Privacy policy

Who we are

Basy is a school bus tracking system based in Amman, Jordan. We provide the service to schools; the school registers its students, drivers and parents and decides what data is entered. We process that data on the school's behalf, only to run the service.

Data we collect

Depending on the role in the system:

• Parents: name and phone number as registered by the school, the children linked to them, absence reports and notes they send, and their device's notification token.
• Students: name, grade, route and bus stop, and boarding and drop-off records with their times. A photo of the student if a parent adds one (optional): only the parents, the school and the bus staff of the student see it, location and device details are removed from it, and the parent can delete it at any time. We do not ask for official documents of students.
• Drivers: name and phone number, and the bus location during a trip only (coordinates, speed and heading).
• School staff: names and phone numbers of admin users, and bus and route details.
• Technical data: server logs (IP address and request time) for security and troubleshooting.

What we do not collect

• The parent app does not track the parent's location or device.
• The driver's location is not tracked outside trips.
• We use no advertising tools, and we do not sell data or share it for marketing.

How we use data

• Showing the bus location and estimated arrival time to the parents of students on the trip and to the school.
• Sending notifications: bus departure, the bus nearing the stop, boarding and drop-off, and absences.
• Signing in with a one-time code sent on WhatsApp.
• Keeping a trip history for the school to review later.
• Protecting the service from abuse and fixing faults.

Who sees the data

• A parent sees their own children only, and the bus location only during their trip.
• A driver sees the students on their own round only.
• A school's staff see their own school's data only.
• No school can see another school's data.

Service providers

We rely on providers that process part of the data, only to run the service:

• Google Firebase Cloud Messaging, to deliver notifications to phones.
• WhatsApp (Meta), to send the sign-in code to the user's number.
• Hosting servers in the European Union, and Cloudflare to protect and speed up connections.
• Map services (OpenStreetMap and Mapbox), which receive the device's IP address when the map loads.
• Resend, to send the emails for demo requests made on this website.

Security

• All traffic between the apps and the server is encrypted with HTTPS.
• Access by role, and sign-in with one-time codes that expire within minutes.
• Sign-in codes are stored hashed and deleted within a day.

Retention

We keep data for as long as the school uses the service. Old trips are moved to an archive and old notifications are deleted automatically. When a school's subscription ends, or when it asks, we delete its data.

Your rights

A parent can ask to see, correct or delete their data through the school or by writing to us directly. Because the school registers the accounts, we may need to coordinate with it to complete the request.

Children

The Basy apps are meant for parents, drivers and school staff, not for children. Student data is entered by the school, and students do not use the apps themselves.

Changes to this policy

We may update this policy. We publish the new version on this page with its date, and tell schools about any significant change.