Privacy Policy

This policy applies to everyone whose data passes through BusBuzz: schools and their administrators, parents and guardians, drivers, and the students whose journeys are tracked.

For account data belonging to school administrators, parents, and drivers, BusBuzz is the data controller. For student information, which schools enter to run their transport, BusBuzz acts as a data processoron the school’s behalf and only on the school’s instructions. You can reach us about any privacy matter at hello@busbuzz.com.ng.

We collect only what we need to run the service:

• From school administrators: name, email address, and school details.
• From parents and guardians: name, email address, phone number, the children linked to them, and a device token used to deliver push notifications.
• From drivers: name, phone number, assigned bus, and a 4-digit sign-in PIN, which is stored only in hashed form — we never keep it in plain text.
• About students (provided by the school): name, class, an optional photo, and their assigned route and stop; plus boarding and attendance records created during trips.
• Bus location: GPS coordinates broadcast by the driver’s mounted device while a trip is active.
• Technical data: basic app and device information needed to deliver notifications and keep the service secure.

BusBuzz tracks the bus, not people. Location comes only from the driver’s mounted device, and only while a trip is active. The parent app does not track a parent’s phone or a child’s phone— it simply displays where the bus is. Location breadcrumbs are kept for a rolling 30 days so parents and schools can review recent trips, and are then automatically deleted.

• To show the live location of a child’s bus to their linked parents.
• To send approaching, boarded, dropped-off, and arrival notifications.
• To record attendance and produce trip and attendance reports for the school.
• To operate driver sign-in, manage devices, and provide support.
• To keep the service secure, prevent misuse, and meet our legal obligations.

We do not use children’s data for advertising, and we never sell personal data.

Student data is collected from, and processed on behalf of, the school under its authority as part of providing school transport. It is used only to deliver the service — for example, to let a driver mark a child as boarded and to notify that child’s linked parents. It is not used for marketing and is not shared beyond the recipients described below.

We share personal data only where necessary, and never with advertisers. Specifically:

• With the child’s school, which controls its own students’ records.
• With a parent, who can see only their own linked child’s bus and updates — access is enforced at the database level so families cannot see one another’s data.
• With the service providers that power BusBuzz: our cloud database and authentication host (Supabase), the push-notification service (Expo), mapping (Google Maps), and our email provider. These providers process data on our behalf under their own safeguards.
• Where we are required to by law, or to protect the safety and rights of users.

Parents receive push notifications about their child’s trip through the Expo push service. You can turn notifications off at any time in your device settings; the app will still show live tracking when you open it.

• Bus location breadcrumbs: 30 days, then deleted automatically.
• In-app notification history: 90 days.
• Account, student, route, and attendance records: for as long as the account is active and the school needs them, and then deleted or anonymised on request or account closure.

• Data is encrypted in transit.
• Access is enforced by row-level security, so each account can reach only the data it is entitled to.
• Student photos are stored in private storage and served only through short-lived, signed links.
• Driver PINs are stored only as hashes, never in plain text.

Under the NDPA you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Request deletion of your data, subject to any legal obligations.
• Object to or restrict certain processing, and withdraw consent where processing relies on it.
• Request a copy of your data in a portable form.

To exercise any of these, email hello@busbuzz.com.ng. Parents can also raise requests about a child’s data with their school, which controls those records. We will respond within the timeframes set by law.

Parents can delete their BusBuzz account and associated personal data directly from the parent app. Schools can request removal of their data by contacting us. Some records may be retained where the law requires.

BusBuzz uses reputable cloud providers that may store or process data on servers located outside Nigeria (for example, in the European Union). Where data is transferred internationally, we rely on providers that apply appropriate safeguards and contractual protections consistent with the NDPA.

We may update this policy as the service evolves or the law changes. We will revise the date above and, for material changes, notify schools. Please check back from time to time.

For any privacy question or request, contact our team at hello@busbuzz.com.ng. We take every request seriously and will get back to you promptly.