How We Handle Your Personal Information
busschedules.org/ takes data protection seriously. This page sets out what we collect from you as a visitor, why, and the rights you have under federal and state privacy laws.
What’s on this page
- Who we are
- Scope of this policy
- Information we collect
- Agency & carrier data — held by them
- How we collect it
- Why we collect it
- Who we share with
- “Sale” and “sharing”
- Cookies and analytics
- Retention
- State privacy rights
- How to exercise rights
- Children — COPPA
- Security
- International visitors
- Changes to this policy
1. Who We Are
busschedules.org/ is an independent informational and educational directory that publishes practical, step-by-step guidance for using U.S. transit agencies, intercity bus carriers, paratransit services, and school bus systems across all 50 states. We are the business and the controller for the personal information described on this page.
For any privacy-related question, contact us at info@busschedules.org with the subject line “Privacy request” and we will respond within the time limits set out below.
2. Scope of This Policy — Important
This privacy policy covers personal information about you, the visitor to busschedules.org/. It does not cover records held by U.S. transit agencies, intercity carriers (Greyhound, FlixBus, Megabus, Peter Pan, Trailways), paratransit operators, school districts, or fare-card system operators (OMNY, Clipper, ORCA, SmarTrip, CharlieCard, TAP, and others) — which are held by those organisations under their own privacy policies. busschedules.org/ does not host, mirror, or republish those records. Concerns about a specific account at a transit agency, fare-card balance, ticket purchase, paratransit application, or school transportation record must be raised with that organisation directly.
3. The Personal Information We Collect About You
| Category | Examples | Source |
|---|---|---|
| Identifiers | Email address, name (if provided), IP address | You · Your browser, automatically |
| Contact content | The content of messages you send us | You — when you email us or use a contact form |
| Internet/network activity | Pages visited, time on page, click paths, referring URL | Cookies and analytics, when you consent |
| Device and technical data | Browser, device type, OS, approximate location from IP (e.g., to suggest your nearest city page) | Your browser, automatically |
| Inferences | Aggregate inferences about which content is most useful | Derived from analytics, where consented |
| Advertising identifiers | Identifiers used to limit ad frequency and measure ad performance | Third-party advertising networks, when you consent |
We do not collect Sensitive Personal Information — no Social Security numbers, government identification numbers, financial accounts, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail/email/text, genetic data, biometric data, sex-life or sexual-orientation data, or specific health information about you. We do not ask for it and you should not send it through our contact channel.
We do not collect or retain ticket purchases, fare-card balances, journey histories, paratransit-eligibility records, or school transportation enrollment from visitors. Those interactions happen between you and the agency, carrier, or vendor directly — we don’t see or log them.
4. Transit-Agency and Carrier Records — Held by Them, Not by Us
If you've purchased a ticket from Greyhound, FlixBus, Megabus, Peter Pan, Trailways, or your local agency, registered for a fare card (OMNY, Clipper, ORCA, SmarTrip, CharlieCard, TAP), applied for paratransit eligibility, or enrolled a child in school transportation, those records are held by the receiving organisation. busschedules.org/ does not have access to them and does not maintain a parallel database. To request access, correction, or deletion, contact the organisation directly. State public-records laws may apply for transit-agency records.
5. How We Collect Personal Information
- Directly from you — when you email us, complete a contact form, or set cookie preferences
- Automatically — when you visit the site, your browser sends standard technical information so the page can load
- From third-party services we use — analytics and advertising providers, but only after you have given consent through our cookie banner
6. Business Purposes for Collection and Use
- Providing the website and its content
- Responding to questions, corrections, and feedback
- Securing the site and protecting against abuse, fraud, and unauthorised access
- Auditing interactions and measuring site performance (analytics, where consented)
- Supporting display advertising that funds the site (where consented)
- Complying with legal obligations and responding to lawful requests
We do not use personal information for automated decision-making with legal or similarly significant effects, and do not engage in profiling within the meaning of state privacy laws.
8. “Sale” and “Sharing” of Personal Information
We do not sell personal information for money. However, under CCPA/CPRA the term “sale” is broad, and use of certain advertising cookies may meet the CCPA/CPRA definition of “sharing for cross-context behavioural advertising.” Where that applies, you have the right to opt out — see Section 11 for state-by-state procedures.
