Privacy policy

Last updated: October 16, 2026 · Version 2026-10b

RutaSegura is an app and website for following school transportation. Students' locations and data are sensitive, and we treat them that way. This policy explains who decides about the data, what data we use and why, who we share it with, how long we keep it, how we protect it and how you can exercise your rights.

Laws we follow: Law 81 of March 26, 2019 on Personal Data Protection and its regulation, Executive Decree 285 of May 28, 2021; Law 51 of July 22, 2008 (electronic documents and commerce); and Law 45 of October 31, 2007 (consumer protection), all of the Republic of Panama.

1. Who we are and who decides about the data

There are two kinds of data:

• Transportation service data (students, families, bus monitors, drivers, buses, routes, attendance and location). It is entered and managed by the school or transportation company that hires RutaSegura (the "Client"). The data controller is the school, the transportation company or both, each for what it decides (for example, the school for its students' data and the company for its routes, buses and staff): they decide what the data is used for, who sees it and how long it is kept. If both decide about the same data, they must agree on and communicate each one's role. RutaSegura is the data processor: it processes the data only on the Client's behalf and following its instructions, to provide, maintain and protect the service.
• RutaSegura's own data (business and billing contacts with Clients, support requests, technical and security records of the platform). For this data, GR Multiservicios PTY, S.A. is the controller.

If your question is about a route's or a student's data, you can contact the school or transportation company, or write to us: we will handle it together with them.

2. Who uses RutaSegura

The app is used by families (parents, guardians and the relatives they invite), bus monitors and drivers, the transportation company's coordinators and office staff, and school staff with the permissions coordinators give them. Accounts are created by the Client or by invitation; there is no open sign-up.

3. What data we use

From families (parents, guardians and invited relatives)

• Name, email, mobile number, language and, if you turn on WhatsApp alerts, your WhatsApp number.
• The requests you send: route or stop changes, cancellations, absences and their reason, and vacations.
• The alert zones you save on the map (name, point and radius).
• The relatives you invite: their name, email and relationship.
• Your answers to transportation surveys, if you choose to answer them.
• If the transportation company charges through the app: your ID or passport number, and the company name and tax ID if you want the receipt issued to a company; payments, receipts and, if you pay by bank transfer, the proof you upload. We never store your card number: you enter it directly on the bank's secure page.
• Your acceptance of this policy (date and version) and any privacy requests you make.

From students (minors)

• Name, school, grade, route, bus, assigned stop and, if the Client adds it, a photo.
• Each trip's records: whether they boarded, at what time, where they got off and whether they were dropped off; and on field trips, the trip there and back.
• Absences and changes requested by their guardians, with the reason they write.
• Behavior notes during the trip, when the bus monitor records them (the school only sees the ones coordinators approve).
• Emergency contacts and people authorized to pick them up: name, relationship, phone, ID number and photo.
• On a field trip, the bus monitor may add a child who is not in the system by name only, to keep a record of who was on the bus. That name does not become an account and receives no alerts.

From staff (bus monitors, drivers, coordinators, office and school staff)

• Name, email, mobile number, user type, permissions and assigned bus or route.
• The bus location during the route and the location they share with coordinators (see section 6).
• Bus speed, traffic and unplanned stops, incident reports, bus inspections (mileage, lights, tires, oil), maintenance and vehicle documents.
• The end-of-route check (whether a child or an object was left on the bus) and, if taken, the photo.
• For office staff: the two-step verification method (we do not see or store the codes on your phone).

Photos

• Photos of people authorized to pick up, uploaded by guardians or coordinators.
• Evidence photos taken by the bus monitor at a stop (with time and place) and photos of route reports, incidents and the end-of-route check.
• Photos of bus inspections and documents (for example, the insurance policy or vehicle registration).
• The app only uses the camera when you tap "Take photo" and only uses the photo you choose; it does not read your gallery.

Technical and security data

• The identifier used to send notifications to your phone and the platform (Android, iPhone or web).
• On bus monitors' and drivers' phones, while the app is open: brand, model, system and app version, battery and last known location, so coordinators know the device is ready.
• App crash reports (without names, emails or locations).
• Sign-in records, anti-bot check records and staff actions (for example, who changed a route).

We ask Clients not to enter sensitive data or more information than necessary about students and their families.

4. Where the data comes from

Data is entered by the Client's coordinators or staff (including uploads from Excel), provided by families and staff when using the app, or generated by the bus phone during a route (location, boarding and drop-off times). When data does not come directly from you, the Client must inform you and keep it up to date.

5. What we use it for

• Showing families and coordinators where the bus is, the route and how long until it arrives.
• Notifying families when the bus starts the route, is close or has arrived, when their child boards, does not board or is dropped off, if there is traffic, and on field trips when they are on board, arrive and return.
• Taking attendance, organizing routes and stops, and managing changes, absences, vacations and field trips.
• Letting the bus monitor know who each student can be handed over to.
• Service safety: speeding alerts, traffic, stopped buses, incident reports, end-of-route check, bus inspections and documents, replacement buses and punctuality.
• Satisfaction surveys sent by the Client to families.
• Charges and receipts for monthly fees and trips, when the Client turns them on.
• Translating coordinators' messages into English for families who use the app in English.
• Secure sign-in, preventing improper access, support, fixing errors and complying with legal obligations.

We do not use service data for advertising, sell it, build commercial profiles of minors or use it for our own purposes unrelated to the service. If we ever wanted a new use, we would tell you and, when the law requires it, ask for separate consent.

