Metropolis.io Privacy Policy

Last updated: June 10, 2025

Introduction

This Privacy Policy describes how Metropolis Technologies, Inc. and its subsidiaries and affiliates ("Metropolis", "we", "us" or "our") collect, use, store, and share personal information in connection with the operation of Metropolis’s business. You may interact with Metropolis by accessing and using our websites or mobile applications, visiting facilities that we operate or where our technology is deployed, communicating with us, interacting with our partners, business customers, and service providers, and otherwise engaging with our Services. p>

To make this Privacy Policy easier to read, we refer to our online and offline offerings that link to or are otherwise subject to this Privacy Policy collectively as the "Services".

To learn more about your choices concerning your personal information, see Your Privacy Rights and Choices below.
To learn more about how our Services and communications use cookies and related technologies (including from third parties), see Cookies and Related Online Tracking Technologies below.
For certain details about our use of automated license plate readers (ALPR), please see our Supplemental ALPR Privacy Notice attached as Exhibit A below.

Please carefully read this Privacy Policy, which is part of our Terms of Service, before using our Services. If you do not agree with the Terms of Service and/or this Privacy Policy, you must refrain from using our Services. By accessing or using our Services, you agree to our use of your information consistent with the Terms of Service and this Privacy Policy. If you are a Customer User accessing our administrative portals or similar offerings ("Portals") pursuant to an agreement between you and Metropolis (such as Terms for Enterprise Customers), then your use of the Portals and Services is also governed by such agreement(s).

Information We Collect When You Interact With Our Services

Depending on how you interact with Metropolis, the personal information you choose to provide to us, the nature of your communications, and how we interact with third parties, we may collect the following information:

Basic identifying information. Information you provide when you sign up for an account for our Services, such as your name, email address, phone number, vehicle license plate number and type, and account credentials.
Information about your vehicle. When you visit a property that uses Metropolis technology, we may use Automated License Plate Reader (ALPR) and similar systems to collect video or pictures of your vehicle and license plates. We may also collect information regarding the date, time, and location where these videos or pictures are captured.
Device identifier and other unique identifiers. Information such as device identifier, internet protocol (IP) address, cookies, beacons, pixel tags, mobile ad identifier, and other unique identifiers collected automatically from your devices that you use to interact with our Services.
Biometric Information. Depending on how you interact with our Services, we may collect biometric information using facial recognition technology at our offices or facilities, or at other facilities that leverage Metropolis technology. For more information about how we collect and process this information, please see our Biometric Information Privacy Notice.
Internet or other network activity. Browsing or search history, information about your interaction with our emails and other communications, and other information regarding your interactions with our Services.
Precise geolocation. We collect the geolocation of the device you use to access our Services when you enable location sharing through your device settings.
Financial and payment information. We may use third-party payment processors to process payments made to us, in which case payment information is provided directly to our third-party processors, whose use of your personal information is governed by their privacy policies.
Commercial information. Personal information such as the Services you have purchased or considered, your preferences, how you use our Services, and related information about your commercial activities.
Communications and other user-generated content. Your communications with us and any other content you provide, such as survey responses, comments, reviews, testimonials, and other user-generated content.
Audio and visual information. Photographs, images, videos, and recordings of your vehicle or license plate.
Inferences. Inferences drawn from or created based on the information identified above.
Professional or employment-related information. Your resume and other application materials if you apply for a job with us, as well as personal information we collect at conferences, trade shows, or other events, and personal information we collect from individuals and third parties to assess and pursue potential business opportunities.

How We Collect Personal Information

We collect information you choose to provide to us, including information you enter through the Services. For example, if you aWe typically collect personal information in three ways: (1) directly from you, (2) automatically, and/or (3) from third parties.re a Consumer or visitor to the Site, we may collect information in relation to:

Directly from you. We may collect personal information directly from you, including when you interact with our websites or Services (e.g., by creating an account or making a purchase), visit a property that uses Metropolis technology, participate in a survey, poll, or promotion, communicate with us, or subscribe to receive emails, text messages, or other communications.
Automatically, using tracking technologies. We may collect information automatically, including when you visit a property that uses Metropolis technology, visit our websites, use our Services, open or click on emails we send you or related communications, or interact with our advertisements. We or other third parties may automatically collect information about your use of cookies, pixels, web beacons, software development kits, and other tracking technologies. For more information, see Cookies and Online Tracking Technologies below.
From third parties and other sources. We may collect personal information about you from third parties, including our business customers, service providers, data analytics providers, marketing or advertising providers, security service providers, survey providers, payment processors, and other third parties.

