Privacy Policy

Last updated: July 4, 2026

Flooto ("we", "us", or "our") operates the Flooto Guardian mobile application (Bundle ID: net.flooto.guardian). This Privacy Policy explains how we collect, use, disclose, and protect your personal data in compliance with the Saudi Personal Data Protection Law (PDPL) and SDAIA regulations.

1. Information We Collect

Personal Information (linked to identity)

• Full name, email address, and phone number (for account creation and authentication)
• Guardian relationship type (Father, Mother, or Guardian)
• Profile photo (optional)
• Saudi national address format for pickup/dropoff locations (up to 10 saved addresses)

Student Information (children's data)

• Student name, grade, class, and school
• Student photo
• Boarding and alighting timestamps with GPS coordinates
• Attendance records (present, absent, late)
• QR code for boarding verification

Location Data (precise, linked to identity)

• Parent's GPS location shown on the live tracking map alongside the child's bus
• Collected only while the app is open on your screen (foreground) — we do not collect your location when the app is in the background
• Used to show your position relative to the bus position
• When you search for or pick an address on the map, your search text and selected coordinates are sent to Google Maps Platform (Geocoding and Places APIs) to resolve the address

Device & Technical Data

• Device ID and push notification tokens (Firebase Cloud Messaging)
• Device name, model, and OS version (for session management)
• App version and build number
• Crash reports and performance data (via Sentry) — crash reports may include a screenshot of the app screen at the moment of the crash

Usage Data

• Feature interaction analytics (Firebase Analytics)
• Session duration and screen views
• Push notification delivery and open rates

User-Generated Content

• Safety report descriptions and categories
• Photo/video evidence attached to safety reports (up to 5 files, max 5MB each)
• Absence request details (dates and reasons)
• Address change requests
• Live chat messages with the school support team
• Complaint descriptions and ratings

2. How We Use Your Data

• Real-time GPS bus tracking and ETA calculation
• Push notifications for boarding, arrival, delays, and bus approaching
• Student boarding verification via QR codes
• Safety report processing and incident response
• Absence and address change request processing
• Live chat communication with the school transportation team
• Service improvement and analytics
• Regulatory compliance with TGA school transportation requirements

3. Who We Share Data With

• School institution: Student data, trip data, safety reports, and requests necessary for school transportation operations
• Bus operators and drivers: Student boarding lists and pickup addresses required to complete trips
• Service providers (processors): Google Maps Platform (address search and geocoding when you pick a location on the map), Google Firebase (push notifications and usage analytics), and Sentry (crash reporting). These providers process data on our behalf under strict data protection agreements
• Government authorities: When required by Saudi law or regulation

We never sell your personal data to third parties. We do not share your data for marketing or advertising purposes.

4. Data Storage & International Transfers

Your personal data is primarily stored on servers located in the Kingdom of Saudi Arabia. Operational diagnostics and notification delivery are processed by Sentry and Google Firebase, which may store data outside the Kingdom, in accordance with the PDPL's cross-border data transfer provisions.

5. Data Security

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for all data at rest
• Biometric authentication (Face ID / Touch ID) for app access
• Secure credential storage using platform-native secure storage
• Compliance with NCA (National Cybersecurity Authority) standards
• Regular security audits and vulnerability assessments

6. Data Retention

• Account data: Retained for the duration of enrollment plus 1 year after account deletion
• Trip history: 90 days rolling retention
• Safety reports: Retained for the duration of enrollment plus 1 year

You may request earlier deletion of your data at any time by contacting us.

7. Your Rights Under PDPL

Under the Saudi Personal Data Protection Law, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Withdraw Consent: Withdraw your consent for data processing at any time
• Data Portability: Request export of your data in a portable format
• Lodge a Complaint: File a complaint with SDAIA if you believe your rights have been violated

8. Children's Privacy

We take extra care with children's data in accordance with PDPL requirements:

• Student data is collected solely for school transportation purposes
• No student data is used for marketing, profiling, or advertising
• Access to student data is restricted to authorized guardians, school staff, and assigned drivers
• Student data is subject to the same security measures as all other personal data

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes through the app or by email. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

Governing Law: Kingdom of Saudi Arabia