Privacy Policy

Who operates this service

ZENNIFI LLC builds and operates the software. The bus committee is a group of volunteer parents who run the bus routes. We are not a school, we are not operated by a school, and no school administers this service or has access to it. Guardians enroll their own children directly with the bus committee, and consent for everything described in this policy comes from the child's own guardian rather than from a school acting on a guardian's behalf.

Information we collect

From guardians, when they enroll and use the service:

• Guardian name, mobile phone number, and email address
• The relationship of each guardian to each child, and whether that guardian can make changes or only view
• SMS consent, the date and time it was given, and the version of the notice that was shown
• Absence marks and notes a guardian enters for a run, such as "not riding home today"
• If you book a guest seat, the booking and whether it was paid. Stripe takes the card payment; we never see your card number

About children, provided by their guardian or the committee:

• Name and preferred name, grade, and campus
• Assigned bus, home stop, and the runs the child normally rides
• An optional roster photograph, used so a monitor and the child can identify the right face on the bus screen
• Standing notes the guardian or committee chooses to record, which may include allergies, medical needs, or seating needs
• Daily ridership status for each run, such as expected, not riding, boarded, or not accounted for, with the time it was recorded and who recorded it
• Seat assignment, once seating is in use
• Safety notes a bus monitor records (what happened, when, and where), any safety photo the monitor takes, and any dispute a guardian sends about a note
• About a guest child a guardian brings as a friend: first and last name, grade, and campus, described below under "Guest riders"

Directly from children, when the bus device is in use:

• The time and the stop each time the child taps on or off the bus, described in detail in the next section

That is the entire list. Children do not have accounts, do not sign in, cannot enter free text, and are never asked for contact details. The bus device is a phone or tablet that belongs to the bus, used under the supervision of an adult monitor.

From devices, automatically:

• Standard technical information needed to serve the application, such as the browser type and the pages requested
• Location of the bus device during an active run, once live tracking is in use. This is the position of the bus, not of any child and not of any guardian. We do not collect location from guardian phones.

Children's privacy and parental consent

This service exists to keep track of children, so nearly everything in it is information about a child under 13. We take the following approach, which is written to meet the Children's Online Privacy Protection Act.

• Consent comes from the guardian, before collection. A child is added to the service by their own guardian or by the committee at that guardian's request. Before any information about a child is collected, the enrolling guardian is shown a plain-language notice covering what is collected, who can see it, and how long it is kept, and must affirmatively agree. We record the date, the time, and the exact version of the notice that guardian agreed to. A notice nobody agreed to is not consent, which is why we keep that record.
• We collect no more than we need. Participation in the bus program is never conditioned on a guardian providing more information than is reasonably necessary to put a child on a bus and tell that guardian about it. The roster photograph is optional. Standing notes such as allergies are entered by the guardian or the committee because they matter on the bus, not because we require them.
• Guardians can review what we hold. A guardian may ask us for a copy of everything we hold about their child, correct anything wrong in it, and see who has access to it.
• Guardians can refuse further collection and delete. A guardian may tell us to stop collecting information about their child and to delete what we already have. We honor deletion requests when they are made rather than only on an automatic schedule. If deletion means the child can no longer be carried on the bus roster, we will say so plainly before we act.
• We do not disclose children's information to anyone outside the bus committee and the service providers listed below, and we never disclose it for advertising, marketing, or profiling of any kind.

To exercise any of these rights, contact us at the address at the bottom of this page. We will verify that the request comes from a guardian on that child's record before we act on it.

How we use this information

We use it only to run the bus service:

• Building the daily list of who is expected on each run
• Letting guardians mark a child as not riding, and letting monitors and admins record who actually boarded
• Showing a monitor the roster, the standing notes, and the seat map for their own bus (or, for a substitute monitor, for whichever bus they cover)
• Taking card payments for guest seats
• Sending guardians the notifications described below
• Showing guardians the live position and estimated arrival of their child's bus while a run is in progress
• Keeping an audit record of who changed what and when, so that a disagreement about what happened can be settled from the record
• Keeping the service secure and diagnosing failures

We do not use this information for advertising. We do not build marketing profiles. We do not use children's information to train machine learning models.

Text messages

Guardians who opt in receive text messages tied to their own child's bus runs: ridership reminders, departure and arrival notices, boarding confirmations, delay alerts, notices if a child is not accounted for at departure, and occasional committee broadcasts about the bus service.

Message frequency. On a typical school day this is a small number of messages, most commonly a ridership reminder plus a departure and an arrival notice per run. The exact count varies with how many children a guardian has enrolled and whether a delay, route change, or other disruption occurs that day. We do not send unrelated or promotional messages.

Message and data rates may apply.

Reply STOP at any time to stop receiving text messages. Reply HELP for help, or contact us at the address below. Mobile phone numbers and SMS consent are never shared with or sold to any third party for marketing.

Stopping text messages does not remove your child from the bus roster and does not change anything about their ride. It only stops SMS delivery, so if you opt out we encourage you to keep another way of receiving bus information, such as notifications in the app.

Email alerts

If you have signed in to Zennifi Bus and we cannot reach you in the app or by text message, we email three kinds of message to the address on your account: committee announcements, delay alerts, and safety alerts about your own child. We send nothing else by email except sign-in codes, and never anything promotional. If a message reached you in the app, we do not also email it. You can turn email alerts off for each kind of message on the “How we reach you” page in the app, which every alert email links to. We do not email a guardian who has never signed in.

