session id + payment_intent.
• Rate limiting: OTP 5/min, book 10/min, search 60/min, admin 30/min (Upstash Redis in prod).
• DB: Postgres via Supabase pooler 6543 pgbouncer, advisory lock `pg_advisory_xact_lock(lot_id)` prevents double-book.

9. Children

No service for under 18. We do not knowingly collect child data.

10. International transfers

Servers US West (Vercel us-west, Supabase us-west-1 aws-0-us-west-1). If you are EU/UK, your data transfers to US under Standard Contractual Clauses via our processors (Stripe, Supabase, Vercel).

11. Changes

We will post updated effective date and email if material. Continued use = acceptance.

12. Contact

Privacy requests: support@parkatsea.com · Operator: operator@parkatsea.com · Mail: on request · EU rep: same.