How We Use Personal Information

We use personal information to:

Provide and improve our Services, develop new services, and operate our business, including to facilitate your access to and use of our Services, support our core business functions, and maintain records.
Communicate with you, including to respond to your requests, inquiries, issues, feedback, and to provide customer service.
Train AI systems, including large language models and other machine learning systems.
Market and advertise, including to send marketing, advertising, and promotional communications to you by email, text message, and postal mail, as well as to show you advertisements for our Services, administer sweepstakes, surveys, and other contests, and market additional products and services to you.
Conduct analytics and personalization, including understanding your interaction with our websites, advertisements, Services, and our communications with you, and to personalize your experience.
Create de-identified and/or aggregated information that is no longer associated with you. If we receive de-identified information, we will not attempt to re-identify such information unless permitted by, or required to comply with, applicable laws.
Help prevent fraud and maintain security, including to detect, investigate, prevent, safeguard against, detect, and respond to security incidents and malicious, deceptive, fraudulent, or illegal activity, enforce our terms and procedures, secure our facilities and infrastructure, and help prevent harm to us and others.
Comply with legal obligations, including to comply with applicable law and legal process, establish and exercise our rights, and defend against legal claims.

How We Disclose Personal Information

We disclose personal information to:

Service providers that perform services on our behalf.
Business customers, such as hotels or employers whose garages we operate. We may also disclose personal information to hotels and other facilities that deploy our technology. Our business customers may process your personal information in accordance with their own privacy policies. We are not responsible for our customers’ processing of your personal information.
Corporate affiliates, such as our parent and subsidiary entities.
Advertising partners. These third-party advertising partners may set cookies and other tracking tools on our Services to collect information regarding your activities and your device (e.g., your IP address, cookie identifiers, page(s) visited, location, time of day). These advertising partners may use this information (and similar information collected from other services) for purposes of delivering personalized advertisements to you when you visit digital properties within their networks. This practice is commonly referred to as "interest-based advertising" or "targeted advertising."

We may also disclose personal information:

To comply with legal process and protect Metropolis, our business customers, users, and others. We may disclose or make available your information to satisfy any law, regulation, legal process, governmental request, or where we have a good faith belief that the disclosure is reasonably necessary or advisable to enforce our agreements or policies, protect our, your, or a third party’s interests, property, or safety, in connection with claims, disputes, or litigation, and to assist with an investigation or prosecution of suspected or actual illegal activity.
In connection with a business transaction. We may disclose personal information to others in connection with a corporate business transaction, such as due diligence, a merger or acquisition, joint venture, corporate reorganization, financing, or sale of company assets. We may also disclose personal information in the unlikely event of insolvency, bankruptcy, or receivership, in which such information could be transferred to third parties as a full or partial asset in the transaction or to potential purchasers of certain assets and other related third parties, such as courts, attorneys, and other individuals tied to such transactions.

Cross-Border Data Transfers

Your personal information may be stored and processed in any country or region where we have facilities or engage service providers. You understand that your personal information may be transferred to countries outside of your country or region of residence, including to the United States, which may have data protection rules that are different from those of your country or region. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries or regions may be entitled to access your personal information.

Where applicable, we have put in place adequate measures, such as the standard contractual clauses adopted by the relevant authority, to protect your personal information. You may obtain a copy of these measures by contacting us as specified in Contact Us below.

Retention of Personal Information

We may keep personal information for as long as necessary to achieve the purpose for which it was collected, our business needs, and any other purpose permitted under law.

Links to Third-Party Sites

Our Services may contain links to third-party websites or services. These links are provided for your convenience and information only, and the websites and services may operate independently from us and have their own privacy policies or notices that you should review. We encourage you to read those policies and notices before engaging with those third-party sites.

Do Not Track

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.

