Flooto Crew — Privacy Policy

Last updated: July 4, 2026

This policy covers the Flooto Crew mobile application for school-bus drivers (iOS bundle ID net.flooto.driver), operated by Flooto ("we", "us"). It explains what data the app handles, why, and your rights under the Saudi Personal Data Protection Law (PDPL).

1. Who uses this app

Flooto Crew is a work application. Your account is created by the school or transport provider you work with — you cannot sign up independently. Your employer decides which trips, buses, and students are assigned to you.

2. Data we collect

Account and profile data (provided by your employer or by you): your name (Arabic and English), phone number, email address, driver's license number and expiry date, assigned bus and institution.

Work activity data (created as you use the app): trip start/complete events, student boarding and drop-off confirmations (QR scans or manual check-ins, with timestamps), vehicle inspection checklists and notes, SOS/breakdown/route-deviation reports, and messages you exchange with the school's operations team.

Device and notification data: a push-notification token, device model, operating-system version, and app version, so we can deliver trip and message notifications to your device.

Diagnostics and usage data: anonymous crash reports and basic usage events collected through Google Firebase (Crashlytics and Analytics) to keep the app stable. These are not tied to your identity.

3. Data we do NOT collect

• Your phone's location. The app contains no location tracking. Bus positions shown to schools and parents come from a GPS telematics unit installed on the vehicle itself — never from your phone.
• Photos, videos, or audio recordings.
• Contacts, browsing history, financial or health data.
• We do not use advertising SDKs and we do not track you across other apps or websites.

4. Students' data

When you scan a student's QR code or check students in manually, the app records the boarding event (student, stop, time) and sends it to the school so parents are notified. This student data belongs to the school (the data controller); Flooto processes it on the school's behalf and it is not visible to anyone outside the school and the student's guardians.

5. How we use your data

• Operate your daily trips and boarding verification
• Notify the school and parents about trip events
• Vehicle-safety compliance (inspections)
• Respond to emergencies (SOS, breakdowns)
• App stability and improvement (crash reports)

We do not sell your data. We do not use it for advertising.

6. Who we share it with

• Your school / transport provider: trip activity, boarding events, inspections, reports, and messages are visible to the operations team.
• Service providers (processors): Google Firebase (push notifications, crash reporting, analytics). These providers process data on our behalf under their own security commitments.
• Authorities when required by Saudi law.

7. Retention

Trip, boarding, and inspection records are retained as long as required by the school's operational and regulatory obligations, then deleted or anonymized. Account data is removed when your employer ends your account.

8. Security

Data is encrypted in transit (TLS). Authentication tokens and biometric login credentials are stored in the iOS Keychain on your device. Face ID / Touch ID processing never leaves your device.

9. Your rights (PDPL)

You have the right to access, correct, or request deletion of your personal data. Because accounts are employer-managed, deletion of your account is handled through your employer; you can also contact us directly at support@flooto.net and we will process your request within 30 days.

10. Changes

We will update this page and the "Last updated" date when this policy changes materially.

11. Contact