Privacy policy
Last updated 23 September 2026
This page is in progress.
Who operates SpudBus and a postal address for data requests will be added before any organisation is onboarded. Until then, write to hello@spudbus.com.
Who we are
SpudBus runs transport software for schools and other organisations. For the information an organisation puts into SpudBus, the organisation is the data controller and we process it on their behalf. Their own privacy notice explains why they collect it, and questions about it should go to them first.
We are the controller for enquiries sent through this website, which we hold with your consent, and for our service logs, which we keep to find faults and stop misuse (our legitimate interest). Contact us at hello@spudbus.com.
What we hold and for how long
| What | Details | How long |
|---|---|---|
| Passengers | Name, year group or team, pickup point, and any note for the driver. | While enrolled. |
| Contacts | Name, email and phone of the person responsible for a passenger. | While enrolled. |
| Staff | Name, email, phone and role. | While the account is active. |
| Your sign-in | Your login, once you are no longer connected to any organisation. | 90 days, then deleted. An invitation before then keeps it. |
| Journey records | Who travelled, when and where, including where the driver’s phone was when each was marked. | 18 months. |
| Live bus location | The bus’s latest position during a run, seen by the organisation. Families see an arrival time, not the position. | Until the run ends. |
| Notifications | Alerts sent, such as a bus arriving. | 90 days. |
| Tracking links | A link showing one passenger’s bus, without an account. | Until switched off or expired, then 30 days. |
| Audit log | Who did what in the system, such as approvals and exports. | While the organisation uses SpudBus. |
| Service logs | Requests to our servers and the account making them. | 14 days. |
| Enquiries | What you send through our register-interest form. | Until the enquiry is closed. |
- Personal data held in SpudBus, and how long it is kept
Passengers
Name, year group or team, pickup point, and any note for the driver.
How long
While enrolled.
Contacts
Name, email and phone of the person responsible for a passenger.
How long
While enrolled.
Staff
Name, email, phone and role.
How long
While the account is active.
Your sign-in
Your login, once you are no longer connected to any organisation.
How long
90 days, then deleted. An invitation before then keeps it.
Journey records
Who travelled, when and where, including where the driver’s phone was when each was marked.
How long
18 months.
Live bus location
The bus’s latest position during a run, seen by the organisation. Families see an arrival time, not the position.
How long
Until the run ends.
Notifications
Alerts sent, such as a bus arriving.
How long
90 days.
Tracking links
A link showing one passenger’s bus, without an account.
How long
Until switched off or expired, then 30 days.
Audit log
Who did what in the system, such as approvals and exports.
How long
While the organisation uses SpudBus.
Service logs
Requests to our servers and the account making them.
How long
14 days.
Enquiries
What you send through our register-interest form.
How long
Until the enquiry is closed.
An organisation can ask us to keep records for a different period to match its own policy. We hold no photographs of passengers.
Drivers’ location
A driver’s phone shares its location only while a run is in progress and the driver view is open; it does not run off-shift. We keep only the most recent position, and clear it when the run ends. The one exception is the position at the moment a driver marks a stop or a passenger, which is kept with the journey record and seen only by the organisation’s administrators.
Where it is held
Our database is in London and our servers are in Europe. Supabase, Cloudflare, Vercel, Mapbox and Grafana Labs are US companies; each protects data it handles in the US under the UK Extension to the EU–US Data Privacy Framework or the UK’s International Data Transfer Addendum.
Your rights
You can ask for a copy of your data, and ask for it to be corrected, erased, restricted or given to you in a portable form. Where we rely on consent you can withdraw it at any time.
You can object to any use of your data based on legitimate interests.
For records an organisation holds in SpudBus, ask them — we will help them answer. For anything else, email hello@spudbus.com. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Security and changes
Data is encrypted in transit and each organisation’s records are kept separate. If a breach affects your data we will tell your organisation without delay. We will tell organisations about material changes to this notice before they take effect.