Privacy Policy

1. Who we are

SkolBuzz is operated by Pac Labs ("SkolBuzz", "we", "our", "us"), Bangalore, Karnataka, India. We provide a school bus tracking platform that connects parents, drivers, and school administrators in real time. Our app is available for Android (published on the Google Play Store as com.skolbuzz) and for iOS (com.skolbuzz.ios, currently distributed via TestFlight ahead of its App Store release). This policy applies to both.

For any privacy questions, contact us at info@skolbuzz.com or +91 91646 46451.

2. Your school and us — who is responsible for what

Your school (or its transport provider) decides to use SkolBuzz, enters student and route information, and links each child to their parents' phone numbers. For that information, your school acts as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and SkolBuzz processes it on the school's instructions under our Terms of Service.

For the live tracking of the bus during your child's journey, we process location in the interests of children's safety under the exemption in the Fourth Schedule (Part A, item 5) of the DPDP Rules, 2025, which covers providers engaged by educational institutions for the transport of children — restricted strictly to tracking location, for safety, during travel to and from the institution. We do not use that exemption for anything else.

3. What we collect — item by item

The app uses Firebase Analytics to record how its core flows perform — for example, whether a trip started, a child was marked aboard, or a notification actually arrived — linked to your account ID and role. This runs automatically, including Google's standard automatic collection, and there is currently no in-app opt-out. It is used only to operate and improve the Service — never for advertising. The app contains no advertising SDK. Processing logs are retained for a minimum of one year as required by the DPDP Rules.

4. Children's data — our commitments

SkolBuzz exists for children's safety, and children's data gets the strictest treatment in this policy:

• We process a child's live journey location only under the safety-of-children transport exemption described above — during travel, for safety, and for nothing else.
• All other children's data (name, photo, class, home stop) is processed on the basis of parental consent obtained through your school before the school enters the child into SkolBuzz. Schools confirm to us that they hold this consent.
• We will never direct advertising at children, profile children, monetise children's data, or undertake any tracking or behavioural monitoring of children beyond the safety purpose.
• Children do not use the app; it is operated by adults — parents, drivers, and school staff. Usage analytics measure how these adult accounts use the app; we do not analyse or profile children.

5. Location, exactly

Only the driver's device shares location, and the app requests only foreground ("while using the app") location permission — we never ask for Android's "Allow all the time" or iOS's "Always" permission. During an active trip, the driver's phone keeps sharing its position with the screen off through an Android foreground service (with a visible, persistent notification) or the iOS location background mode (with the system's blue location indicator). Location is recorded approximately every 3 seconds, held only as the most recent coordinate, shared only with the parents and school administrators of that route, and deleted when the trip ends. Parents' and children's devices are never location-tracked.

6. How consent is obtained, recorded, and withdrawn

• Parents, drivers, and school staff: at sign-in, the app asks you to accept this policy; your acceptance is recorded on your account as the exact policy version you accepted, together with a server timestamp. When this policy materially changes, the app asks you to accept the new version before continuing.
• Children's data: consent is collected by your school from parents before the school enters a child into SkolBuzz, and the school's entry of the child is logged.
• Withdrawal is as easy as giving: ask your school to unlink or delete your child at any time (effective immediately in the app); mark per-trip opt-outs yourself in the app; revoke location permission in your phone's settings (drivers); or email info@skolbuzz.com to delete your account — actioned within 30 days. Withdrawal does not affect the lawfulness of processing already carried out.

7. Who we share data with — and who we don't

We share personal data only with the service providers who operate the platform under their own privacy terms: Google Firebase (Authentication, Firestore, Cloud Messaging, Crashlytics, and Google Analytics for Firebase — Firebase Privacy), Google Play Services (location services on Android), and Google Maps Platform (map display and place search). Driver location during an active trip is visible to the parents and administrators of the same route — that is the core function of the service.

We do not sell your personal data or use it for profiling. SkolBuzz currently shows no advertising; if we introduce ads in the future (for example, on free accounts), we will update this policy beforehand and clearly explain what changes — and location and student data will never be shared with advertisers, and advertising will never be directed at children. Notification tokens and phone numbers are used solely to deliver the alerts described in this policy. If we are required to disclose data by law or lawful government order, we will disclose the minimum required.

8. Data security

All data is transmitted over HTTPS/TLS. Access to data is governed by security rules that restrict each user to only the data they are authorised to see — a parent can only see their own child's trip, a driver can only write location for their assigned route, and school administrators can only access their own school's data. Sign-in is by one-time code only, so there are no passwords to leak. No system is perfectly secure, and we do not claim to be — see section 10 for what we do if something goes wrong.

9. Your rights

You have the right to:

• Access the personal data we hold about you and your children.
• Request correction of inaccurate data.
• Request deletion of your account and associated data — actioned within 30 days.
• Withdraw consent at any time (section 6), including by revoking the location permission in your phone's settings.
• Nominate another individual to exercise your rights on your behalf if you are unable to.

To exercise any of these rights, email info@skolbuzz.com or ask your school (for records the school entered). We will respond within 30 days.

10. If there is a data breach

If a personal data breach affects you, we will notify you without delay — in the app or via your registered contact — describing what happened, the likely consequences for you, what we have done about it, what you can do to protect yourself, and whom to contact. We will also notify the Data Protection Board of India without delay, with a detailed report within 72 hours, as required by the DPDP Rules, 2025.

11. Grievance redressal

Grievance Officer — SkolBuzz (Pac Labs) · info@skolbuzz.com · Bangalore, Karnataka, India.

We acknowledge grievances promptly and resolve them within 30 days. If you are not satisfied after using this mechanism, you may escalate your complaint to the Data Protection Board of India.

12. Language

You may request this notice in English or in any language listed in the Eighth Schedule to the Constitution of India — write to info@skolbuzz.com and we will provide it.

13. Changes to this policy

When we make material changes, we update the "Last updated" date and version number at the top of this page and, where required, notify users via the app. We do not make silent, undated amendments. Continued use of SkolBuzz after a change constitutes acceptance of the updated policy.