Privacy notice
3 November 2026. Book a Bus is operated by Luck Dragon Pty Ltd. For privacy questions, access, correction or account closure, contact support@bookabus.com.au. See Support for what to include in your request.
This notice describes Book a Bus data handling. It does not replace a school’s own privacy, records-management or incident procedures, or an operator’s own privacy notice.
School records and your connected storage
School profiles, business contacts, journey requests, quotes, accepted terms, bookings, activity and recovery records, and supplier invoices are saved in the school’s own connected Google Drive or, where enabled, OneDrive app folder. Use an account your school authorises for these records. Connecting a personal account does not establish that authority. Microsoft sign-in and OneDrive connection may require the school’s Microsoft tenant administrator to approve the app or its permissions before they can be used.
School-owned storage does not mean that records stay only on your device or that Book a Bus cannot process them. Book a Bus reads and updates the workspace through Cloudflare to provide the service and to show authorised schools and operators the information they need. It does not persist a full copy of the school booking database in Cloudflare. The service does not import existing school files or pupil lists. Do not enter pupil names, medical details, home addresses or other sensitive pupil information; use passenger totals and authorised business contacts.
Sign-in, storage permission and Cloudflare records
Google sign-in supplies an account identifier and verified email address. Microsoft sign-in, where enabled, supplies account and organisation identifiers and may supply a display email address. A Microsoft display address is not treated as a separately verified notification address.
The school storage owner separately grants access to the app’s storage. Google access uses its app-file permission; OneDrive uses its app-folder permission and a basic account check. The connection includes permission to refresh access so Book a Bus can perform authorised booking operations while the storage owner is signed out. Signing out ends the current session; it does not disconnect the storage grant.
Cloudflare holds an encrypted account and credential registry containing identity bindings, roles, sessions, storage access and refresh credentials, folder/file identifiers, and operator company and fleet profiles. It also holds operator approval, email preference and business billing records. A separate fleet ledger holds pseudonymous operator/vehicle keys, reserved times, operation hashes, status and recovery counters to prevent conflicting reservations. These are not anonymous records and are separate from the school’s detailed booking workspace.
The encrypted registry also retains each school record’s latest verified revision number and a cryptographic hash (a record fingerprint) to detect replacement with an older or conflicting version. This integrity checkpoint contains no booking contents.
Staff access and team invitations
A school storage owner or operator administrator may add staff to the organisation’s existing workspace. A staff invitation is a manual share link, not an email invitation, and expires after 72 hours unless accepted or revoked. Google invitations are bound to the invited verified Google email. Microsoft staff first obtain a short-lived account code after Microsoft sign-in; the code expires after 15 minutes, binds the invitation to that immutable Microsoft identity rather than a display email, and does not itself create membership, a session or storage access.
The encrypted platform registry holds the access metadata needed to administer staff access: provider-bound identity, member identifier, organisation role/access level, invitation state/expiry and invite/accept/revoke audit entries. Booking activity identifies the individual staff member in the organisation’s existing activity history. This registry does not hold a copy of school booking data, which remains in the connected organisation storage workspace.
Staff use the organisation’s existing records only. An invitation does not grant, change or transfer Google Drive, OneDrive, mailbox, billing or payment access. The original school storage owner remains the storage and service-notification owner. Staff cannot change organisation storage, service-email settings, recovery, billing or invoices. Platform operations staff are separately managed by the Book a Bus founder and do not receive platform financial or access-administration powers.
Who receives booking information
Submitting a request makes the school and journey information needed for quoting available to approved operators. Operators cannot view competing operators’ quote details. Accepting a quote makes the booking contact details available to the selected operator, including while its confirmation is pending. Schools and operators should provide only information they are authorised to share. Operators may keep their own records of transport they supply under their own privacy and recordkeeping obligations.
Operator payments through Stripe
Schools pay the transport operator directly. Stripe processes the bus company’s Book a Bus subscription and separately authorised platform fees. The company name, billing email, amounts and pseudonymous billing references are sent to Stripe. School names, routes, passenger information and school storage identifiers are not included in these Stripe billing records.
Card or bank details are entered on Stripe’s hosted payment pages. Book a Bus stores Stripe customer, payment-method, checkout, subscription and invoice identifiers, authorisation records and payment status in its encrypted business registry; it does not store full card or bank account details. Do not enter payment details in booking notes.
