Privacy Policy

OnTheBus ("we", "us", or "our") provides school transport tracking, boarding, and parent-alert services for private schools. This Privacy Policy explains what information we collect, why we collect it, and the choices available to you. It is written to align with common mobile-store expectations (including Google Play's Data safety disclosures) and privacy practices used by similar education and location services.

1. Who this policy covers

• School administrators using the OnTheBus web console
• Drivers and conductors using the OnTheBus Driver app
• Parents and guardians using the OnTheBus Parent app or receiving SMS/push alerts
• Students whose transport and boarding records are managed by their school

Schools are typically the primary controllers of student and parent contact data they enroll. OnTheBus processes that data to provide the service under each school's instructions and applicable law.

2. Information we collect

Account and contact information

• Names, roles, work email addresses, and phone numbers for school staff
• Phone numbers used to sign in parents, drivers, or conductors (for example via OTP)
• Parent/guardian contact details provided by the school for alerts

Student transport information

• Student name, route/stop assignment, and boarding status
• Encrypted or hashed NFC badge identifiers (not raw card secrets in plain form)
• Attendance and trip history associated with school transport

Location information

• Precise location from the Driver app during active trips (including background location when a trip is running) to power live tracking, proximity alerts, and safety features
• Map display location for parents viewing their child's bus during a trip
• School-configured stop or campus locations

Device and usage information

• App version, device type, crash/diagnostic data, and approximate network info
• Push notification tokens where notifications are enabled

Communications

• SMS and in-app/push alert content related to boarding, proximity, and trip events
• Support and demo-request messages you send us

3. How we use information

• Operate live fleet tracking, manifests, and parent alerts
• Authenticate users and secure school-scoped access
• Send transactional SMS/push notifications requested by the school's configuration
• Provide school admin reporting (attendance, trips, billing metrics)
• Improve reliability, prevent abuse, and comply with legal obligations

We do not sell personal information.

4. How we share information

We share information only as needed to run the service, including:

• Your school — administrators and authorised staff for the school that enrolled you or your child
• Service providers— hosting, database, maps, SMS gateway, and email providers that process data on our instructions (for example cloud infrastructure and Africa's Talking for SMS)
• Legal requirements — when required by law, regulation, or valid legal process, or to protect the safety of students, users, or the public

Multi-tenant controls are designed so one school cannot access another school's student, parent, or fleet data.

5. Data retention

• Account and roster data is retained while the school subscription or demo is active
• High-resolution telemetry is retained for a limited operational window (approximately 7 days) and then pruned
• After a school ends service or a deletion request is completed, personal data is deleted or anonymised within a reasonable period, except where we must keep records for legal, security, or billing reasons

6. Security

We use industry-standard safeguards such as encryption in transit (HTTPS/TLS), access controls, tenant isolation, and least-privilege service roles. No method of transmission or storage is 100% secure; please protect OTP codes and admin credentials.

7. Children's information

OnTheBus is used in a school context and may process children's transport data provided by schools. We do not offer the service for children to create accounts independently. Parents and schools should contact each other (and us if needed) about student data requests.

8. Your choices and rights

• Parents and staff may update contact preferences through their school administrator
• You may request access, correction, or deletion of personal data as described on our Delete account page
• You can disable push notifications in device settings; SMS may still be sent by the school's alert rules
• Drivers can stop location sharing by ending the trip and signing out

9. International processing

Data may be processed in Kenya and in other regions where our cloud providers operate. We take steps appropriate to the service to protect personal data during transfer and hosting.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Continued use of the service after changes means you acknowledge the updated policy.

11. Contact

Privacy questions: support@onthebus.app
For student or parent records managed by a school, start with your school's transport administrator.