Privacy Policy

Orbit Software, Inc. ("Orbit Software," "we," "us," or "our") operates the BusBoss Technology Suite application (the "Service"), a school bus routing and transportation management platform marketed under the BusBoss brand. This Privacy Policy explains how we collect, use, disclose, and safeguard information when school districts, transportation providers, and authorized users access the Service.

BusBoss Technology Suite is provided to K–12 school districts and transportation operators (each, a "Customer") under a written agreement. The Customer is the data controller for student and operational records processed in the Service. Orbit Software acts as a service provider and school official under the Family Educational Rights and Privacy Act (FERPA) when processing student data on behalf of the Customer.

By accessing the Service, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Service.

1. Scope of This Policy

This Privacy Policy applies to:

• The BusBoss Technology Suite application and related web pages hosted by Orbit Software.
• Information collected from Customer administrators, dispatchers, routers, drivers, school staff, and other authorized end users ("Users").
• Student, parent, and guardian information processed by the Service on behalf of a Customer.

This policy does not apply to third-party websites, products, or services linked from the Service. Those services have their own privacy practices.

2. Information We Collect

2.1 Information Provided by the Customer

The Customer uploads or enters records needed to plan and operate student transportation. Depending on the Customer's configuration, this may include:

• Student data: name, student identification number, grade, school assignment, home address, emergency contacts, pickup and drop-off locations, eligibility status, and special transportation needs.
• Parent and guardian data: name, contact information, and authorized pickup designees.
• School and stop data: school addresses, bell times, bus stops, routes, run schedules, and boundary information.
• Vehicle and driver data: vehicle identifiers, driver names, route assignments, and licensing details when entered by the Customer.

2.2 Information Provided by Users

Users with login credentials provide:

• Account information: name, email address, role, phone number (optional), and assigned school or department.
• Authentication credentials: usernames, passwords (stored as salted hashes), and multifactor authentication settings when enabled.
• Configuration choices: routing rules, optimization parameters, custom fields, and report preferences.

2.3 Information Collected Automatically

When a User accesses the Service, we automatically collect:

• Log data: IP address, browser type and version, operating system, pages viewed, actions taken, timestamps, and referring URLs.
• Device data: device type, screen resolution, and language settings.
• Usage data: feature interactions, session duration, error reports, and performance metrics.
• Cookies and similar technologies: session cookies, authentication tokens, and preference cookies as described in Section 8.

2.4 Information from Third-Party Services

The Service integrates with third-party providers selected by the Customer or by Orbit Software to deliver core functionality. These providers may supply:

• Map and geocoding data from Google Maps Platform or equivalent providers used to plot stops, calculate routes, and validate addresses.
• Student information system (SIS) records imported through approved connectors.
• Single sign-on (SSO) identity attributes when the Customer enables SSO.

3. How We Use Information

We use information to:

• Provide, operate, and maintain the Service for the Customer.
• Plan, optimize, and modify school bus routes, runs, and stops.
• Authenticate Users and enforce role-based access controls.
• Generate reports, dashboards, and exports requested by the Customer.
• Provide technical support, troubleshoot issues, and respond to inquiries.
• Monitor system performance, detect security incidents, and prevent fraud or misuse.
• Comply with legal obligations and enforce our agreements.
• Improve the Service through aggregated, de-identified analytics.

4. Student Privacy: FERPA, COPPA, and State Laws

4.1 FERPA

Student records in the Service are "education records" under FERPA. Orbit Software qualifies as a "school official" with a "legitimate educational interest" under 34 CFR § 99.31(a)(1) when processing student data for the Customer. Orbit Software performs services the Customer would otherwise perform itself, operates under the Customer's direct control regarding the use and maintenance of education records, and does not redisclose education records except as permitted by the Customer or by law.

4.2 COPPA

BusBoss Technology Suite is designed for use by Customer staff, not for direct use by children under 13. Where the Service collects information about students, including students under 13, it does so on behalf of the school district under the school-consent exception to the Children's Online Privacy Protection Act. The Customer is responsible for any direct notice to and consent from parents required by applicable law.

4.3 State Student Data Privacy Laws

Orbit Software supports Customer obligations under state student data privacy laws, including but not limited to laws in California (SOPIPA, AB 1584), New York (Education Law § 2-d), Colorado (HB 16-1423), Connecticut, Illinois (SOPPA), and similar statutes. Where required, Orbit Software will execute a Data Privacy Agreement (DPA) with the Customer.

5. How We Share Information

We share information only as described below:

5.1 With the Customer

All information processed in the Service is accessible to the Customer that owns the account. Authorized Users see the data permitted by their role-based permissions.

