Privacy Policy

Data controller

ATME Inc. is the data controller responsible for your personal data. We determine how and why your personal information is processed when you use the ATME app and website.

If you have any questions about how we handle your data, you can reach us at privacy@atme.is.

ATME Inc.
Delaware C-Corporation
United States

Lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR) and other applicable data protection laws, we must have a lawful basis for processing your personal data. We rely on the following bases depending on the type of data and how it is used:

Consent

When you create an ATME account, you consent to the collection and processing of your email address and license plate for the purpose of providing the service. When you submit a Neighbor Alert report, you consent to the collection of your device location for that specific report. You can withdraw your consent at any time by deleting your account or by contacting us at privacy@atme.is. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

Legitimate interest

We process certain data based on our legitimate interest in operating and improving ATME, preventing abuse, detecting spam and harassment, and maintaining the security of our platform. We have assessed that these interests do not override your fundamental rights and freedoms, particularly given the minimal amount of personal data we collect and our anonymous-first design.

Legal obligation

We may process your data when required to comply with a legal obligation, such as responding to a valid court order or law enforcement request.

Information you provide

Account Registration

You register a license plate and email address when you create an ATME account. License plates are used to route messages to you. Email is used for login verification only.

Messages

Messages you send and receive are stored temporarily on our servers for delivery. We do not sell, rent, or monetize your messages or data in any way. Ever.

Optional Information

You may optionally add a vehicle description to help senders confirm they have the right car. This information is visible only to message senders.

Information we don't collect

ATME is designed to protect your privacy. We do not collect:

• Your name
• Your home address
• Your phone number linked to your plate
• Your continuous location history or vehicle tracking data

Note: If you submit a Neighbor Alert report, your device's location at the time of the report is collected to identify the vehicle's location. This requires your explicit permission through your device's location settings, which you can revoke at any time. See Community Reports for details.

Data retention

We retain different types of data for different periods based on what is necessary to provide the service:

• Messages: Automatically deleted after 7 days.
• Neighbor Alert reports: Retained for 30 days for dispute resolution, then deleted.
• Email address and license plate: Retained for as long as your account is active. Permanently deleted when you delete your account.
• Optional vehicle description: Retained for as long as your account is active. Permanently deleted when you delete your account.
• Device push notification tokens: Retained for as long as your account is active. Permanently deleted when you delete your account.

Upon account deletion, all associated data, including your license plate, email, messages, and any optional vehicle information, is permanently removed from our systems.

International data transfers

ATME's servers are hosted on Amazon Web Services (AWS) in the United States. If you are located in the United Kingdom or European Economic Area, your personal data will be transferred to and processed in the United States.

We ensure that these transfers are protected by appropriate safeguards as required by the UK GDPR. AWS maintains compliance with international data transfer frameworks and provides Standard Contractual Clauses (SCCs) approved by the UK government to protect personal data transferred outside the UK. You can learn more about AWS's data protection commitments at aws.amazon.com/compliance/gdpr-center.

By creating an ATME account, you acknowledge that your data will be transferred to and processed in the United States under these protections.

Third-party services

We use Amazon Web Services (AWS) for hosting, data storage, and infrastructure. AWS is the same trusted platform used by banks, hospitals, and government agencies.

Push notifications are delivered through Apple Push Notification Service (APNs) for iOS devices and Firebase Cloud Messaging (FCM) for Android devices, via our AWS infrastructure.

When you choose to escalate a report to 311, we submit service requests through municipal Open311 APIs (such as SeeClickFix) on your behalf. See 311 Service Requests for details on what information is shared.

We do not use:

• Third-party analytics or tracking tools
• Advertising networks
• Data brokers or resellers

Your data is never sold, shared with advertisers, or monetized in any way.

Cookies and tracking

The ATME mobile app does not use cookies, tracking pixels, or any third-party analytics tools.

The ATME website (atme.is) does not use advertising cookies, analytics cookies, or third-party tracking technologies. Any cookies used are strictly necessary for the website to function, such as maintaining your session during the account deletion process on this page.

Push notifications

We send push notifications to alert you when you receive a new message. These notifications are delivered through Apple Push Notification Service (APNs) for iOS devices and Firebase Cloud Messaging (FCM) for Android devices, via our AWS infrastructure.

