1. Executive Summary

This Privacy Policy provides full transparency on how VortexFleetz collects, processes, protects, and retains personal data within our school transportation platform. Below is a high-level executive summary:

• 🏢 Who We Are: VortexFleetz, an enterprise school bus tracking and student transportation management provider headquartered in Tamil Nadu, India.
• 📥 What We Collect: Account credentials, student enrollment data, driver details, precise real-time GPS location during active trips, device telemetry, and system interaction logs.
• 🎯 Why We Collect It: To facilitate safe student transit, provide real-time bus tracking to authorized parents and school admins, record attendance, and fulfill legal/safety obligations.
• 🤝 Who Receives It: Authorized school administrators, assigned parents/guardians, and vetted infrastructure sub-processors (e.g., cloud hosting, push notification gateways, mapping APIs). We never sell personal data.
• ⏳ How Long We Keep It: Data is retained strictly according to our Data Retention Matrix (e.g., GPS data for 12 months, attendance records for 3 years, active logs for 90 days).
• 🛡️ Your Rights: Access, correction, erasure, export, and processing restriction rights under applicable data protection laws.
• 📧 Contact Us: privacy@vortexfleetz.com for all privacy inquiries and data subject requests.

2. Scope of Policy

This Privacy Policy applies to all digital properties, software applications, infrastructure services, and customer interactions operated by VortexFleetz, including but not limited to:

• VortexFleetz Web Admin Dashboard (accessible via https://www.vortexfleetz.com)
• VortexFleetz Driver Mobile Application (Android and iOS)
• VortexFleetz Parent/Student Mobile Application (Android and iOS)
• Application Programming Interfaces (APIs) and background telemetry engine
• Customer Support and Ticketing Channels
• Future software updates, add-on modules, and platform services

3. Definitions

To eliminate ambiguity, the following technical and legal terms are defined as used throughout this document:

• Personal Data: Any information relating to an identified or identifiable natural person ('Data Subject').
• Processing: Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, transmission, or erasure.
• Data Controller: The legal entity (e.g., the partner School or Educational Institution) that determines the purposes and means of processing student and parent personal data.
• Data Processor: The entity (VortexFleetz) that processes personal data on behalf of the Data Controller under contract.
• School / Client Institution: The educational body subscribing to VortexFleetz services.
• Student: Enrolled pupil utilizing school transportation managed through the platform.
• Parent / Guardian: Authorized individual linked to a student's profile for tracking and alerts.
• Driver: Authorized vehicle operator assigned to a route running the Driver Mobile App.
• Administrator: Authorized school personnel managing routes, vehicles, students, and drivers via the Admin Panel.
• Device: The mobile smartphone, tablet, or workstation accessing VortexFleetz apps or web services.
• GPS Data: Geographic location coordinates (latitude, longitude, speed, heading, timestamp) emitted by driver devices.
• Consent: Freely given, specific, informed, and unambiguous indication of the user's wishes.

4. Data Controller vs. Data Processor Roles

Under global privacy regulations (including GDPR and DPDP Act 2023), data responsibilities depend on the context of collection:

• School as Data Controller: When a school uploads or inputs student profiles, parent details, pickup/drop points, and route assignments, the School is the Data Controller. The school remains responsible for maintaining lawful grounds for processing student data and providing notice to parents.
• VortexFleetz as Data Processor: VortexFleetz acts strictly as a Data Processor regarding institutional student data, processing it solely in accordance with the Data Processing Agreement (DPA) executed with the school.
• VortexFleetz as Data Controller: For direct account creation by website visitors, direct billing relationships, and platform telemetry logs generated for direct website users, VortexFleetz acts as the Data Controller.

