Privacy Policy

1. Who we are

ORANGE TECH LABS INC. ("Company", "we", "us") provides Orange Route (also styled OrangeRoute), its trade and product brand, not a distinct corporation. The Company operates the software platform used by bus and motorcoach companies to plan routes, sell tickets and operate their services, including the orangeroute.app website and booking pages published on behalf of those companies.

When you buy a ticket or manage a booking, the bus company selling that ticket ("the Operator") decides how your information is used and is responsible for that journey. The Company processes your information on the Operator's behalf to run the booking and ticketing services. When you visit orangeroute.app itself or request a demo, the Company is the controller of that information.

For our own business-account administration, subscription billing, website inquiries and platform support, the Company determines the purposes of processing. Passenger, driver and employee data uploaded or generated for a business customer’s transport operations is customer-controlled; the Company processes that data on the customer’s behalf to provide the contracted services, subject to applicable law and the service agreement. Staff sign-in and platform security data may also be processed for the Company’s own account and security purposes.

The Company provides ticketing SaaS, not transportation. The transport Operator remains responsible for its journey, passenger conditions of carriage and refund policy.

You can reach us at hello@orangeroute.app for privacy questions for ORANGE TECH LABS INC.

2. Information we collect

Account information: for Operators and their team members — name, work email, role, company details and sign-in method (including identifiers from Google sign-in such as your Google account email).

Booking information: for passengers — name and contact details needed to issue a ticket, seating and fare choices, add-ons such as bags or bicycles, and, where offered, loyalty programme details.

Payment information: payments are handled by the Operator's payment provider. The Company does not store full card numbers; limited payment references may be stored to process refunds or credits where the Operator enables them.

Usage information: device and browser information, pages viewed and actions taken in the Services, used to keep the Services secure and to improve them.

Business subscription billing information: company billing contacts, plan and usage details, and limited billing references needed to administer the Company’s SaaS service, distinct from passenger ticket payments.

Support information: messages you send to us, including demo and contact requests.

3. How we use information

To provide the Services: creating and managing bookings, issuing tickets and QR codes, seat inventory, driver manifests, notifications about your trips, and self-service changes.

To operate and improve the platform: usage analysis, security monitoring, fraud and abuse prevention, and product development.

To communicate with you: transactional emails about bookings and account changes, service notices, and — with consent or as permitted — product and marketing updates.

Legal bases where the GDPR applies include performance of a contract (providing the booking and ticketing services), legitimate interests (security, product improvement), and consent where required (for example, marketing emails or optional cookies).

4. Sharing of information

With the Operator: passengers' booking and ticket details are shared with the company operating the trip so they can serve you — manifests, boarding and loyalty records, and support.

With service providers: companies that host our infrastructure, deliver email and notifications, process payments on behalf of Operators, provide mapping and sign-in, and help us understand usage. These providers are bound by contracts limiting use of the data to our services.

With channel partners: where an Operator participates in a distribution channel, only the schedule and availability data needed to sell that Operator's trips is shared; passenger details are shared only as needed to fulfil and service a booking.

Data is not shared across other Company products by default merely because they have the same corporate owner. Any such processing requires its own applicable purpose, disclosure and legal basis; customer-controlled transport data remains subject to the customer’s instructions and applicable agreement.

Legal and safety: to comply with law, respond to lawful requests, or protect the rights, property and safety of the Company, Operators and travellers.

5. Cookies and similar technologies

The Services use cookies and similar storage to keep you signed in, keep your session secure, remember preferences, and understand how the Services are used. Booking pages use the minimum cookies needed to operate the purchase flow.

Where required, you can manage preferences through your browser settings or the consent options presented to you.

6. Data retention

Booking and ticket records are kept for as long as needed to service bookings, meet transportation, tax and accounting requirements, and resolve disputes. Operator account data is kept while the Operator's subscription is active and for a reasonable period afterwards.

Data that is no longer required is deleted or anonymised. The Company never sells personal information.

7. Security

We protect personal information with encryption in transit and at rest, role-based access so each company's staff can reach only their own data, audit logging of booking and trip changes, and least-privilege access for our own team.

No system is perfectly secure; if a breach affects your personal information, we will notify you and regulators as required by law.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, object to or restrict certain processing, and withdraw consent. Canadian residents have rights under PIPEDA; residents of the EEA and UK have rights under the GDPR; other jurisdictions provide similar rights.

Passengers should first contact the Operator whose ticket they hold, and we will assist them in resolving the request. You may also contact us directly at the address above. You have the right to complain to your local privacy regulator.

9. Children

The Services are not directed to children under the age of consent in their jurisdiction. Tickets for minors are purchased by a parent or guardian, whose account and contact details are used for the booking.

10. International transfers and changes

Information may be processed in countries other than your own. Where required, transfers are protected by standard contractual clauses or equivalent safeguards.

We may update this policy as the Services evolve; material changes will be announced on orangeroute.app. The date above reflects the current version.