Your Privacy Rights and Choices

Depending on where you are located, the nature of our business in that jurisdiction, and other factors, you may have the following rights:

Right to know / access / portability. The right to request that we confirm whether we are processing your personal information, obtain details about such processing, and obtain a copy of such personal information.
Right to delete. The right to request that we delete your personal information.
Right to correct. The right to request that we correct your personal information.
Right to opt out of targeted advertising, selling, sharing for behavioral advertising, and certain profiling. The right to request an opt-out of certain processing activities including, as applicable, if we process your personal information for "targeted advertising" (as "targeted advertising" is defined by applicable privacy laws), if we "sell" your personal information (as "sell" is defined by applicable privacy laws), if we "share" your personal information for "cross-context behavioral advertising", or if we engage in "profiling" in furtherance of certain "decisions that produce legal or similarly significant effects" concerning you (as such terms are defined by applicable privacy laws).

If you would like to opt out of the sale of your data, please Click Here. We will process such requests in accordance with applicable laws. You have the right to be free from unlawful discrimination for exercising your rights under applicable law.

If you would like to opt out of the sharing of your data via cookies, including for cross-context advertising, please follow these steps: (a) clear your browser cookies, (b) revisit our site, and (c) select "Decline" in the cookie banner. When you select "Decline":

Marketing and advertising cookies will be blocked.
Non-essential analytics cookies will be blocked.
Only strictly necessary cookies required for the website to function will be placed.

Only you, or someone legally authorized to act on your behalf in certain jurisdictions, may make a request to exercise the rights listed above regarding your personal information. If your personal information is subject to a law that allows an authorized agent to act on your behalf in exercising your privacy rights and you wish to designate an authorized agent, please provide written authorization signed by you and your designated agent by Clicking Here and asking us for additional instructions.

We will take steps to verify your identity before fulfilling requests submitted under applicable privacy laws. These steps may involve asking you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. Examples of our verification process may include asking you to confirm the email address we have associated with you.

Some laws may allow you to appeal our decision if we decline to process your request. If applicable laws grant you an appeal right, and you would like to appeal our decision with respect to your request, you may do so by informing us of this and providing us with information supporting your appeal.

Regardless of what privacy laws apply to your personal information, Metropolis may offer you the following choices:

Opt out of marketing emails. If you would like to stop receiving marketing emails, you can update your email preferences by clicking the "unsubscribe" button found at the bottom of the email.
Opt out of marketing texts. If you would like to stop receiving marketing text messages, reply STOP to text messages. Text HELP for help. Message and data rates may apply.
Adjust push notification preferences. You may limit push notifications in our mobile apps by adjusting the permissions on your device.
Adjust location preferences. You can revoke our access to your device’s precise geolocation by adjusting your device settings.
Opt out of collection of precise geolocation from your device. You may at any time opt out from allowing us to access your device’s precise geolocation data by adjusting your device’s permissions.
Uninstall the mobile application. You can uninstall our mobile application at any time. You may use the standard uninstall process available as part of your mobile device or via the mobile application marketplace or network. If you uninstall the mobile application from your device, the unique identifier associated with your device will continue to be stored. If you re-install the application on the same device, we will be able to re-associate this identifier to your previous transactions and activities.
Delete your account on iPhone or Android devices. You may delete your account at any time from your mobile application. We will email you instructions to confirm your identity and finalize your deletion after you submit your account deletion request.

Children

Our Services are not intended for children under the age of 16.

Changes to Our Privacy Policy

We may change this Policy from time to time. Any and all changes will be reflected on this page, and, where appropriate, we may also send other communications. The effective date will be stated at the top of this Privacy Policy. You should regularly check this page for any changes to this Privacy Policy.

Accessibility

To print a copy of this Privacy Policy, please Contact Us to obtain a copy of our Privacy Policy. If you require a copy of this Privacy Policy in an alternative format, please Contact Us.

Exhibit A — Supplemental ALPR Privacy Notice

This Supplemental ALPR Privacy Notice supplements our Privacy Policy and provides additional details regarding our use of ALPR Systems at certain parking facilities. Nothing in this Notice limits our rights under the Privacy Policy.

For purposes of this Notice, the following definitions apply:

"ALPR Systems" means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.

"ALPR Information" means information or data collected through the use of an ALPR System.

Authorized purposes

The authorized purposes for using ALPR Systems and collecting ALPR Information include parking enforcement, validating accurate parking rates, performing vehicle inventories, and those purposes set forth in our Privacy Policy.

Authorized personnel

ALPR Systems and ALPR Information may be used or accessed by authorized Metropolis personnel whose jobs require such use or access including, without limitation, lot checkers, parking attendants, enforcement agents, and facility managers, or independent contractors who are required to access such information in order to provide a service to Metropolis or its clients. Such personnel are required to be trained on information security procedures and receive personalized training at the local parking facility level.

