Privacy Policy

Version 1 — effective May 27, 2026

1. Who is responsible

BusOryn (operated by an independent developer based in the Republic of Kazakhstan) is the data controller for personal data processed through the BusOryn app and website.

2. What BusOryn is

BusOryn is primarily a search and directory service. Passengers use it to find intercity bus schedules published by independent transport providers ("Operators") and to view Operator contact details. On buses where the Operator has enabled it, passengers can also reserve seats. Passengers do not need an account; aside from advertising data (described below) and the limited reservation data described in Section 3, we do not collect personal data from passengers.

3. What we collect

From bus Operators who create an account:

• Email address — only if you register with email or sign in with Google.
• The company and contact information you choose to publish (e.g., business phone, messaging handles, company name) and your schedule data.
• Communications you send us (e.g., support emails).

We strongly advise Operators to use business / non-personal contact details, as published contact information is shown to passengers.

From passengers who reserve a seat (where enabled):

• Reservation details (selected seats and the trip/schedule) and a device/installation identifier used to create and manage the reservation and prevent abuse. No passenger account or name is required.
• A push-notification token (Firebase Cloud Messaging), used only to notify you if a trip you've reserved is cancelled.

Collected automatically (all users, through advertising):

• Advertising identifier, IP address, and device/usage signals collected by Google AdMob and its mediation partners to serve and measure ads.
• App language preference (stored on your device).

4. Advertising

BusOryn is supported by ads served through Google AdMob and its mediation/advertising partners. These providers may collect and process your device's advertising identifier, IP address, and ad-interaction data to deliver and measure ads, which may be personalized or non-personalized. This applies to all users, including passengers using the app without an account.

You can reset or limit your advertising identifier in your device settings. For how Google uses this data, see Google's "How Google uses information from sites or apps that use our services" policy.

5. Why we use it

• To create and operate Operator accounts and publish their schedules in search.
• To create and manage seat reservations on buses where the Operator has enabled them.
• To send notifications about your reservations (e.g., if a reserved trip is cancelled).
• To display ads that fund the service.
• To prevent fraud and abuse and protect the platform.
• To comply with legal obligations under Kazakh law.

6. Legal basis

• Your consent (Operators at sign-up and continuing use; advertising processing on continued use, with consent where required).
• Necessity to provide the service you request.
• Our legitimate interests in operating, funding, and improving the platform.
• Compliance with the laws of the Republic of Kazakhstan, including the Law "On Personal Data and its Protection."

7. Who we share with

• Advertising: Google AdMob and its mediation/advertising partners, which receive advertising and device data as described above.
• Service providers: Supabase (database and Operator authentication hosting), Cloudflare (web hosting and DNS), Google Firebase Cloud Messaging (push notifications), email delivery providers.
• Authorities: when required by Kazakh law.

We do not sell your personal data to third parties.

8. International transfers

Some of our service providers, including advertising partners, may process data outside Kazakhstan. Where required by law, we take steps to ensure adequate protection.

9. Retention

We retain Operator account data while the account is active and for as long as necessary to operate the service, resolve disputes, and meet legal obligations. Operators may request account deletion at any time. Passenger reservation data is retained only as needed to manage the reservation and is removed once it is no longer required.

10. Your rights

Under applicable Kazakh law, you have the right to: access your personal data, request correction, request deletion, withdraw consent, and file complaints with the data protection authority of the Republic of Kazakhstan.

To exercise these rights, contact us at [email protected].

11. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), authentication, and access controls. No system is perfectly secure, but we work continually to reduce risks.

12. Children

BusOryn is not intended for use by anyone under 16. We do not knowingly collect data from children under this age. Ads are configured for a general (non-child) audience.

13. Changes

We may update this Privacy Policy. Material changes will be presented to you in the app. Previous versions remain accessible at this URL with a version suffix.

14. Contact

For privacy questions or to exercise your rights: [email protected]