Privacy policy

Our role

Transport operators and schools (our customers) control the data they enter into Trayvar. Trayvar processes it on their behalf to run daily transport operations. Questions about a specific child's or driver's record go first to the operator or school; we support every request they pass to us.

What we process

Children: name, year and class, assigned school, pickup point, and where an operator uses NFC cards, the card identifier. Photos only where an operator chooses to add them.

Parents and guardians: name, phone number, preferred language, and records of consent to receive WhatsApp notifications.

Drivers: name, phone number, sign-in credentials, assigned vehicle and routes, and live location while a route is in progress.

Operational events: pickups, drop-offs, absences, route timings, and the notifications sent about them.

Why we process it

To run the service our customers contract for: planning routes, recording pickups and drop-offs, showing operators live progress, and telling parents their child was collected or dropped off safely. WhatsApp notifications are sent only to guardians who have consented, and consent can be withdrawn at any time through the operator.

Children's data

Trayvar exists to keep children safe in transit, and their data gets the strictest treatment in the system. We collect the minimum needed to run a route, never use children's data for marketing or profiling, and never sell it. Access inside the product is restricted by role: drivers see only the children on their own routes.

Location data

Driver location is collected only while a route is active, is visible to the driver's operator for live tracking and safety, and is deleted automatically after 24 hours, with hourly summary positions kept for 30 days for operational reporting, then deleted. We do not track drivers outside active routes.

Who we share it with

We use a small set of processors to run the service: Supabase (database and authentication), Meta (WhatsApp Business Platform, for guardian notifications), Mapbox (maps and routing), Netlify (hosting), and Resend (transactional email). Each receives only what its function requires. We do not sell data to anyone.

Security

Data is encrypted in transit, access is scoped by role at the database layer, and operator accounts are isolated by tenant. We review access controls as part of every release.

Retention

Operational records are kept while the operator's account is active and for a limited period afterwards to meet legal and contractual obligations, then deleted. Driver location follows the shorter window above.

Your rights

You may ask to access, correct, or delete personal data we hold. Requests go to your operator or school, or directly to us at info@carthenaadvisory.com. We comply with the Nigeria Data Protection Act 2023 and apply the same standard in every market where Trayvar operates.

Changes

We will post any material change to this page and update the date above.

Carthena Advisory Limited · Maryland, Lagos, Nigeria

info@carthenaadvisory.com