You can disable push notifications at any time in your device settings. Disabling notifications will not affect your ability to use the app or receive messages. You simply won't receive real-time alerts.

Community Reports (Neighbor Alerts)

ATME allows users to report parking violations through our Neighbor Alert feature. When you submit a report:

• Your device's location is collected to identify where the vehicle is parked. This requires your explicit permission through your device's location settings, and you can revoke this permission at any time through your device settings.
• The location (including street address) is shared with the vehicle owner if they are registered
• If the owner does not respond within the allowed time, the report and location may be shared with the community partner (e.g., university parking services) who manages that area
• Reports are retained for 30 days for dispute resolution, then deleted

Reporter identity remains anonymous to both the vehicle owner and community partners.

311 Service Requests

If a reported issue is not resolved through ATME (for example, the vehicle owner is not registered or does not respond), ATME may submit a service request to your local municipality's 311 system on your behalf. When this happens:

• Your device's location at the time of the report is included in the 311 submission so the municipality can locate the issue
• The report description and category you selected are submitted
• Your email address may be included so the municipality can send you status updates on your request
• Your license plate and ATME account details are not shared with the municipality

311 submissions are made through publicly available municipal APIs (such as the Open311 standard). Once submitted, the service request is governed by the municipality's own privacy practices. You will be prompted to confirm before any report is submitted to 311.

Security

Encryption

All data is encrypted in transit and at rest using industry-standard protocols.

Infrastructure

Our backend runs on Amazon Web Services (AWS) serverless architecture, the same infrastructure trusted by banks, hospitals, and government agencies.

Abuse Prevention

We use automated systems to detect and prevent harassment, spam, and inappropriate content. Users can block and report others, and patterns of misuse result in permanent bans. Message sending is rate-limited to 5 messages per hour and 20 messages per day to prevent spam and harassment.

Data sharing

We do not share your information except in these limited circumstances:

• To meet any applicable law, regulation, legal process, or enforceable governmental request.
• To enforce applicable Terms, including investigation of potential violations.
• To detect, prevent, or otherwise address fraud, security, or technical issues.
• To protect against harm to the rights, property, or safety of ATME, our users, or the public.
• With institutional community partners (such as universities or property managers) when a Neighbor Alert report is escalated due to non-response by the vehicle owner. Only the report details and location are shared; reporter identity is never disclosed.
• With municipal 311 systems when you choose to escalate a report. Only the report details, location, and optionally your email address (for status updates) are shared. See 311 Service Requests for details.

Age requirement

ATME is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18 years of age. If we learn that we have collected information from a user under 18, we will delete that information promptly.

Your rights

All Users

You have the right to:

• Request a copy of your data
• Request deletion of your account and all associated data
• Block other users from contacting you
• Report inappropriate messages or behavior

UK and EEA Residents (UK GDPR / EU GDPR)

If you are located in the United Kingdom or European Economic Area, you have the following additional rights under the UK GDPR and EU GDPR:

• Right of access: You can request a copy of all personal data we hold about you. We will respond within 30 days.
• Right to rectification: You can request that we correct any inaccurate personal data we hold about you.
• Right to erasure: You can request that we delete your personal data. You can also delete your account directly using the form at the bottom of this page.
• Right to restrict processing: You can request that we limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to object: You can object to our processing of your data where we rely on legitimate interest as our lawful basis.
• Right to withdraw consent: Where we rely on your consent to process data, you can withdraw that consent at any time. You can do this by deleting your account, adjusting your device permissions, or contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at privacy@atme.is. We will respond to your request within 30 days.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with your local data protection authority. For UK residents, this is the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use, and disclose
• The right to request deletion of your personal information
• The right to opt out of the sale of your personal information (note: we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at privacy@atme.is.

Updates

We will update this privacy policy as needed so that it is current, accurate, and as clear as possible. If we make significant changes that affect your rights, we will notify you through the app or by email before the changes take effect. Your continued use of ATME after any update confirms your acceptance of our updated Privacy Policy.

Contact Us

Effective as of January 2025
Last updated: February 10, 2026