Privacy

Privacy Policy — Rawabi English Academy

Version 1.2 · Effective: 2026-07-13 · Last updated: 2026-10-09

1. Who we are

This app is operated by Rawabi English Academy ("the Company", "we"). This policy explains how we collect, use and protect your data when you use the Schools app (parent, supervisor and driver apps) and related services (servers, APIs and the admin console).

Privacy contact: privacy@pal-tech.ps · Support: support@pal-tech.ps · Website: www.pal-tech.ps

2. Data we collect

Account data

• Name, username, email, phone, photo (optional), role, school/organization, and user ID.
• Passwords are stored hashed and never kept in plain text.

Student data (provided by the parent or school)

• Name, grade, school ID, parent, bus, route, pickup/drop-off stops, boarding status and trip history.

Location data

• The app receives the bus location from its installed tracking device through the server to show the bus on the map, compute estimated time of arrival (ETA), and send approach and safety alerts.
• The Android app does not collect the parent or supervisor phone location and does not track the user's location.

Device and technical data

• Device model, Android version, app version, language, and the notification token (FCM Token).
• Sign-in logs and time, IP address and login attempts, crash/diagnostic logs, and security audit logs.
• In-app usage events (such as opening the map or viewing the arrival estimate), sent only to our own servers to improve the service and never shared with advertising or third-party analytics providers.

Payment data (when the payment feature is available)

• We store only: transaction ID, amount, currency, status, date and the reference from the payment gateway.
• We do not store the full card number or CVV; card data is processed by the specialized payment gateway.

3. Purposes of processing

• Account creation, identity verification, and management of users and schools.
• Operating school transport: live tracking, ETA, boarding/drop-off logging, bus and route management.
• Sending operational and emergency notifications, technical support, fraud prevention and intrusion detection, and audit logging.
• Processing payments (where available) and complying with legal requirements.

We do not use your data for purposes not stated here, and we do not use student data for marketing or targeted advertising.

4. Data sharing

We do not sell your personal data. We may share it, only as needed to operate the service, with:

• Your school/organization and authorized parents, supervisors and drivers — strictly per permissions.
• Service providers acting on our behalf: Firebase (notifications), the maps provider, HotSMS (SMS text messages), the email provider, the hosting provider, and the payment gateway.
• Legal authorities where a legal obligation exists.

We enforce strict tenant (school) isolation, so one school's data never reaches another.

5. Biometric authentication (fingerprint/face)

When biometric sign-in is enabled, verification is performed by the device operating system via BiometricPrompt, and an encrypted key is stored in the Android Keystore on your device. We never collect or store your fingerprint image or biometric template on our servers. You can disable biometrics at any time in the app settings.

6. QR and NFC

QR/NFC scanning is used to verify student boarding and to link the supervisor/bus to a trip. Short-lived identifiers/tokens are used, no sensitive data is placed directly in the code, and the action is recorded within the current trip context.

7. Data security

We apply appropriate technical and organizational measures including: encryption in transit (HTTPS/TLS), password hashing, secure token storage, Android Keystore, role-based access control (RBAC), tenant isolation, rate limiting, and audit logging. No system can guarantee 100% security, but we work to protect your data against unauthorized access, loss or unlawful disclosure.

8. Data retention

• User account: active while you are linked to the school; when the relationship ends the account is deactivated and archived, not deleted.
• Live location and trip history: per operational need, school policy and law.
• OTP codes: minutes · Security logs: a defined period · Payment records: per financial requirements.

9. Children and minors

The app is not intended to let children create independent accounts. Student data is processed through the school or parent for transport management and safety only. We minimize data, and prohibit child-targeted advertising and sharing children's data for commercial purposes. A parent may review or correct a student's data via the school or the contact below. Student records are part of the school's records: when a student leaves, they are archived, not deleted.

10. Your rights

• Access and correct your data, request deactivation of your account, and object to or restrict certain processing.
• Withdraw consent, obtain a copy of your data, and lodge a complaint.

11. Account deactivation and archiving

Accounts are created and managed by your school; the app does not offer sign-up. To stop using the service, request deactivation of your account via privacy@pal-tech.ps or through your school. Once the request is processed you can no longer sign in. Data is not deleted: account, student, trip, attendance, message and payment records are kept in the school's archive for transport management, safety, financial and legal requirements, and remain protected by the measures in section 7.

12. International data transfers

Some data may be processed outside your country (e.g. Firebase infrastructure and international messaging providers), with appropriate contractual and technical safeguards applied.

13. Changes

We may update this policy; we will update the "Last updated" date above and notify you of material changes where appropriate.

14. Contact

For any privacy inquiry: privacy@pal-tech.ps