Privacy Policy
Last updated: April 4, 2026 · Effective date: April 4, 2026
Who we are
bustrackr. ("we", "us", "our") is a school bus safety and real-time tracking platform developed and operated by bustrackr, incorporated under the Companies Act 2013, with its registered office at NH-44, Kishora, Murthal, Sonipat, Haryana, India, 131001. We operate the bustrackr. parent app, bustrackr. driver app, school administrator dashboard, and the website bustrackr.in (collectively, the "Platform"). For the purposes of the Digital Personal Data Protection Act 2023 ("DPDP Act"), we act as the Data Fiduciary in respect of all personal data processed through the Platform.
This Privacy Policy applies to all users of the Platform: parents and guardians, school bus drivers, school administrators, and visitors to our website.
What data we collect and why
| User type | Data collected | Purpose | Legal basis |
|---|---|---|---|
| Parent / Guardian | Name, mobile number, email, child's name, school name, home address (for geofencing), notification preferences | Account creation, trip notifications, geofence alerts, billing via school invoice | Consent (DPDP Act S.6) + Contractual necessity |
| Driver | Name, mobile number, driving licence number, Android device ID, real-time GPS coordinates during active trips only, trip start/end timestamps | Live bus tracking, route binding, trip history, driver accountability logs | Consent + Employment/Contractor obligation |
| School admin | Name, designation, work email, mobile number, school name and address, UDISE code (if provided) | Dashboard access, fleet management, compliance reporting | Contractual necessity |
| All users | Device model, OS version, app version, crash logs, usage analytics (anonymised) | App stability, bug fixing, product improvement | Legitimate interest |
We do not collect Aadhaar numbers, PAN numbers, bank account details, biometric data, or any government-issued ID beyond a driver's licence number for driver verification purposes.
How we collect data
Data you provide directly
- Registration details entered when creating an account on the parent app or driver app
- School onboarding forms submitted by administrators
- Early access and pilot request forms on our website
- Support requests and feedback submitted through the Platform
Data collected automatically
- GPS coordinates from the driver's Android device collected only when a trip is actively in progress and the driver has started the trip in the app
- Device and app diagnostics via Firebase Crashlytics
- Anonymised usage analytics via Firebase Analytics
Data we do NOT collect
- Driver location outside of active trip windows
- Cabin audio or video (no dashcam integration in the current version)
- Parent location at any time
- Any data from children directly all child-related data is provided by a parent or guardian
How we use your data
- To display a live bus map in the parent app showing the bus's real-time GPS position
- To send push notifications to parents when a trip starts, when the bus is delayed, and when the bus is 500 metres from the drop-off point
- To generate automated trip summaries and delivery confirmations
- To enable school administrators to view all active buses on a single dashboard
- To maintain trip logs for school administrative and compliance purposes
- To detect route deviations or unexpected stops and alert the school dashboard
- To improve the accuracy of our ETA prediction model using anonymised historical route data
- To communicate product updates, service notices, and support responses
We do not use your data for advertising, we do not sell your data to any third party, and we do not use your data to build advertising profiles.
Data sharing and third parties
We share personal data only with the following categories of third parties, strictly for the purposes described:
| Third party | Data shared | Purpose |
|---|---|---|
| Google (Firebase / Maps) | Device identifiers, anonymised analytics, map coordinates | Backend infrastructure, live map rendering, crash reporting |
| Meta (WhatsApp Business API) | Parent mobile number, notification message content | Sending trip alerts and notifications via WhatsApp |
| Supabase / PostgreSQL hosting | Trip data, user account data | Database and backend infrastructure |
| School institutions | Trip logs, driver attendance, route completion data | Fleet management and institutional compliance |
| Law enforcement / courts | Any data required by valid legal order | Legal compliance only we will notify you unless prohibited by law |
We do not share GPS coordinates, child names, or home addresses with any party other than the school directly associated with that student's transport, and only to the extent required for fleet management.
Children's data special provisions
This is a high-priority compliance section. We take children's privacy with maximum seriousness under both the DPDP Act 2023 and general legal principle.
- The bustrackr. platform does not collect any data directly from children under 18
- All child-related data (name, school, drop-off address) is provided exclusively by a verified parent or guardian during account setup
- We obtain verifiable parental consent before processing any data associated with a minor
- Child names displayed in the app are used only to confirm the correct student on the correct route they are never shared with any advertising platform or data broker
- We do not build any profile, analytics record, or behavioural model associated with a child's identity
- Trip data associated with a child's route is retained for 90 days and then permanently deleted unless the school requests a shorter period
- Parents may request immediate deletion of all data associated with their child by contacting us at [email protected]
Driver location tracking
This section specifically governs the collection and use of GPS location data from drivers using the bustrackr. driver app on their personal or school-provided Android device.