5. Company Information & Data Protection Contact

6. Complete Data Inventory

We collect and maintain the following categorized inventory of data elements across user roles:

Category	Data Elements Collected	Target Role
Identity & Profile	Full name, profile photo, school ID, grade/section, user role.	All Users
Authentication	Email address, phone number, hashed password, JWT session tokens.	All Users
Location Telemetry	Real-time GPS coordinates, speed, heading, trip waypoints, geofence logs.	Drivers (Active Trips)
Driver Compliance	Driver license number, license expiry date, assigned vehicle & route logs.	Drivers
Student & Guardian	Student full name, pickup/drop stop, emergency contacts, parent phone & email.	Students / Parents
Operational & Attendance	Boarding timestamps, drop-off timestamps, absent status, route history.	Students / Drivers
Device & Diagnostic	IP address, OS version, device model, app build number, crash logs.	All App Users
System Audit Logs	User login timestamps, admin CRUD actions, account modifications, IP logs.	Administrators

7. Sensitive Personal Data Protections

Certain categories of data processed by our platform are classified as sensitive under privacy statutes, specifically:

• Precise Real-Time GPS Location: Continuous geolocation data is gathered solely during active transport trips.
• Minor / Children Data: Student records for individuals under 18 years of age.
• Transit Attendance Records: Historical logs of student whereabouts during school transit hours.

Enhanced Protections: Sensitive data undergoes enhanced security controls, including restricted role-based authorization (RBAC), TLS 1.3 transit encryption, end-to-end data access isolation per school organization, and zero monetization or advertising integration.

8. Device Permissions Requested

The VortexFleetz mobile applications require specific device permissions to execute safety-critical operations:

Permission	App Context	Explicit Purpose
ACCESS_FINE_LOCATION	Driver App	Capture high-precision GPS coordinates during active school bus trips.
ACCESS_BACKGROUND_LOCATION	Driver App	Ensure continuous route tracking when the driver app is minimized or phone screen is off.
POST_NOTIFICATIONS	Parent & Driver App	Deliver real-time bus proximity alerts, stop notifications, and emergency broadcasts.
CAMERA	Driver App	Allow drivers to scan QR codes for student boarding/attendance verification (optional).
READ_PHONE_STATE	Driver App	Maintain network connection stability and reconnect telemetry web sockets.

9. GPS & Background Location Lifecycle

Precise background location tracking in the Driver Mobile App operates under strict lifecycle controls:

• Tracking Activation: GPS location transmission starts ONLY when a driver explicitly taps "Start Trip" within the Driver App.
• Background Execution: When a trip is active, location transmission persists seamlessly even if the driver switches apps or locks the screen, preventing route loss.
• Automatic Deactivation: Location transmission immediately and permanently terminates when the driver taps "End Trip", logs out, or cancels the route session.
• Offline Buffering: If cellular network coverage is lost during a trip, telemetry points are securely stored in local encrypted storage and synced back to servers upon reconnect.
• Battery & Optimization Safeguards: Intelligent location sampling adjusts update intervals dynamically based on movement speed to prevent excessive battery depletion.

10. How We Use Personal Data

We process personal data strictly for legitimate operational purposes:

• Core Service Delivery: Transmitting live bus tracking, ETA calculations, geofence alerts, and route progress to authorized parents and admins.
• Student Transit Safety: Confirming student boarding/alighting events and assisting emergency responses during transit incidents.
• Platform Operations & Security: Verifying user identity, monitoring API performance, managing session security, and preventing fraudulent access.
• Institutional Reporting: Providing aggregated trip duration, fuel compliance, and attendance reports to subscribing school management.

