Legal
Privacy policy
Last updated 29 September 2026.
Vavr is provided by R92 Corporation ("we", "us"). Vavr helps schools, childcare providers and school transport operators record who drops off and collects each child. This policy covers the Vavr apps (Vavr, Vavr Staff and Vavr Door), the Vavr web console, and this website.
Who is responsible
Your school or provider decides what Vavr records and how long it keeps it. We process that information on the school's behalf and only to provide Vavr. For US schools we act as a "school official" with a legitimate educational interest under FERPA, and we follow the school's data privacy agreement.
What we collect
| Information | From whom | Why |
|---|---|---|
| Name, email address, phone number (optional) | Parents, guardians, staff | Your account, sign-in links, notifications |
| Photo of the adult at a pickup or drop-off | The adult at the door | So staff can compare it by eye with the photo on file |
| Signature | The adult at the door | Proof of the handover |
| Adults a parent authorises: name, phone, photo | Parents | So the school knows who may collect |
| Children's names, classes, attendance, pickups | The school | The school's records |
| Bus position during a run; who boarded and got off where | The driver's phone | Showing parents and the school where the bus is |
| Voice on the staff radio | Staff | Streamed live to other staff at the same school; never recorded |
| Notification token, device key, app version | Your device | Notifications, and signing records made on your device |
Children do not have accounts and do not use Vavr. The parent app does not collect your phone's location.
What we never do
- We never use facial recognition, and we never create or store face templates.
- We do not sell or rent personal information, and we do not share it for advertising.
- We do not show ads, and we do not use advertising or analytics trackers in the apps.
Who sees it
- Staff at your school, as the school allows. Teachers see only their own class.
- Parents see their own children, and photos and signatures only for adults they added.
- Our service providers, only to run Vavr for us: Cloudflare (hosting and storage), Google and Apple (app notifications), and our email provider.
- Authorities, when the law requires it. We tell the school unless the law forbids it.
How long we keep it
For the retention period your school sets, which follows its state's rules. After that, a record is reduced to a tamper-evident link with no personal details, and its photos and signatures are deleted. When a school stops using Vavr, its data is deleted and we provide a certificate of deletion.
Security
Data is encrypted in transit and at rest. Each record is signed by the device that made it and chained, so any change can be detected. Staff with administrative access use a second factor. If a breach affects a school's data, we tell the school within 7 days.
Your choices
- Ask your school to see, correct or delete information about you or your child. You can also write to us and we will pass your request to the school.
- Remove adults you authorised at any time in the app.
- Turn notifications off in the app or in your phone's settings.
- Delete your account in the app or on the web.
Depending on your state, you may have further rights under its privacy laws. We honour them through the school, which controls the records.
Children
Vavr is used by adults. We do not knowingly collect information from children under 13 through the apps; information about children is entered by their school.
Changes
We will post changes on this page and update the date at the top. For important changes, we will tell schools in advance.
Contact
R92 Corporation, privacy@vavr.us.