Privacy Policy

SchoolBusTrack ("we", "our", "us") is a school fleet tracking and parent communication platform operated by SchoolBusTrack Ltd, incorporated in Nigeria. Our registered address is Lagos, Nigeria.

This Privacy Policy explains how we collect, use, store, and share personal information when you use our website (schoolbustrack.ng), our admin dashboard, or our parent mobile application (collectively the "Services").

We collect information you provide directly:

• Account data — name, email address, phone number, school name, and password when you register.
• School data — school address, routes, student names (first name only for notifications), and bus details entered by school administrators.
• Payment data — billing information processed via Paystack. We never store raw card numbers on our servers.
• Communications — messages you send to our support team.

We collect information automatically when you use the Services:

• GPS location data — from driver devices during active trips only. Location is not collected when no trip is in progress.
• Device & usage data — IP address, browser type, pages visited, and crash reports to improve reliability.
• Cookies — session tokens and preference cookies. See our Cookie Policy for full details.

We use the information we collect to:

• Provide, operate, and improve the Services.
• Send parents real-time notifications about their child's bus.
• Process payments and send invoices and receipts.
• Respond to support requests and troubleshoot issues.
• Send important service announcements (not marketing) to account holders.
• Comply with legal obligations.

We will never sell your personal data to third parties. We will never use student data for advertising purposes.

We share data only where strictly necessary:

• Paystack — payment processing. Subject to Paystack's own privacy policy.
• Email service providers — to deliver transactional notifications.
• Cloud infrastructure providers — for hosting and storage, under data processing agreements.
• Law enforcement — only when required by a valid legal order.

All third-party processors are contractually bound to use your data only to provide services to us and to maintain appropriate security measures.

We retain your account data for as long as your account is active. If you close your account, we delete your personal data within 90 days, except where we are required by law to retain it longer (e.g. financial records for 7 years).

GPS trip history is retained for 12 months and then automatically purged.

We use industry-standard measures to protect your data: TLS encryption in transit, AES-256 encryption at rest, bcrypt password hashing, role-based access controls, and regular penetration testing. Despite this, no system is 100% secure and we cannot guarantee absolute security.

Our Services are provided to schools and parents — not directly to children. We collect only first names and route assignments for students, which are entered by school administrators. We do not create accounts for children, and we do not knowingly collect data directly from anyone under the age of 13.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete your personal data (subject to legal retention obligations).
• Portability — receive your data in a machine-readable format.
• Objection — opt out of any optional processing.

To exercise any of these rights, email us at privacy@schoolbustrack.ng. We will respond within 30 days.

We may update this policy from time to time. We will notify account holders by email at least 14 days before any material change takes effect. The "Last updated" date at the top of this page always shows the current version date.

For privacy-related questions or concerns, contact our Data Protection contact at privacy@schoolbustrack.ng or write to us at SchoolBusTrack Ltd, Lagos, Nigeria.