Privacy Policy

Last updated: May 18, 2026

At "School Match" we respect the privacy of our users (parents, bus supervisors, class supervisors, school admins). This policy explains in detail what data we collect, how we use it, which third parties may process it, and your rights regarding your data. By using the app, you agree to the terms below.

1. Data We Collect

We collect only the minimum data necessary to operate the service:

Account data: name, phone number, email (optional), profile picture (optional).
Child data (entered by the parent or the school): name, grade, school, pickup address.
Precise location data: used only while the bus-tracking screen is open (foreground only) — we do not track your location in the background.
Payment data: processed directly by Stripe Inc. — we do not store card numbers on our servers, only the transaction reference.
Bank-transfer receipts: stored as images on our servers for admin review only.
Push notification token (Expo Push Token): an anonymous identifier used to send notifications to the device.
Diagnostic data (crash logs): anonymous, used to improve stability.

2. How We Use Your Data

We use your data exclusively for the following purposes:

Operating the school transportation service and real-time bus tracking.
Sending operational notifications (bus arrival, payment confirmation, subscription reminders).
Managing subscription and payments (Stripe / bank transfer / cash).
Communicating verification codes (OTP) via WhatsApp/SMS through Infobip d.o.o..
Complying with legal requirements and protecting users.

We do not use your data for advertising, and we never sell or rent it to third parties.

3. Third Parties

We rely on trusted vendors to operate the service:

Stripe Inc. — card payment processing (PCI-DSS Level 1). Stripe policy: stripe.com/privacy
Infobip d.o.o. — delivery of WhatsApp/SMS OTP messages. Infobip policy: infobip.com/policies/privacy
Expo (Universal Aps Inc.) — runs the push-notification service. Expo policy: expo.dev/privacy
CloudPanel / Hetzner — hosting our servers in the European Union under GDPR protection.

4. Data Security

We use HTTPS for all communications, store tokens in Apple Keychain, hash passwords with bcrypt, and enforce strict internal access controls.

5. Data Retention

We retain your data for as long as you use the service. When you delete your account, we delete your personal data immediately, retaining payment records for 5 years for accounting and legal purposes.

6. Account Deletion (App Store Requirement)

You can permanently delete your account from within the app: open "Profile" or "Settings" → "Delete Account" → type "DELETE" (or "حذف") to confirm. Your personal profile and all sessions are deleted immediately. Your children's records remain in the system with the school. For full deletion including children's records, contact: privacy@schoolmatchglobal.com

7. Your Rights

Right to access your data at any time.
Right to correct your data through the profile edit screen.
Right to permanently delete your account.
Right to export your data (contact us).

8. Children's Privacy

The app is intended for parents and adults (rated 12+). We only collect children's data from the parent or the school, and children themselves cannot register accounts. We do not use children's data for advertising or analytics.

9. Policy Updates

We may update this policy from time to time. The latest update date is always shown at the top of this page, and we will notify you of material changes via the app or email.

10. Contact Us

For any privacy-related question or to request a copy of your data: privacy@schoolmatchglobal.com