6. Location

• Bus location: taken from the bus monitor's or driver's phone only while the route is in progress, every few seconds, also with the app closed or the screen off. On Android a persistent notification is shown while it is being sent. It turns off automatically when the route ends.
• Traffic: if the bus is almost stopped for a few minutes away from a stop, its location and the next stop's are checked with map services to find out whether there is traffic or a traffic light, so families can be notified.
• "Share my location" (bus monitors and drivers): if turned on, their location is sent to coordinators until they tap "Stop sharing"; it turns off automatically after 12 hours at most.
• Service phones: while a bus monitor's or driver's app is open, the phone's last known location is recorded (see section 3).
• Families: the app does not send your location continuously. It only uses it if you tap "Use my current location" when creating an alert zone.
• Families only see their children's bus and only while it is on the route. Stops and homes are not published or freely searchable. Tracking staff outside the service is not allowed.
• Location depends on the phone's GPS, signal and battery: it may be delayed or interrupted, and it is not a guarantee of arrival or drop-off.

7. Notifications, email and WhatsApp

The app asks for permission to send you notifications. You can turn them off in your phone's settings, but then you will not receive boarding, arrival and proximity alerts. Some notices also arrive by email (for example, an approved change, a receipt or an invitation). WhatsApp alerts are only sent if you turn them on, and you can turn them off at any time. All notices are about the service: we do not send advertising.

8. Minors

RutaSegura is not directed at children; students do not have accounts or carry any RutaSegura device. Their data is entered by the Client or by their parents or guardians, with the authorization of their parents or guardians, given when they accept this policy in the app. We apply reinforced protection: only the necessary data is used and it is only seen by:

• Their parents or guardians and the relatives they invite (invited relatives can only view).
• The bus monitor and driver of their route, for that day's trip.
• The transportation company's coordinators and office staff, according to their permissions.
• Their school, only its own students and according to the permissions coordinators give it.

We do not publish students' identities, homes, locations or photos, and we do not use them for advertising. No automated decisions affect a student: what the app suggests (for example, a replacement bus or a stop order) is always decided by a person.

9. Legal basis

We process data to provide the transportation service the Client contracted, with parents' or guardians' consent when the law requires it, to comply with legal obligations (for example, accounting) and to protect the safety of the service and of students. Accepting the terms is not a general permission for any use. You can withdraw your consent at any time; if you do, some features, such as alerts or live tracking, may stop being available.

10. Who we share data with

• With the Client (school or transportation company), as explained in section 8.
• With authorities, only when the law requires it and with the requirements the law sets.
• With providers who help us run the service (sub-processors). They may only use the data to provide their service to us, with confidentiality and security measures:

Data outside Panama: some providers store or process information in other countries (for example, the United States). We choose providers with adequate protection measures and contractual guarantees, as the law requires, and only to provide the service.

11. Access by our team and separation between companies

Several transportation companies use the same platform, but each company only sees its own data: the server enforces this on every request, not just the screen. RutaSegura's technical staff only access data that identifies a person when needed to provide support, fix an error, maintain or protect the service or comply with the law, with limited access, a duty of confidentiality and a record of what they do. We never use that access to copy data, do marketing or give it to third parties.

12. How long we keep data

These are the periods the system applies. The Client can adjust some of them and decides how long its operation's data is kept.

Backups are deleted in automatic cycles. When a Client stops using RutaSegura, we return or delete its data according to its instructions and what the law allows; we do not reuse it for anything.

13. Security and what we do in an incident

Data travels encrypted (HTTPS) and is stored on servers with restricted access. Each person signs in with their own account and only sees what concerns them. On phones, the session is stored encrypted. Office staff sign in with two-step verification, computer sessions close automatically when idle, passwords must be strong and an anti-bot check protects sign-in. Photos and documents are kept in private storage and staff actions are recorded.

If an incident affecting personal data occurred, we would contain it, document it and promptly notify the responsible Client so it can meet its duties; and, when applicable, we would notify Panama's National Authority for Transparency and Access to Information (ANTAI) and the affected people within the periods set by law.

14. Your rights and how to exercise them

You can exercise your rights of access, rectification, cancellation, objection and portability at any time, and withdraw your consent.

• Delete your account: in the app or on the web, tap the Settings gear and then Delete my account. The steps and what is deleted are on this page.
• Other rights: request them in the app (Settings › Privacy and my data) or write to privacidad@rutaseguraapp.com with your name and what you need. We will only ask for what is essential to confirm your identity.
• Your children's data: as a parent or guardian you can request access, correction or deletion of your children's data.
• When the request concerns data the Client decides about (for example, a route or a school record), we handle it together with the Client.

We will answer within the period set by law. If you are not satisfied, you can go to the National Authority for Transparency and Access to Information (ANTAI).

15. Phone permissions

• Location: bus monitors and drivers, to send the bus location and share it with coordinators (see section 6). Families, only if they use "Use my current location".
• Camera: only when you tap "Take photo".
• Microphone: only for staff voice search, while the button is held. Families do not use it.
• Notifications: for service alerts.

The app does not use your contacts or calendar.

16. Cookies

Read our cookie policy. We only use what is needed for the website to work and be secure.

17. Changes to this policy

Each version shows its date. If we make important changes, we will let you know in the app or by email before they take effect and, if the law requires it, ask you to accept them again. A new use of your data does not become valid just because you keep using the app.