Legal
Privacy policy
Last updated 30 September 2026.
Vavr is provided by R92 Corporation ("we", "us"). Vavr helps schools, childcare providers and school transport operators record who drops off and collects each child. This policy covers the Vavr apps (Vavr, Vavr Staff and Vavr Door), the Vavr web console, and this website.
Who is responsible
Your school or provider decides what Vavr records and how long it keeps it. We process that information on the school's behalf and only to provide Vavr. For US schools we act as a "school official" with a legitimate educational interest under FERPA, and we follow the school's data privacy agreement.
What we collect
| Information | From whom | Why |
|---|---|---|
| Name, email address, phone number (optional) | Parents, guardians, staff | Your account, sign-in links, notifications |
| Photo of the adult at a pickup or drop-off | The adult at the door | So staff can compare it by eye with the photo on file |
| Signature | The adult at the door | Proof of the handover |
| Adults a parent authorises: name, phone, photo | Parents | So the school knows who may collect |
| Children's names, classes, attendance, pickups | The school | The school's records |
| The driver's phone's precise location during a run, including with the app closed; who boarded and got off where | The driver's phone | Showing parents and the school where the bus is and when it will arrive. Collected only between Start the run and the end of the run |
| Messages, and the photos and files attached to them | Parents, guardians, staff | Conversations between families and the school, and between staff; kept for the school's records |
| Lost-and-found items: a description, where they were found, photos of the item, and who claimed them | Staff, parents | Returning lost belongings to their owners |
| Reports and blocks you make, and that you accepted the community rules | Parents, guardians, staff | Keeping conversations safe, and reviewing reports |
| Voice on the staff radio | Staff | Streamed live to other staff at the same school; never recorded |
| Notification token, device key, app version | Your device | Notifications, and signing records made on your device |
Children do not have accounts and do not use Vavr. The parent app does not collect your phone's location. Microphone use in Vavr Staff is limited to the staff radio, and only while you hold the talk button.
Messages
Your school can read the conversations it takes part in, and the school's leaders review messages and lost-and-found items that someone reports, or that match the safeguarding words the school sets. Vavr does not send your messages to a third-party translation or AI service.
What we never do
- We never use facial recognition, and we never create or store face templates.
- We do not sell or rent personal information, and we do not share it for advertising.
- We do not show ads, and we do not use advertising or analytics trackers in the apps.
Who sees it
- Staff at your school, as the school allows. Teachers see only their own class.
- Parents see their own children, and photos and signatures only for adults they added.
- Our service providers, only to run Vavr for us: Cloudflare (hosting and storage), Google and Apple (app notifications), and our email provider.
- Authorities, when the law requires it. We tell the school unless the law forbids it.
How long we keep it
For the retention period your school sets, which follows its state's rules. After that, a record is reduced to a tamper-evident link with no personal details, and its photos and signatures are deleted. Messages and their attachments follow the same retention. Lost-and-found items are deleted, with their photos, 90 days after they are handed back or given away. Reports are kept with the school's records. When a school stops using Vavr, its data is deleted and we provide a certificate of deletion.
When you delete your account, we remove your name, email, phone number, password, passkeys and notifications at once. Messages you sent remain part of the school's records, shown as from a deleted account, until the school's retention removes them.
Security
Data is encrypted in transit and at rest. Each record is signed by the device that made it and chained, so any change can be detected. Staff with administrative access use a second factor. If a breach affects a school's data, we tell the school within 7 days.
Your choices
- Ask your school to see, correct or delete information about you or your child. You can also write to us and we will pass your request to the school.
- Remove adults you authorised at any time in the app.
- Turn notifications off in the app or in your phone's settings.
- Block someone in Messages, and report a message or an item that worries you.
- Delete your account in the app or on the web.
Depending on your state, you may have further rights under its privacy laws. We honour them through the school, which controls the records.
Children
Vavr is used by adults. We do not knowingly collect information from children under 13 through the apps; information about children is entered by their school.
Changes
We will post changes on this page and update the date at the top. For important changes, we will tell schools in advance.
Contact
R92 Corporation, privacy@vavr.us.