5.2 With Service Providers

We engage vendors that perform functions on our behalf, including:

• Cloud hosting and infrastructure providers.
• Database, backup, and disaster recovery providers.
• Mapping, geocoding, and routing providers.
• Email, SMS, and notification delivery providers.
• Customer support, ticketing, and analytics providers.
• Security monitoring and logging providers.

Service providers receive only the information needed to perform their function and are bound by confidentiality and data protection obligations.

5.3 As Required by Law

We may disclose information if required by subpoena, court order, or other legal process, or to protect the rights, property, or safety of Orbit Software, our Customers, Users, or the public. Where permitted, we will notify the Customer before responding to a legal demand for student data.

5.4 Business Transfers

If Orbit Software is involved in a merger, acquisition, financing, or sale of assets, information may transfer to the successor entity, subject to the same protections described in this Privacy Policy or as required by applicable law.

5.5 With Customer Direction

We share information with third parties when the Customer directs us to do so, such as when the Customer enables an integration or authorizes a data export.

6. Data Retention

We retain Customer data for the duration of the subscription agreement plus a limited transition period. Specifically:

• Active accounts: data is retained while the Customer's subscription is in effect.
• Termination: upon written request, and within the timeframe specified in the Customer agreement (typically 30 to 90 days), we return or delete Customer data.
• Backups: encrypted backup copies are purged on a rolling schedule, generally within 90 days of the production deletion.
• Logs and aggregated analytics: system logs and de-identified usage statistics may be retained for security, audit, and product-improvement purposes.

Specific retention periods may be modified by the Customer agreement or applicable Data Privacy Agreement.

7. Security

Orbit Software maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, and destruction. These safeguards include:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest in the production database and backups.
• Role-based access controls and the principle of least privilege for Orbit Software personnel.
• Multifactor authentication for administrative access to production systems.
• Regular vulnerability scanning, patching, and security monitoring.
• Segregated production, staging, and development environments.
• Incident response procedures and breach notification protocols.
• Background checks and confidentiality obligations for personnel with access to Customer data.

No system is completely secure. Users are responsible for safeguarding their login credentials and for promptly reporting any suspected unauthorized access.

8. Cookies and Tracking Technologies

The Service uses cookies and similar technologies for the following purposes:

• Authentication: to keep Users signed in during a session.
• Security: to detect and prevent unauthorized access and abuse.
• Preferences: to remember User settings such as map zoom level and report filters.
• Performance: to measure response times and diagnose errors.

The Service does not use cookies for cross-site advertising or third-party behavioral tracking. Users may block or delete cookies in their browser, but doing so may impair core functionality such as sign-in.

9. Data Location and International Transfers

BusBoss Technology Suite is hosted in data centers located in the United States. Customer data is processed and stored in the United States. Orbit Software does not transfer student data outside the United States in the ordinary course of providing the Service.

10. Rights of Parents, Students, and Users

10.1 Parents and Students

Under FERPA and applicable state laws, parents and eligible students have the right to inspect and request correction of education records. These requests must be directed to the Customer (the school district), which controls the records. Orbit Software will support the Customer in fulfilling such requests.

10.2 Users

Users may update their account profile within the Service or request changes through the Customer's system administrator.

10.3 California, Colorado, Virginia, and Other State Resident Rights

To the extent any non-student personal data of a U.S. state resident is processed outside the FERPA framework, that resident may have rights to access, correct, delete, or limit processing of that data under applicable state law. Such requests should be directed to the Customer first; Orbit Software will assist the Customer in responding.

11. Children's Information

BusBoss Technology Suite is not intended for direct use by children. Where information about students under 13 is processed, it is processed on behalf of the Customer for the educational purpose of operating student transportation. Parents who wish to review or correct a child's information should contact the child's school district.

12. Third-Party Services

The Service may include integrations with third-party providers selected by the Customer or by Orbit Software, such as mapping, SIS, SSO, and notification providers. These providers maintain their own privacy practices, which are not governed by this Privacy Policy. Customers should review the privacy notices of any third-party services they enable.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted within the Service or communicated to the Customer's designated administrator. The "Last Updated" date at the top of this policy reflects the most recent version. Continued use of the Service after the effective date of any change constitutes acceptance of the revised policy.

14. Contact Information

Questions or concerns about this Privacy Policy or our privacy practices should be directed to:

Parents and students should first contact their school district's transportation or student records office. Orbit Software will coordinate with the school district to address any concerns.

15. Definitions