Privacy Policy
Version 2026-10-26 · Last updated 26 October 2026
This policy explains how Banto handles the personal data of the businesses that use it, their staff, and visitors to bantohq.com. Guests of the accommodations that use Banto: please read the Guest Privacy Notice.
1. Who we are
Banto is operated by Studio Hedera, a sole proprietorship owned by IVY COMILANG VENENOSO, 5081-1 Toyoda, Iiyama-shi, Nagano, Japan ("we"). Contact: support@bantohq.com.
For account data and support we decide how data is used. For the data a business puts into Banto about its own work, staff and guests, the business decides and we process it on its behalf.
2. What we collect and why
| Information | Why |
|---|---|
| Account: name, email address, role in the organization, profile photo; sign-in records (one-time email codes, Google or Apple sign-in where still used; passwords are stored only as hashes by Firebase Authentication) | To sign you in and provide the service |
| The organization's records: properties, bookings, tasks, checklists, photos, reports, journal, team chat | To provide the service to the organization |
| Attendance, shifts, pay rates and staff numbers entered by the organization | The organization's own staff and payroll management (we process them for the organization). Banto does not record your location when you clock in. |
| Staff voice calls: who called whom and when | To connect calls between staff. The sound passes through Agora's network and is not recorded by Banto. |
| The AI assistant: what a manager says or types to it, with the names of members and properties it needs | To carry out the request. Speech is turned into text by your phone's own speech recognition (Apple or Google may process it); the text goes to Anthropic. |
| Questions asked to the admin's AI help | To answer them (sent to Anthropic); kept until you delete your account |
| Device push-notification tokens | To send notifications; removed when you sign out |
| Crash reports from the app (device model, app version, technical details; not your name) | To find and fix faults (Firebase Crashlytics, kept 90 days) |
| Emails you send us | To answer you |
| Website: your region choice, stored in your browser | To show the right regional site. No advertising or analytics cookies. |
3. AI
Banto uses AI from Anthropic (Claude) and Google (Gemini) through their business (API) services: reply drafts and translations for guest messages, translation of checklists and team messages, the AI assistant, the admin's AI help, and the passport check that an organization can turn on. Under Anthropic's commercial terms and Google's terms for the paid Gemini API, the content we send is not used to train their models. AI output is a suggestion; people decide.
4. Service providers
We use these providers to run Banto. They process data on our instructions under data processing terms.
| Provider | For | Location |
|---|---|---|
| Google Cloud / Firebase | Servers, database, file storage, sign-in, push notifications, crash reports | United States |
| Anthropic | AI | United States |
| Google (Gemini API) | AI | United States and other countries |
| Resend | Sending email | United States |
| Cloudflare | Receiving email | Global network |
| Agora | Staff voice calls | Agora's global network |
| Apple, Google | Delivering push notifications; speech recognition on the device | United States |
Services an organization connects itself — its booking system (for example Beds24, Hostfully), smart locks, cleaning and operations services, LINE for its suppliers — receive the data that connection needs. We do not sell personal data or use it for advertising. Card payments, when offered, will be handled by Stripe; Banto does not store card numbers.
5. Data stored outside Japan
Banto's data is stored in the United States (Google Cloud: database in the US multi-region, files in us-central1, daily backups in the US). The United States has no general federal data protection law like Japan's; some states have their own laws. The providers above are bound by contract to protect the data, including the EU Standard Contractual Clauses for transfers from the EU, the United Kingdom and Switzerland.
6. How long we keep it
- Account data: while the account exists; see Account deletion for what is deleted and what the organization keeps.
- Attendance records (punches, their corrections, time on tasks): 5 years from the pay day, kept for the organization as the employer (Article 109 of Japan's Labour Standards Act), then deleted automatically. Shifts and pay rates stay with the organization's staff records.
- Crash reports: 90 days. Backups: deleted data stays in backups for up to 60 days, and deleted files can be restored for 7 days.
- When an organization's contract ends, it can export its data; on its request we delete the organization's data within 90 days, except what the law requires to be kept.
7. How we protect it
- Organisation: one person is responsible for the system and its access; incidents follow a written procedure, and affected organizations are told without undue delay.
- Access: staff see only what their role allows; the strictest records (passport copies, pay rates, guest registers) are limited to managers, and each time a passport copy is opened it is recorded.
- Technology: encryption in transit and at rest, a second layer of encryption for passport copies and connection keys, daily backups with point-in-time recovery, monitoring and alerts.
- Facilities: data centres of Google Cloud.
8. Your rights
You can ask us to tell you what data we hold about you, to correct it, to delete it, or to stop using it (and, in the EU and the UK, to object or to receive it in a portable form). Write to support@bantohq.com. We confirm who you are and answer without undue delay; there is no charge. If the data belongs to an organization's records (for example attendance), we pass the request to that organization. You can also complain to the Personal Information Protection Commission of Japan or to your local data protection authority.
9. Children
Banto is a service for businesses and their staff and is not meant for children.
10. Changes
When this policy changes, the new version is published here with a new version number. Important changes are also announced in the service.