The visitor parking enforcement app for people who are done asking nicely.

KAR3N is built to capture as little as possible: for a visitor, we hold nothing but the vehicle plate, with no name, contact, or identity attached to it. For a resident, we hold only the plate and the unit number, again no name and nothing else. The only people whose name and contact information we hold are the few of your own staff who log in to operate the system, and we keep no location tracking or browsing data on anyone, as our privacy policy sets out in full.

Your scheme's records, every vehicle scan, every evidence image, and your audit logs are stored and processed on Amazon Web Services (AWS) in its Sydney, Australia data centres. The only personal data that ever leaves Australia is the content of a notification we send: a recipient's email address and any plate reference inside that message are handled by an overseas email-delivery provider, and card payments run on Stripe's global platform. Everything that matters most, your residents' records and the enforcement evidence, stays onshore.

Most of what we scan is discarded almost immediately: a clean scan of a compliant vehicle is permanently and automatically deleted within 48 hours, so we never build a movement history of vehicles that are parking within the rules. A record is kept only when a vehicle actually breaches, for 30 days if your scheme takes no action, or seven years if it does (a warning, notice, or tow) as the record you may need at a tribunal. Deletion runs on a scheduled job, and the complete retention schedule is set out in our privacy policy.

No other scheme can ever see your data: every scheme is isolated at the data layer, so your residents, vehicles, and records are invisible to every other customer. Inside your scheme, access is role-based, so an operator scanning vehicles sees only what that task needs while managers and account holders see more. Our own access is limited to authorised support, gated behind mandatory multi-factor authentication, and every access to your data is written to a tamper-evident audit log.

Your data is encrypted with AES-256 at rest and TLS 1.3 in transit, runs on Amazon Web Services (AWS), and we adopt and align to ISO 27001 and OWASP security standards with edge firewalling, rate-limiting, and continuous monitoring. We never touch your card details: payments complete entirely on Stripe's hosted, PCI-DSS-compliant pages (SAQ-A), so card data never reaches our servers. Our controls are reviewed regularly, not set once and forgotten.

Never: we do not sell your data, do not use it for advertising, and do not mine it for any purpose beyond running KAR3N for your scheme. We host on Amazon Web Services and process payments through Stripe; our email runs through a delivery service that is itself underpinned by AWS, and a separate provider handles only the limited SMS we send to towing companies (both vetted, both named on request, with the provider categories listed in our privacy policy). Plate recognition runs on our own systems, so your scans are never sent to an outside service.

It is lawful parking enforcement, not surveillance: KAR3N reads plates solely to enforce the rules on your scheme's own private property, which strata schemes are entitled to manage. We collect only what that purpose requires, disclose it in our privacy notice, and automatically delete any scan that does not result in an enforcement action within 48 hours. Plate data is never used to profile or track individuals.

Yes, and we make it straightforward: any individual can request the information we hold, ask us to correct it, or ask us to delete it, and we respond within the timeframes Australian privacy law requires. Where a record must be retained for your scheme's legal obligations we keep only that and remove the rest, explaining why. We issue written confirmation once the data is deleted, and our privacy policy explains how to make a request.

You stay in control: on cancellation your scheme keeps full access for a 30-day handback window to export every record before anything is removed. After that, data with no legal retention requirement is deleted, while records you must keep (such as actioned-breach evidence) move to encrypted cold storage for the required period and are then destroyed. We confirm in writing once your data is deleted.

We are built to detect and respond: our systems are monitored for security events and we run a defined incident-response process. If a breach were ever likely to cause serious harm, we would assess it and notify the affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme within the statutory 30-day assessment period, and keep your scheme fully informed so you can meet your obligations.