11. Legal Basis for Processing (GDPR & Global Standards)

For each processing activity, our legal basis is mapped in accordance with GDPR Article 6 and international privacy laws:

Processing Activity	Legal Basis
User Authentication & Login	Performance of a Contract
Driver GPS & Telemetry Tracking	Legitimate Interest / Contractual Obligation
Student Attendance Management	Performance of a Contract (School Terms)
Push Notifications & Safety Alerts	Performance of a Contract
App Performance & Crash Analytics	Legitimate Interest
Optional Marketing Communications	Explicit Consent

12. Data Sharing and Disclosure

VortexFleetz does NOT sell, rent, or monetize personal data under any circumstances. Data is shared exclusively with the following parties:

• Authorized Platform Users: Parents can view location data ONLY for the bus assigned to their child's specific route. School Admins can view data within their tenant organization.
• Vetted Sub-Processors: Third-party infrastructure partners bound by strict Data Processing Agreements (see Section 13).
• Legal & Regulatory Authorities: Where mandated by enforceable law enforcement requests, court orders, or statutory regulations.

13. Third-Party Vendors & Sub-Processors

We partner with enterprise cloud and technology providers to deliver service functionality:

Vendor	Service Provided	Data Shared
Google Maps Platform	Map rendering, route polyline, and distance matrix API.	Anonymized GPS coordinates.
Firebase Cloud Messaging (FCM)	Push notification delivery for Android devices.	Device push token, alert payload.
Apple Push Notification Service (APNs)	Push notification delivery for iOS devices.	Device push token, alert payload.
Cloud Hosting Providers	Secure cloud server infrastructure & database hosting.	Encrypted database storage.

14. International Data Transfers

Primary data processing for VortexFleetz occurs in India. Where cross-border data transfers occur, we enforce robust transfer mechanisms including European Commission Standard Contractual Clauses (SCCs), strict data encryption in transit (TLS 1.3), and binding contract terms with all international vendors.

15. Layered Security Architecture

We deploy a 7-layer defense-in-depth security model to safeguard all platform assets:

1. Layer 1 — Physical Security: Data centers featuring 24/7 physical security, biometric access controls, and surveillance.
2. Layer 2 — Network Security: Firewalls, DDoS protection, and TLS 1.3 protocol encryption for all data in transit.
3. Layer 3 — Authentication: Cryptographically signed JWT tokens, Argon2/bcrypt password hashing, and session timeout controls.
4. Layer 4 — Authorization: Strict Role-Based Access Control (RBAC) ensuring tenant data isolation.
5. Layer 5 — Database Security: Data encryption at rest and isolated schema/tenant boundaries.
6. Layer 6 — Monitoring & Audit: Real-time security telemetry, automated anomaly detection, and centralized system logs.
7. Layer 7 — Encrypted Backups: Automated daily backups stored offsite with strong cryptographic protection.

16. Technical Security Practices

Our engineering and operations teams adhere to industry technical security controls:

• Password Hashing: Strong password hashing algorithms (Argon2 / bcrypt with high work factor).
• Token Expiry & Revocation: Short-lived JWT access tokens paired with secure refresh token revocation lists.
• Rate Limiting: Automated API rate limiting against brute-force and credential stuffing attacks.
• Input Sanitization: Strict parameter validation and parameterized queries preventing SQL injection and XSS vulnerabilities.
• Patch Management: Continuous dependency scanning and vulnerability patching across production servers.

17. Incident Response Lifecycle

In the event of a suspected or confirmed data security incident, VortexFleetz executes a structured 6-stage response protocol:

72-Hour Breach Notification: Where required by applicable law (such as GDPR or DPDP Act 2023 rules), VortexFleetz will notify affected institutions, users, and relevant data protection authorities within 72 hours of becoming aware of a personal data breach.

18. Data Retention Matrix

Personal data is retained only for as long as required by operational, legal, and educational record-keeping standards:

Data Category	Retention Period	Purge Action
GPS & Location Logs	12 Months	Automated DB row purge / aggregation
Student Attendance Records	3 Years	Archived then securely deleted
Driver Records & Logs	3 Years post-offboarding	Permanent file erasure
System Audit & Security Logs	90 Days	Rolling log rotation purge
Encrypted System Backups	30 Days	Rolling backup overwrite cycle

19. Account Deletion Lifecycle

Users and administrators can initiate account deletion through self-service app controls or by contacting privacy officers:

In-app account deletion is accessible via app settings or at https://www.vortexfleetz.com/delete-account.