The site honours the Global Privacy Control (GPC) signal as a valid opt-out of “sale” and “sharing” under CCPA/CPRA, the Colorado Privacy Act, the Connecticut Data Privacy Act, and similar laws that recognise universal opt-out mechanisms.
9. Cookies, Analytics, and Advertising
For full detail — including the cookies used, third-party services, and how to manage them — see our Cookie Policy. Key controls: the cookie banner, the “Cookie settings” link in the footer, browser-level controls, and industry opt-outs (NAI, DAA).
10. How Long We Keep Personal Information
| Category | Retention |
|---|---|
| Email correspondence and contact-form messages | Up to 24 months from last contact, then deleted unless an active matter requires longer retention |
| Server access logs (IP addresses, request data) | Up to 90 days, then aggregated or deleted |
| Analytics data | Aggregated; identifiable data retained no longer than 14 months |
| Cookie consent records | 12 months from when you set your preference |
| Backups | Rotating backups deleted on a 30–90 day cycle |
11. U.S. State Privacy Rights
busschedules.org/ is accessible from across the U.S. Visitors from states with comprehensive privacy laws have rights under those laws:
| State | Law |
|---|---|
| California | CCPA / CPRA — access, delete, correct, opt out of sale/sharing, limit use of sensitive PI |
| Texas | Texas Data Privacy and Security Act (TDPSA) |
| Florida | Florida Digital Bill of Rights (FDBR) |
| Virginia | Virginia Consumer Data Protection Act (VCDPA) |
| Colorado | Colorado Privacy Act (CPA) — recognises Universal Opt-Out Mechanisms |
| Connecticut | Connecticut Data Privacy Act (CTDPA) |
| Utah, Oregon, Montana, Iowa, Indiana, Tennessee, NJ, NH, KY, MN, MD, RI, DE | Comprehensive state privacy laws (effective dates vary) |
Right to access
Confirm processing and access your personal data.
Right to correct
Correct inaccuracies in your personal data.
Right to delete
Delete personal data we hold, subject to legal exceptions.
Right to portability
Obtain a copy in a portable, technically feasible format.
Right to opt out
Opt out of targeted advertising, sale, and decision-making profiling.
Right to non-discrimination
You will not be denied service or charged more for exercising these rights.
12. How to Exercise Your Rights
For all privacy requests, email info@busschedules.org with subject line “[State] privacy request.” Include enough information for us to identify the data you’re asking about. We may need to verify your identity before responding — most commonly by confirming you control the email address that submitted the request. We respond within the period required by the applicable law (typically 45 days, with possible extensions).
13. Children — COPPA Compliance
This site is not directed at children under 13 and we do not knowingly collect personal information from children under 13. We comply with the federal Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§6501–6506, and its implementing regulations at 16 C.F.R. Part 312. If we learn we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. We recognise that bus and transit content is genuinely interesting to children of all ages — we welcome young readers, but the site is not designed to collect information from them.
14. Security
We apply technical and organisational measures appropriate to the risk: encryption of data in transit (HTTPS across the site), access controls on administrative tools, regular software updates, secure authentication for our editorial team, and contractual security commitments from vendors. If we become aware of a breach involving your personal information, we will notify you and applicable authorities consistent with state breach-notification laws.
15. International Visitors (GDPR / UK GDPR)
The site is operated for a U.S. audience but is accessible globally. EU and UK visitors have rights under the EU GDPR and UK GDPR — access, rectification, erasure, restriction, portability, and objection. UK residents may complain to the Information Commissioner’s Office at ico.org.uk.
16. Changes to This Policy
We update this policy when our practices change or when state privacy laws change. The “Last reviewed” date at the top reflects the current version. Substantive changes will be flagged on the homepage banner for at least 30 days. This policy is read alongside our Cookie Policy, Terms of Service, and Disclaimer.
Questions About Your Personal Information?
Email us. We respond to general privacy questions within seven business days, and to formal state-law requests within the deadline set by the applicable law.
📧 info@busschedules.org