How we handle student, family, and driver data.

This policy applies to school administrators and staff who manage routes, drivers who operate vehicles on the platform, aides who confirm student boarding, and parents or guardians who receive trip updates. A school that deploys AuraTransit is the data controller for its students' information; AuraTransit acts as a data processor carrying out the school's instructions, unless stated otherwise below.

The information we collect depends on your role on the platform.

From schools & administrators

• Account details: name, work email, role, and school affiliation
• Route, vehicle, and schedule configuration data
• Student roster information provided by the school: name, grade, pickup/drop-off stop, and guardian contact details

From drivers & aides

• Name, contact details, license or employment identifiers provided by the school
• Trip status entries, such as student boarding and drop-off confirmations
• Device information used to run the driver app

From parents & guardians

• Name, email, phone number, and notification preferences
• Push notification tokens used to deliver pickup and arrival alerts

While a trip is active, the driver app shares the vehicle's GPS position at short, regular intervals so the route can be shown on a live map. This data is associated with the vehicle and the trip it is completing, not with an individual student's device.

Boarding and arrival events — for example, a confirmation that a specific student boarded at a specific stop — are recorded with a timestamp so that schools and parents can see accurate pickup and arrival information. Historical trip and location data is retained only as long as described in Data retention below, and access is limited to the school that operates the route, the assigned driver or aide, and the guardians linked to a student on that route.

We use the information described above to:

• Operate core features: route planning, live tracking, boarding confirmation, and notifications
• Send trip-related alerts to parents, such as "student boarded" or "arriving in 5 minutes"
• Maintain accurate rosters, vehicle assignments, and schedules on behalf of a school
• Monitor system performance, investigate issues, and keep the Service secure
• Meet legal, safety, and recordkeeping obligations a school may have around student transportation

We do not use student data to build advertising profiles, and we do not sell student, driver, or parent data.

AuraTransit is designed to be used by schools, not directly by children. Student information is provided to us by the school under its own authority to manage transportation, consistent with applicable education privacy laws such as FERPA in the United States, and, where relevant, COPPA. We process student data solely to provide the Service to the school and do not use it for any other purpose, including marketing.

We share personal data only in the following circumstances:

• Within a school's account — administrators, assigned drivers/aides, and linked guardians see the data relevant to their role and routes
• Service providers — infrastructure partners that host data or deliver notifications on our behalf, bound by contract to protect it and use it only to provide their service to us
• Legal requirements — where disclosure is required to comply with law, protect safety, or respond to a valid legal request
• Business transfers — if AuraTransit is involved in a merger or acquisition, data may transfer as part of that transaction, subject to this policy

We do not sell personal data, and we do not share student data with advertisers.

We retain account and roster data for as long as a school's subscription is active, and for a limited period afterward to support account recovery and legal obligations. Live location data used for real-time tracking is retained briefly and then aggregated or deleted; boarding and trip history is retained according to the retention period a school configures, or a reasonable default period if none is set. Schools can request deletion of their data on offboarding, subject to any legal retention requirements.

We apply industry-standard safeguards including encryption in transit, access controls scoped by role and school, and regular review of our infrastructure. No system is completely immune to risk, and we encourage schools and users to use strong, unique passwords and report any suspected unauthorized access immediately.

Depending on your role and location, you may have rights to access, correct, or request deletion of your personal data. Parents and guardians should generally direct requests about student data to their school first, since the school controls that data; school administrators and staff can reach us directly using the contact details below. You can also manage notification preferences directly within the app.

Our web dashboard uses essential cookies to keep you signed in and remember basic preferences; we do not use third-party advertising cookies. Our mobile apps request permission before sending push notifications, and you can disable them at any time from your device settings or in-app preferences.

We may update this policy as our Service evolves. If we make material changes, we'll notify school administrators by email and update the "Last updated" date above. Continued use of the Service after changes take effect means you accept the updated policy.