20. User Rights Matrix

Right	Description	Availability
Right of Access	Request copy of personal data held.	✓ Available
Right to Rectification	Correct inaccurate or incomplete profiles.	✓ Available
Right to Erasure	Request permanent deletion of data.	✓ Available
Right to Data Portability	Export personal data in JSON/CSV format.	✓ Available
Right to Restrict Processing	Limit how data is used in disputed cases.	✓ Available
Right to Object	Object to legitimate interest processing.	✓ Available

21. Children's Privacy (Student Data Safeguards)

As a school transportation platform, student privacy is our highest priority:

• No Student Accounts: Students do not independently register or maintain accounts on the platform. All student records are configured by verified school admins or parents.
• Strict Ad Ban & No Profiling: We do not show advertisements, build commercial behavioral profiles, or trade student data.
• COPPA & International Compliance: We adhere to the US Children's Online Privacy Protection Act (COPPA) guidelines and international student privacy frameworks.

22. Cookies & Tracking Technologies

The Web Admin Panel uses minimal cookie classification for secure session management:

• Essential Cookies: Required for user session verification and CSRF token defense.
• Preference Cookies: Store dark/light theme choices and language preferences.
• Analytics Cookies: Anonymized metrics on admin panel usage to improve UI workflows.

23. Automated Decision Making

VortexFleetz does NOT subject users to decisions producing legal or similarly significant effects based solely on automated processing or profiling.

24. Audit Logs & Accountability

For administrative transparency and security compliance, the platform records detailed audit trail entries containing:

• Admin user ID and action performed (Create, Read, Update, Delete)
• Timestamp of operation
• Originating IP address and user-agent string
• Affected record identifiers (e.g., student ID, vehicle ID)

25. Backup & Disaster Recovery

To ensure high availability and data durability, VortexFleetz maintains automated backup schedules:

• Backup Frequency: Daily automated database snapshots with point-in-time recovery capabilities.
• Disaster Recovery Targets: Recovery Point Objective (RPO) < 1 hour; Recovery Time Objective (RTO) < 4 hours.
• Testing: Periodic automated backup integrity and restore simulation testing.

26. Business Continuity

Our platform architecture is built with redundancy across server zones. In the event of primary cloud host disruption, automated failover procedures redirect network traffic to standby infrastructure to preserve live tracking uptime for school buses in transit.

27. School & Institutional Responsibilities

Subscribing schools and educational institutions using VortexFleetz agree to:

• Maintain accurate, up-to-date student rosters and driver assignments.
• Secure administrator account credentials and enforce strong passwords within their organization.
• Provide required privacy disclosures and secure necessary parental authorizations where acting as Data Controller.
• Promptly revoke access for offboarded staff or drivers.

28. Regulatory Compliance Matrix

Regulation / Standard	Applicability	Compliance Status
Digital Personal Data Protection Act, 2023 (India)	Primary Jurisdiction	✓ Fully Compliant
General Data Protection Regulation (GDPR)	Global Users / EEA	✓ Compliant
Children's Online Privacy Protection Act (COPPA)	Student Data Handling	✓ Compliant
Google Play User Data Policy	Mobile Apps	✓ Supported & Verified
Apple App Store Privacy Guidelines	Mobile Apps	✓ Supported & Verified

29. Modifications to This Policy

We may update this Privacy Policy periodically to reflect technological advancements, legal amendments, or operational changes. Material updates will be announced via website notice, app notification, or direct email prior to taking effect.

30. Version History

Version	Effective Date	Key Changes / Summary
v1.0	June 20, 2026	Initial Privacy Policy release.
v1.1	August 4, 2026	Expanded to 30 enterprise sections; added DPDP Act 2023 compliance, Data Controller vs Processor mapping, 7-layer security architecture, retention matrix, and audit logging specifications.

— End of Privacy Policy —