Service emails, cookies and feedback
Where available and enabled in your account, generic setup, approval and booking-update emails are sent through Cloudflare’s email service. Google accounts use their verified sign-in address. Microsoft school storage owners can separately verify an authorised notification inbox using an explicitly requested, short-lived code. Microsoft display addresses and booking-contact addresses are not automatically enabled for email. The code is bound to the signed-in school identity, expires after 15 minutes and has limited attempts and requests. Confirming the code enables welcome and generic booking emails, which can be disabled in account setup or Email alerts. Microsoft bus-company service emails remain unavailable.
Service emails contain a sign-in link and general service text, not school names, trip details or booking contacts. The verification message also contains the requested one-time code. The provider receives the recipient address and message. The verified school notification address, hashed verification challenge, request limits, preferences, school account email history and booking-update delivery records stay in the school workspace. The app does not store the plaintext code. A successful verification replaces the pending challenge; any later request replaces an older challenge, and expired challenges cannot enable delivery. Operator preferences and account email history are held in the business registry. Company submissions may also send a generic review alert to the Book a Bus owner. Push delivery is not enabled.
The app uses essential cookies for sign-in, security and test-workspace selection. Sign-in sessions expire after two hours and incomplete sign-in flows after ten minutes. These expiry periods do not apply to the connected storage grant, account or business records.
In internal test mode, an optional feedback link opens Asgard, a separate Luck Dragon service. The link does not automatically send page content, the current page address or screenshots. Submit only general feedback there, without student, staff, booking or personal details.
Retention, deletion and overseas processing
School workspace files, recovery records and any provider-held file versions remain subject to the school’s retention controls and the storage provider’s settings. Contact support before deleting active booking or recovery files. Revoking Google or Microsoft access stops future authorised storage access when the provider applies the revocation; it does not automatically delete school files or the account registry.
Storage credentials remain in the encrypted registry until they are replaced or removed through support. Account, operator billing and necessary fleet reservation/tombstone records do not currently have an automatic deletion schedule. Account closure and deletion requests require review of active bookings, recovery needs and business records that must be retained. We keep a documented manual case log of the request, decision, material removed or retained, and the reason for any retention. Request removal through the contact above; account closure does not itself cancel a paid subscription. See the service terms.
For a closure, access, correction or deletion request, use the support address from the verified sign-in account and identify the affected school or company. We will verify authority, identify whether the material is in school-controlled storage, the Book a Bus registry or a provider account, preserve records needed for active bookings, recovery, disputes or legal/business recordkeeping, then confirm the action or explain the limit. We do not automatically delete school workspace files, provider versions, invoices or records held by an operator. A school storage owner controls its school workspace and should use its own approved records process for those files.
Cloudflare, Google, Microsoft and Stripe may process information internationally; Australian-only processing is not promised. Cloudflare describes primary information storage in the United States and the European Economic Area and global transfers. Stripe describes international transfers including the United States and India. Google Workspace offers United States, Europe or no-preference data-region options for supported accounts; Microsoft 365 OneDrive locations depend on the school's tenant and service arrangements. These provider statements do not identify the location of a particular school file or every request. Schools should confirm their own Google or Microsoft storage arrangements with their administrator where location matters. See Cloudflare's privacy policy, Stripe's privacy policy, Google Workspace data regions and Microsoft OneDrive data residency. Their services process the requests needed to provide hosting, identity, storage, email and payment functions.
Access, correction and privacy concerns
To make a privacy complaint, email support@bookabus.com.au with the affected account and a brief description. Avoid sending pupil details or credentials by email. We will acknowledge the complaint, verify identity and authority where needed, record and assess it, distinguish Book a Bus records from school-controlled files and provider records, and provide a written response. We aim to respond within 30 days where feasible; if we need more time, we will explain why and give an update. Report suspected unauthorised access promptly so we can investigate and coordinate with the affected school, operator or provider. Any notification required by applicable law will be considered as part of that response.
If you are dissatisfied with our response, or we have not responded within 30 days, you may complain to the Office of the Australian Information Commissioner or seek advice from another relevant authority. This notice does not limit privacy rights that apply to you.
Changes to this notice
We will publish changes here with a new effective date. Where a material change affects how an existing account uses the service, we will use the account’s available service channel where appropriate; do not rely on email alone for urgent booking matters.
Google API data
Google data is used to provide sign-in and the requested school Drive booking service, not advertising or sale of personal information. Book a Bus’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.