Who else handles this information

We use a small number of service providers to run the service. Each one processes information only on our instructions, only to provide the service to us, and is not permitted to use it for its own purposes, to sell it, or to build advertising profiles from it.

• Supabase hosts our database, our sign-in system, and the stored images: the roster photographs you upload and any safety photos. Everything described in this policy is stored there.
• Vercel hosts and serves the application itself and runs the scheduled jobs.
• Twilio delivers our text messages. Twilio receives the guardian phone number and the message content, which can include a child's first name and their bus status.
• Resend delivers the email we send: sign-in codes, and the email alerts described above. It receives your email address and the message, which for a safety alert can include your child's name.
• Mapbox works out drive times for the estimated arrival. It receives bus positions and stop locations. It never receives a child's name or a guardian's contact details.
• Stripe takes card payments for guest seats. Card details go straight to Stripe and never touch our servers. Stripe is told the bus, the date, the seat, and a booking number, never a child's name.

The live bus map's background images come from OpenStreetMap. Your phone loads them directly, the same way any website map does, so OpenStreetMap sees your device's internet address and the map area shown. It is not sent any name.

When the app sends a push notification to a phone, delivery is relayed by the browser or device maker's push service, such as Apple's or Google's. The message content is encrypted before it leaves our servers, so that relay carries the notification without being able to read it.

We do not use an outside error-monitoring service today. If we turn one on, we will name it here first.

Beyond these providers, we disclose information only to the bus committee staff who need it, to a guardian about their own child, or where we are legally required to do so. All of these providers store data in the United States.

How long we keep information

• Bus position history: thirty days. Positions recorded during runs are deleted after thirty days.
• Who rode, when they tapped on and off, and who was marked as not riding. Kept with your child's ride history, and deleted when you ask us to delete your child's information. When a child is withdrawn from the roster, their ride history is kept; nothing is deleted until you ask.
• Safety photos: until the end of the school year, unless a dispute is open or the committee keeps one for a serious incident. Safety notes: kept with your child's ride history; a note the committee deletes is erased.
• A guest rider's name, grade, and campus: deleted after the school year of the ride ends, or right away if the host child's information is deleted. The seat, the payment, and the count of guest seats are kept.
• A tag's serial number. Kept while the tag is in use. A lost or replaced tag stays on record as switched off, so past rides still make sense.
• Audit records: retained for dispute resolution. The record of who changed what and when is retained so that a contested account of a day can be checked against it.
• Roster information and guardian contact details are kept while a child is enrolled, and are deleted or de-identified after enrollment ends unless a guardian asks us to keep them for re-enrollment or the law requires otherwise.
• SMS consent records are kept for as long as we may need to show that consent was given, which is required of us as an SMS sender.

One honest caveat: our database has point-in-time recovery backups, so deleted information can persist in those backups for a short recovery window before it ages out of them. We do not restore backups to recover data a guardian asked us to delete.

Your rights and how to use them

A guardian may, at any time:

• Access. Ask for a copy of the information we hold about them and about their child.
• Correct. Ask us to fix anything inaccurate, including a name, a phone number, a bus assignment, or a standing note.
• Delete. Ask us to delete their child's information, or their own.
• Withdraw consent. Withdraw consent to text messages, to the roster photograph, or to the service as a whole.
• Object. Tell us to stop a particular use, and get a straight answer about whether the service can still work for their child if we do.

Email us at yossi@zennifi.com or write to the address below. We will confirm that you are a guardian on the child's record before acting, and we will tell you what we did.

Withdrawing SMS consent does not remove your child from the bus program. Replying STOP stops text messages to that number and nothing else. Your child keeps their seat, their stop, and their place on the roster.

How we protect information

We will describe our security honestly rather than impressively.

• Access is scoped by role. A guardian can see only their own children. A bus monitor can see only the students on the bus they are assigned to, and only for current and upcoming runs. A substitute monitor, who can be sent to cover any bus, can see the whole roster, including standing notes, while they are a substitute. An administrator can see their own organization. These limits are enforced on the server, not merely by hiding buttons in the interface, so a request replayed by hand is rejected the same way.
• Tenant isolation. Every record carries the identifier of the organization it belongs to, every query is bound to the caller's organization, and database-level row security policies sit underneath that as a second layer for the paths that browsers reach directly, including stored photographs. We test that one family cannot read another family's data, and that one organization cannot read another organization's data, on every database change.
• Encryption in transit. All traffic between your device, the bus device, and our servers uses HTTPS. Our hosting providers encrypt stored data at rest on their managed infrastructure.
• Undo requires an adult. On the bus device a child can only check themselves in. Reversing a check-in requires the monitor's PIN.

What we do not claim: we hold no security certification, we have not completed a SOC 2 or ISO audit, and we do not claim that any system is impossible to breach. No online service can promise that. If a breach affecting children's information ever occurs, we will notify affected guardians directly and promptly rather than burying it.

Changes to this policy

If we change this policy, we will update the date at the top of this page. If the change is material, meaning it affects what we collect about a child, how we use it, how long we keep it, or who else sees it, we will notify guardians directly by text message or in the app before the change takes effect, and where the law requires fresh parental consent we will ask for it rather than assume it.

Governing law

This policy and any dispute about it are governed by the laws of the State of Florida, without regard to its conflict-of-laws principles.

Contact us

For any privacy question, to review or correct your child's information, or to request deletion, contact us at yossi@zennifi.com, or by mail at:

ZENNIFI LLC
818 NE Second Ct
Hallandale Beach, FL 33009

See also our Terms of Service and our SMS Consent Notice.