Privacy Policy

1. Introduction

Candar (“we”, “us”, “our”) operates the candar.city website and provides parking enforcement analytics services to government agencies and universities. This policy describes how we collect, use, and protect information when you use our services.

2. Information We Collect

3. How We Use Information

• To provide parking enforcement analytics and insights to our clients
• To generate aggregated, anonymized reports and benchmarks
• To power AI-assisted analytics features (see Section 11)
• To improve our services and develop new features
• To communicate with clients about their accounts and our services
• To send scheduled email reports (weekly summaries, monthly digests, and threshold alerts)

4. Data Storage & Security

• All data is stored in Supabase (PostgreSQL) with AES-256 encryption at rest
• Data in transit is encrypted via TLS 1.3
• Row-level security (RLS) policies ensure strict data isolation between organizations
• API endpoints are protected by rate limiting to prevent abuse
• All administrative actions are recorded in audit logs retained for 2 years
• We follow industry best practices for application security and are pursuing SOC 2 Type II compliance

5. Data Sharing

• We do NOT sell citation data or any other information to third parties
• Data is shared only with the sub-processors listed in Section 12, solely for the purpose of service delivery
• Aggregated, anonymized benchmarking data may be shared across clients (no city-identifiable data without consent)
• We may share data if required by law or legal process

6. Data Retention

• Citation data is retained for the duration of the client relationship plus 1 year
• Clients may request data deletion at any time
• Anonymous aggregated data may be retained indefinitely for benchmarking purposes
• See Section 13 for a detailed data retention schedule

7. Your Rights

Government and university clients may request access to, correction of, or deletion of their data at any time. We will respond to all data requests within 30 days.

Contact us at ivan@candar.city for any data requests. California residents have additional rights described in Section 14.

8. Children's Privacy

Our services are designed for government agencies and universities, not individuals. We do not knowingly collect information from children under 13. Our platform does not store any personally identifiable information about citation recipients, including minors.

9. Changes to This Policy

We may update this policy from time to time. We will notify clients of material changes via email at least 30 days before they take effect. Non-material changes may be made at any time and will be reflected in the “Last Updated” date above.

10. Contact Us

11. AI and Automated Decision-Making

Candar uses Claude, developed by Anthropic, to provide AI-powered analytics features within the platform. Here is how AI is used and what safeguards are in place:

12. Sub-Processors

Candar uses the following sub-processors to deliver our services. All sub-processors are based in the United States.

We will notify clients at least 30 days before adding any new sub-processor. Clients may object to a new sub-processor by contacting us at ivan@candar.city.

13. Data Retention Schedule

The following schedule governs how long different categories of data are retained:

Upon contract termination, data export is available for 30 days. All data is permanently deleted within 60 days of termination unless a longer retention period is required by law.

14. CCPA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to Know: You have the right to request that we disclose what personal information we collect, use, and share about you.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. We have never sold personal information and have no plans to do so.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, contact us at ivan@candar.city. We will respond to verifiable requests within 45 days.

15. Government & University Specific Terms

Many of our clients are municipal governments and universities. The following terms address common regulatory considerations for these organizations:

16. Breach Notification

In the event of a data breach that affects client data, Candar commits to the following notification and response procedures:

• 48-Hour Notification: Affected organizations will be notified within 48 hours of Candar becoming aware of a confirmed breach.
• Notification Contents: Breach notifications will include the nature of the breach, the categories of data affected, the approximate number of records involved, and the remediation steps being taken.
• Coordination: Candar will coordinate with the affected organization's incident response team and procedures, and will provide ongoing updates as the investigation progresses.
• Regulatory Compliance: Candar will assist affected organizations in meeting their own breach notification obligations under applicable state and federal laws.