1. Introduction
StudentRide ("we," "us," or "our") is committed to protecting the privacy and security of all users, especially the students we serve. This Privacy Policy describes how we collect, use, store, and protect personal information in connection with our student transportation platform available at studentride.live.
We are fully committed to compliance with the Family Educational Rights and Privacy Act (FERPA), Children's Online Privacy Protection Act (COPPA), Americans with Disabilities Act (ADA), and all applicable state and federal privacy laws.
2. Information We Collect
2.1 Student Information
- Full name, OSIS number, date of birth
- School enrollment and transportation assignment
- Disability accommodations (IEP/CSP designations, wheelchair accessibility)
- Medical information (allergies, medications relevant to transport safety)
- Pickup/dropoff addresses and schedule
- Court order information affecting custody and transport
2.2 Parent/Guardian Information
- Name, email address, phone number
- Home address and emergency contact information
- Payment and billing information (P-Card, credit card)
2.3 Driver/Companion Information
- Name, contact information, home address
- Driver's license, vehicle registration, insurance documentation
- Background check results and fingerprint verification status
- GPS location data during active service hours
- Earnings and payment information
2.4 Automatically Collected Data
- Device information and attestation data
- IP address, browser type, access timestamps
- GPS coordinates during active trips
- Geofence entry/exit events
3. How We Use Your Information
- Safe Transportation: Matching students with verified drivers/companions, routing, pickup/dropoff verification
- Safety Compliance: Geofence monitoring, court order enforcement, emergency alerts (including 911 integration)
- Communication: Trip status updates, schedule changes, emergency notifications to parents, schools, and transportation liaisons
- Billing & Payments: Processing payments, P-Card transactions, Net-30 invoicing
- Legal Compliance: Court order adherence, FERPA-protected record maintenance, law enforcement cooperation when legally required
- Platform Improvement: Aggregated, de-identified analytics to improve route efficiency and safety metrics
4. FERPA Compliance
We act as an authorized agent of educational institutions under FERPA. Student education records are handled in accordance with 34 CFR Part 99. We:
- Use student data solely for the transportation services authorized by the school/district
- Do not disclose student records to unauthorized third parties
- Maintain appropriate security controls for all student records
- Allow parents/guardians to inspect and review their child's transportation records
- Return or destroy student data upon termination of our agreement with the school/district
5. Data Security
We implement industry-standard security measures including:
- End-to-end encryption for data in transit (TLS 1.3)
- Encryption at rest for all sensitive data (AES-256)
- Role-based access control (RBAC) with principle of least privilege
- Device attestation verification for high-risk operations (GPS streaming, student verification)
- Comprehensive audit logging of all data access and modifications
- Regular security assessments and penetration testing
6. Data Retention
We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy. Student transportation records are retained in accordance with applicable state education record retention requirements. GPS tracking data is retained for 90 days. Financial records are retained for 7 years per IRS requirements.
7. Your Rights
Parents and guardians have the right to:
- Access their child's transportation records
- Request correction of inaccurate information
- Receive notification of data breaches affecting their information
- Request deletion of their account and associated data (subject to legal retention requirements)
- Opt out of non-essential data collection
8. Third-Party Services
We may use third-party services for payment processing (Stripe), email notifications (Resend/SendGrid), SMS alerts (Twilio), and cloud hosting (Vercel/AWS). These providers are contractually bound to protect your data and process it only as we direct.
9. Contact Us
For privacy-related questions or to exercise your rights, contact us at: