Privacy Policy

Who we are

RouteNest provides vehicle tracking for schools, colleges, companies and transport operators, and location sharing for families and private groups. RouteNest is operated by:

RouteNest, a company registered in India

This policy covers the RouteNest Android app, the RouteNest parent web page and the RouteNest servers. It applies wherever you use RouteNest. Where the law of your country gives you more rights, those rights apply.

Our role

• Your own account (as a family or group member, individual driver, or person who signs up): we decide how your data is used, so we are the data fiduciary (India) or data controller (EU/UK).
• Data a school, company or transport operator puts into RouteNest (its staff, drivers, students or passengers): that organization decides how it is used and is the data fiduciary or controller. We process it for them, following their instructions, as their data processor. Requests about that data are best sent to the organization; we will help them respond.

What we collect

• Account details: your name, email address, role (admin, driver, parent or member) and the organization you belong to.
• Contact form messages: if you write to us from routenest.co.in, the name, email, organization and message you send, used only to reply to you.
• Driver location: while a driver has a trip running, the driver's phone sends its precise location, speed and heading, including while the screen is off, while the app is closed or not in use, and after the phone restarts if the driver allows location all the time. A notification is shown for the whole trip, and sending stops when the trip ends.
• Family and group location: only while you turn on sharing. Private Group sharing stops automatically after the time you choose; Family sharing continues until you stop it. A notification is shown while sharing is on.
• Students and passengers: organizations enter the names and pickup locations of the people they transport.
• Device information: a push notification token so we can send trip alerts.
• Messages and activity: messages you send through Contact us, and a record of changes admins make (for example adding a vehicle).
• Payments: subscriptions bought in the app are processed by Google Play. We receive confirmation of the purchase, never your card or bank details. Organizations paying by invoice give us billing contact details.

Your phone's location is only sent to us during a trip, while you share it, or when you choose to use it (for example to place a school's map pin). We do not collect contacts, photos or files from your phone.

Why we use it, and on what basis

• To provide the service you or your organization signed up for (showing vehicles and shared locations, arrival times, trip notifications, accounts and support). Under the GDPR this is performance of a contract; under India's DPDP Act it is your consent or a legitimate use you have requested.
• Location sharing is based on your consent, which you give each time you start a trip or turn on sharing, and can withdraw at any time by stopping it.
• To keep the service secure and working (preventing misuse, fixing faults, counting map usage). Under the GDPR this is our legitimate interest.
• Emails about your account: verifying your email and resetting your password, and for organization admins a few emails during the free trial (setup tips, a first-week summary and when the trial ends). Every trial email has an unsubscribe link. Under the GDPR this is our legitimate interest.
• To meet legal obligations, such as tax records for paid plans.

We do not sell your data, use it for advertising, build profiles for marketing, or share it with data brokers.

Who can see it

• A vehicle's location is visible to that organization's admins and to parents or viewers linked to students on that vehicle.
• A shared family or group location is visible only to members of that family or group.
• Our support staff can see the data needed to answer your message.
• We may disclose data if the law requires it, for example a valid order from a court or government authority.

Service providers and international transfers

• Render hosts our servers in Singapore, and a cloud database provider hosts our database.
• Google Firebase handles sign-in and push notifications.
• Google Maps and Mapbox show maps and calculate road routes. To estimate arrival times, vehicle and stop coordinates are sent to them. Names are never sent.
• Google Play processes in-app subscription payments.
• Resend sends our emails, so it receives your name and email address.

Your data may therefore be stored and processed outside your country, including in Singapore, the United States and other countries where these providers operate. We use providers that protect data under contract. For transfers of personal data from the EU, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or an equivalent safeguard. Transfers from India follow the DPDP Act and any restrictions the Government of India sets.

How long we keep it

• Trip GPS history is deleted automatically after 7 days.
• Each vehicle's last known location is kept so admins can see where it was last; it is deleted with the vehicle.
• Family and group locations are removed as soon as sharing stops.
• Account details, students, support messages and admin activity are kept until the account or organization is deleted, or the organization asks us to delete them.
• Billing records are kept for as long as tax law requires.

Children

RouteNest is used by adults: school and company staff, drivers, parents and group members. Children do not use the app and must not create accounts. Schools and operators enter student names and pickup locations to run their transport. As the data fiduciary or controller for that data, the organization is responsible for having a lawful basis and, where the law requires it (including verifiable parental consent under India's DPDP Act for anyone under 18), the consent of a parent or guardian. We use children's data only to provide transport tracking for that organization: never for advertising, profiling, or tracking children's behaviour.

Parents can ask their school to correct or remove their child's details, or contact us and we will pass the request on.

Your rights

Depending on where you live, you can:

• get a copy of your personal data and information about how it is processed;
• correct or complete inaccurate data;
• delete your data, or your whole account (see below);
• withdraw consent at any time, for example by stopping location sharing, without affecting earlier processing;
• object to or restrict processing, and receive your data in a portable format (EU/UK);
• nominate another person to exercise your rights if you die or become incapacitated (India);
• complain to a regulator: the Data Protection Board of India, or your local data protection authority in the EU/UK.

To use these rights, use Settings → Contact us in the app. We reply within 30 days. We may need to confirm your identity first.

Deleting your account and data

You can delete your account in the app under Settings → Delete account (Settings is in the ⋮ menu). See how to delete your account for what is removed and how to ask us if you cannot use the app.

Security

All data is sent over encrypted connections (HTTPS), access codes are stored encrypted, and each organization can only see its own data. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

Grievance Officer

Under India's Information Technology Act 2000 and the DPDP Act 2023, you can raise any complaint about how we handle your personal data with our Grievance Officer:

Our Grievance Officer, RouteNest

We aim to resolve complaints within 30 days.

Changes to this policy

If we make important changes, we will tell you in the app before they take effect. The date below shows when this policy last changed.