Privacy Policy

1. Our role

Fleet operators and schools ("customers") use Ibis to run their own vehicles. The data they enter about their staff, drivers, vehicles, students and parents belongs to them: the customer decides what is collected and why (it is the data controller), and we process it on the customer's instructions (we are the data processor).

For visitors to ibis.works and for messages sent through the contact form, we decide how the data is used, so we are the controller.

2. What we collect

• Website: the contact form (your name, company, phone, email, the type of fleet and your message), a scrambled (hashed) form of your internet address used only to limit repeated submissions, and a cookie that remembers your language.
• Dashboards (staff of a customer): name, email address, role and sign-in records, handled by our sign-in provider.
• Ibis Driver app: the vehicle's plate number and a sign-in session; the vehicle's precise location (position, speed, heading and accuracy) while the app is signed in and the operator's settings require reporting, including in the background when the app is closed or not in use; the trip details a driver enters (mileage, costs, notes) and any photos of delivery documents the driver attaches; the language choice. The app does not use contacts, the microphone, advertising identifiers or analytics trackers.
• Fleet records entered by the operator: drivers' names, licence numbers and expiry dates, vehicle and trailer documents, trips, orders and costs.
• School transport: students' names, grades, home addresses and pickup points; parents' names, phone numbers and email addresses; attendance per run; bus positions; and, where a school has installed cameras, a live view of the bus camera. Ibis does not record or store camera video.
• Ibis Parent app: the parent's sign-in, the children linked to that parent, notifications about the bus, and the bus position shown on the map.

3. Why we use it

We do not use personal data for advertising and we never sell it.

• To provide the service: live vehicle tracking, trips and routes, attendance, alerts, reports and exports.
• To keep accounts secure and prevent misuse.
• To answer messages sent through the contact form and to set up new customers.
• To meet legal obligations.

4. Location data

The Ibis Driver app shares the vehicle's location so the fleet operator or school can see where its vehicles are. Reporting runs while the driver is signed in and the operator's policy requires it (for example during a trip or a school run), and continues in the background when the app is not on screen. The phone shows a persistent notification while reporting is on. Signing out stops reporting.

Raw location points are kept for about 30 days and then deleted automatically. Trip records keep their start and end details for the operator's business records.

5. Where data is stored and who helps us process it

We rely on specialised providers, each bound by its own data-protection terms:

• Convex (database and backend), hosted in the European Union (Ireland).
• Clerk (sign-in for dashboards and the Parent app), hosted in the United States.
• Vercel (website and dashboard hosting), with servers in the United States and Europe.
• Google Maps Platform (maps, address lookup and route planning): addresses and coordinates are sent to Google to be shown on maps and placed on routes.
• Anthropic (text processing): when a school uploads a student list, address text is sent to be tidied into a standard form so it can be found on the map. No names are sent with it.
• Imou (bus cameras): for schools that use cameras, the live stream is provided by Imou's service.
• Resend (email): invitations and notifications sent by email.

6. Transfers outside Egypt

Some of the providers above store or process data outside Egypt. Customers agree to this in their contract with us and, where the law requires it, obtain the consent of the people concerned (for example parents of students). We choose providers that apply recognised security and data-protection standards.

7. Who can see your data

• Your fleet operator or school and the staff it has authorised.
• The providers listed in section 5, only to the extent needed to deliver the service.
• Authorities, when the law requires it.

8. How long we keep it

• Raw location points: about 30 days.
• Account, fleet, trip and attendance records: for as long as the customer's account is active, then deleted on the customer's request or when the contract ends.
• Contact-form messages: until handled, and at most 12 months.

9. Security

All data travels over encrypted connections (HTTPS). Passwords are stored in hashed form, never in clear text. Access is limited by role, so each person sees only their own organisation's data. No system is perfectly secure; if we learn of a breach affecting you, we will tell the customer concerned without undue delay.

10. Children

The school-transport product handles children's data (names, grades, addresses, attendance and the bus position) on behalf of schools. The school is responsible for obtaining parental consent. Ibis does not knowingly collect data directly from children; the Parent app is for parents and guardians.

11. Your rights

You can ask to see the data we hold about you, correct it, delete it, or object to how it is used. If your data was entered by a customer (your employer or your child's school), contact them first; they control it and can instruct us. Otherwise, or if you are not satisfied, write to us at the address below. We answer within 30 days.

Egypt's Personal Data Protection Law (Law No. 151 of 2020) applies. You may also complain to the Egyptian Personal Data Protection Centre.

How to delete an account or data: see the Data and Account Deletion page.

12. Changes

When we change this policy we update the date at the top and, for significant changes, tell customers directly.

13. Contact

Z Development Studios · hello@thefoundry.run · Cairo, Egypt