ALPR system monitoring

ALPR Information collected and stored by Metropolis is monitored by the Metropolis IT Information Security Department.

For ALPR Information at parking facilities in California, Metropolis:

May maintain a record of access to its ALPR Information which shows:

The date and time the information is accessed; and
The license plate number or other data elements used to query the ALPR System.

Requires that ALPR Information is only used for the authorized purposes identified in this Notice.

Disclosures of ALPR Information

ALPR Information may be disclosed in accordance with our Privacy Policy. In states where collection is permitted for unpaid parking citations, we will share parking violation information with a third-party collection agency.

h2>Responsible personnel

This Notice is implemented by the Director of Operations Support and the Director of Information Security.

Information regarding ALPR information accuracy and corrections

Metropolis is capable of reviewing ALPR Information captured by ALPR Systems for accuracy by comparing it to customer records and data from parking access and revenue control equipment at the parking facilities. Metropolis also has a customer dispute procedure in place for customers to report inaccurate charges.

Retention of ALPR information

ALPR Information may be retained by Metropolis in accordance with our Privacy Policy. For example, Metropolis may retain ALPR Information about paid parking customers for at least ninety (90) days and ALPR Information about unpaid parking customers where a citation has been issued for at least five (5) years.

Your Privacy Choices

Last updated: June 10, 2025

Under certain laws, including in California, consumers have the right to opt out of Metropolis’s processing of their personal information for targeted online advertising purposes (this data use is called "sharing for cross-context behavioral advertising" in California).

Consumers also have the right to opt out of the disclosure of their personal information to third parties for monetary or other valuable consideration (this data use is called a "sale" of data under various state laws).

Marketing and advertising cookies will be blocked.
Non-essential analytics cookies will be blocked.
Only strictly necessary cookies required for the website to function will be placed.

Your right to opt-out of sale

We have not sold or processed/shared for targeted advertising purposes personal information in the last 12 months. However, if you would like to request that we not sell information associated with your name/email address at any point in the future, you can opt-out below.

Biometric Information Privacy Notice

Last updated: June 10, 2025

This Biometric Information Privacy Notice supplements the Metropolis Privacy Policy and describes how we handle the biometric information we may collect.

Why Metropolis Is Providing This Biometric Information Privacy Notice

We are providing this notice because some of the information we collect in the course of providing our services may be considered biometric, and certain laws require a specific notice regarding the collection and processing of such information.

Why and How We Collect Biometric Information

We may deploy cameras and other technologies in our offices and in facilities that we operate or that use our technology. From the video recordings, we may generate facial geometry data to enable the use of facial recognition technology. Because each individual’s facial geometry is unique, this information may be considered biometric.

How We Use Biometric Information

We use facial recognition technology to support our services, including contactless parking, security, hospitality, and other offerings. We also use this technology to help protect the security of our facilities, personnel, and customers and their vehicles.

Privacy Rights

Depending on your location, individuals may be able to exercise the following rights by emailing privacy@metropolis.io:

<Request to know. Individuals may request that we disclose whether we are collecting, sharing, or selling their biometric information; and identities of the third parties with whom we have shared their biometric information.
<Request to opt out or withdraw consent. Individuals may request to opt out of/withdraw consent to the collection, sharing, or sale of their biometric information.
<Request to delete. Individuals may request that we delete their biometric information.
<Request to access. Individuals may request that we provide them with the email address or other online mechanism they can use to contact the third parties with whom the individual's biometric information is shared and request a copy of their biometric information.

These rights are subject to certain exceptions, and we may ask individuals to verify their identity before taking further action on the request. If we are no longer retaining their biometric information and therefore cannot process the request, we will inform the individual. If we refuse to take action on a request, individuals may appeal this refusal by contacting us at privacy@metropolis.io.

Retention of Biometric Information

We will retain biometric information only until the occurrence of the first of the following: (a) the initial purpose for collecting or obtaining the information has been satisfied or (b) three years following the individual’s last interaction with Metropolis.

Contact Us

For questions or comments regarding this Notice, please send an email to privacy@metropolis.io, or write to:

Metropolis Technologies, Inc.
Privacy Officer
Attn: Legal Department
200 East Randolph Street, Suite 7700
Chicago, IL 60601