Privacy Policy

1. Introduction

SchoolBuswala (“we”, “our”, or “the Service”) is operated by Webanav Private Limited (contact: [email protected]). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our mobile application and website (collectively, the “Service”). By using the Service, you agree to the practices described here. This policy is written to align with India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).

2. Information We Collect

Account information: name, mobile number, email address, date of birth, and password (hashed). Date of birth is collected to confirm you are at least 18 — see Section 7 on children's data below.

Rider (child/dependent) information: if you add a child or other dependent to your account (a “Rider”) so they can be enrolled for a ride, we collect their name and, optionally, date of birth. This information is provided and managed entirely by you as the guardian — a Rider is never a separate account, login, or consent-holder of their own.

Profile information: profile photo and gender, if provided.

Vehicle information (drivers): vehicle name, registration number, vehicle photo, and insurance documentation.

Bank account information (drivers): account holder name, account number, IFSC code, and bank name — used to process payouts via Razorpay.

Location data: GPS coordinates while a trip is active. Drivers share live location; parents can view their Rider's bus position during an active trip.

Payment data: invoice amounts and status, Razorpay order and payment IDs (we do not store full card numbers). Subscription and payment processing is handled by Razorpay (Razorpay Software Private Limited) subject to their privacy policy.

Usage data: device type, app version, and logs of Service interactions.

3. How We Use Your Information

• Provide, operate, and improve the Service.
• Process payments and payouts.
• Send OTPs and operational notifications via SMS, push notification, email, and — only if you opt in — WhatsApp.
• Enable live bus tracking for parents and drivers.
• Generate monthly invoices for school transport fees.
• Detect and prevent fraud or abuse.

4. Data Sharing

We do not sell your personal data. We share information only with:

Service providers: Razorpay (payments), Fast2SMS (SMS/OTP delivery), Google Firebase (push notifications), Meta Platforms, Inc. / WhatsApp Business Platform (trip and payment messages, only sent if you have opted in), Google Maps (driver navigation), Oracle Cloud Infrastructure (file storage), and cloud hosting providers — each bound by data processing agreements.

Other users: a driver's live location is shared with passengers on their active trip. A Rider's name is visible to their assigned driver.

Legal requirements: we may disclose information if required by law or to protect the rights and safety of our users.

5. Data Retention

We retain account data for as long as your account is active. Trip and payment records are retained for 3 years for financial and legal compliance. You may request deletion of your account (and any Riders on it) by contacting [email protected]; we will delete personal data within 30 days except where retention is required by law.

6. Security

Passwords are hashed. Sensitive API endpoints are authenticated using JWT tokens transmitted over HTTPS. Bank account details are stored encrypted at rest. We follow industry-standard security practices, though no system is completely secure.

7. Children's Data & Guardian Consent

SchoolBuswala is built around transporting children, so handling their data correctly matters more here than in most apps. Here is exactly how it works:

• Only an adult (18 or older, confirmed at signup) may create an account. A child cannot sign up for their own account.
• A child is added to the Service only as a Rider — a profile owned by their parent/guardian's account, never a login of its own.
• By adding a Rider, you confirm you are their parent or legal guardian and you are giving consent, on their behalf, for us to collect the Rider's name and location-while-riding data for the purpose of providing the transport-tracking Service.
• You may remove a Rider, or delete the whole account, at any time (Section 5).

8. Your Rights & Grievance Officer

You may access, correct, or delete your personal data (and any Rider data you manage) by contacting us at [email protected]. Under the DPDP Act, you have the right to access, correction, erasure, and grievance redressal regarding your personal data.

Grievance Officer: for complaints or concerns about how your data is handled, contact our Grievance Officer at [email protected]. We aim to acknowledge grievances within 7 days and resolve them within 30 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via the app or email. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact Us

For questions about this Privacy Policy, contact us at: [email protected]