Consent and control
- Location tracking begins only when the driver explicitly taps "Start Trip" in the app
- Location tracking stops automatically when the driver taps "End Trip" or when the system detects the bus has returned to the depot geofence
- No location data is collected before or after an active trip window
- Drivers are shown a clear, persistent notification in their Android status bar during any active tracking session
Purpose limitation
- Driver GPS coordinates are used solely to display the bus position on the parent and school map views
- Location data is not used for driver performance scoring, speed monitoring for punitive purposes, or any HR assessment without separate explicit consent
- Raw GPS coordinates are stored for a maximum of 7 days for debugging purposes and then permanently deleted. Anonymised route shape data may be retained longer for ETA model improvement
DPDP Act compliance for drivers
Under the DPDP Act 2023, tracking an employee via their personal device requires explicit, time-bound consent. Drivers provide this consent during app onboarding via an in-app consent screen. This consent can be reviewed and withdrawn at any time via app settings, which will prevent trip initiation until consent is re-provided.
Data retention
| Data type | Retention period | Deletion method |
|---|---|---|
| Raw driver GPS coordinates | 7 days | Automatic deletion from database |
| Trip history (anonymised route) | 90 days | Automatic deletion |
| Parent account data | Duration of school contract + 30 days | On account deletion request |
| Driver account data | Duration of employment + 30 days | On account deletion request or school offboarding |
| School admin data | Duration of contract + 6 months | On contract termination |
| WhatsApp message logs | 30 days | Automatic deletion not stored on Meta servers by us |
| Crash and analytics logs | 90 days (anonymised) | Automatic deletion via Firebase retention settings |
Your rights under DPDP Act 2023
The Digital Personal Data Protection Act 2023 grants you the following rights as a Data Principal. You may exercise any of these rights by contacting us at [email protected]:
- Right to access Request a copy of all personal data we hold about you
- Right to correction Request correction of inaccurate or incomplete personal data
- Right to erasure Request deletion of your personal data, subject to legal retention obligations
- Right to grievance redressal Lodge a complaint with our Grievance Officer (details in Contact section)
- Right to nominate Nominate another individual to exercise your rights in the event of your death or incapacity
- Right to withdraw consent Withdraw your consent for any processing activity at any time. Withdrawal will not affect lawfulness of processing prior to withdrawal.
We will respond to all rights requests within 72 hours of receipt and resolve them within 30 days. If we are unable to fulfil a request, we will explain why in writing.
Data security
- All data in transit is encrypted using TLS 1.3
- All data at rest is encrypted using AES-256 encryption in Firebase and Supabase
- Access to production databases is restricted to authorised engineering personnel only, with multi-factor authentication required
- GPS coordinate streams are transmitted over encrypted WebSocket connections and MQTT with TLS
- We conduct security reviews before each major app release
- In the event of a data breach, we will notify affected users and the Data Protection Board of India within 72 hours of becoming aware, as required by the DPDP Act
WhatsApp Business API specific disclosures
bustrackr. uses the WhatsApp Business API operated by Meta Platforms Ireland Ltd. to send trip notifications to parents. The following disclosures are required by Meta's platform policies:
- Parents provide explicit consent to receive WhatsApp notifications from bustrackr. during account setup. This consent is separate from account registration consent.
- Parents may opt out of WhatsApp notifications at any time by replying STOP to any bustrackr. WhatsApp message or by changing notification settings in the parent app
- Messages sent via WhatsApp are transactional notifications only trip start, delay alerts, proximity alerts, and trip completion. We do not send marketing or promotional messages via WhatsApp
- We share only the parent's mobile number and notification message text with Meta for the purpose of message delivery. We do not share any other personal data with Meta through this integration
- WhatsApp message delivery is subject to Meta's own Privacy Policy available at whatsapp.com/legal/privacy-policy
- Parents whose numbers are registered on India's DND registry may experience delivery issues in such cases, notifications are delivered via push notification in the parent app instead
Cookies and analytics
Our website (bustrackr.in) uses essential cookies only for session management and form functionality. We do not use tracking cookies, advertising cookies, or third-party analytics cookies on our website.
Our mobile apps use Firebase Analytics with IP anonymisation enabled. This data is used solely to understand app performance and is never linked to individual user identities.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify users via a push notification in the app and by email at least 14 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.
The version history of this document is maintained at bustrackr.in/legal/privacy-history.
Contact and grievance officer
As required by the DPDP Act 2023, we have appointed a Grievance Officer for data protection matters:
Grievance Officer: Grievance Officer
Email: [email protected]
Address: NH-44, Kishora, Murthal, Sonipat, Haryana, India, 131001
Response time: Within 72 hours acknowledgement, resolved within 30 days
For all queries: [email protected]