Privacy Policy
Last updated: 2026-11-05
This policy explains how the operator of the Banshao service (“we”) handles personal data. Banshao records employees' working time and screens, so this policy is written both for companies using the service and for the employees being recorded.
1. Our role
For company data (hours, screenshots, window titles, idle time, employee details and so on), the company using the service decides whether to record, whom and why, so it is the controller of that data. We process it according to the company's settings and instructions, so we are its processor. The Data Processing Terms (/dpa) govern this relationship.
For account and billing data (owner and manager accounts, invoices, payment records, email logs, support messages sent to us, and security records of the website), we decide how it is handled, so we are the controller.
2. The data we handle
The table lists the categories. Hours, screenshots and window titles only arise after an employee clicks “Clock in”.
| Category | What it includes | Our role |
|---|---|---|
| Employee details | Name, email, language, team, status, notes entered by the company, a salted hash of the password. | Processor |
| Hours | Clock-in, clock-out and break times, and why a shift ended. | Processor |
| Screenshots | Images and thumbnails of the screen holding the app window, with the time taken. An image contains whatever was on that screen, which may include other people's information. | Processor |
| Activity data | The active window's title (on a Mac, also the app name) and seconds of keyboard and mouse inactivity, recorded with screenshots and with connection signals during a shift. No keystroke content, microphone or camera. | Processor |
| Device and network | Device name, operating system, app version, when the device was last seen; the IP address and time of each employee sign-in and clock-in. | Processor |
| Company and admin accounts | Company name, time zone, language and settings; owners' and managers' names, emails and salted password hashes; the agreement version accepted and when; an action log. | Controller |
| Billing and payments | Invoice amount, seats, term and status, plus the transaction hash and sending wallet address. We do not collect bank card details. | Controller |
| Email and support | Sending logs (recipient address, type, language, status), and whatever you send us by email or Telegram. | Controller |
| Security records | IP addresses when you visit the site, used to limit attempts and to spot unusual sign-ins. The IP of an unusual sign-in attempt may appear in operational alerts sent to us. | Controller |
While the app is open but off shift or on a break, it still sends a periodic connection signal, which also carries the window title and idle time. The server uses it only to update when the device was last seen and the shift status. It does not store those titles or durations, and no screenshot is taken.
If the network drops, screenshots and their details are kept on the employee's computer, up to 200, and are removed once uploaded or at clock-out. The app stores a device token rather than the password on the computer, and keeps a run log locally.
3. Purposes and lawful basis
We use data to: provide and run the service; show hours and screenshots according to the company's settings; issue invoices and confirm payments; send invitation, verification, password reset, invoice and expiry emails; give support; protect the security of the service and detect misuse; and meet legal obligations. We do not sell this data, use it for advertising, or use company data to train models or build profiles.
For data we control, we rely on the grounds recognised by applicable law, which depending on the case may be performing a contract, legitimate interests, a legal obligation or consent. For company data, the lawful basis is for the company to determine and answer for; we cannot determine it on the company's behalf.
4. Who can see what
Each company's data is kept separate. Access works like this:
| Role | Can see |
|---|---|
| Owner and managers | All employees' details, hours, screenshots, window titles, idle time, device details and IP records, plus billing and settings. |
| Team lead | Hours and screenshots (with window titles and idle time) of members of the teams they lead. Not IP records or other teams. |
| Employee | Only their own hours, screenshots and sign-in records. |
| Our platform administrators | Billing and usage of all companies; when support or maintenance needs it, a read-only view of a company's dashboard, including hours and screenshots. This view cannot change anything, each opening is logged, and it is not used for anything else. |
When the service expires without renewal, nobody can view screenshots until it is renewed.
We may disclose data to an authority where the law requires it. Where allowed, we will tell the company concerned first.
5. How long data is kept
The table shows the current rules. Automatic deletion runs once a day, so data may be removed about a day after the period ends.
| Data | How long |
|---|---|
| Screenshots and thumbnails | As the company sets: 14 days by default, from 1 to 90 days, then deleted automatically. |
| Window titles and idle time from shifts | The same period as screenshots. |
| Sign-in and clock-in IP records | 90 days. |
| Hours and breaks | No fixed period: kept until the employee is deleted or the company is closed. |
| Employee and device details | Kept until the employee is deleted or the company is closed. Deactivating an employee does not delete data. |
| Accounts and invoices | No fixed period at present: kept until the company is closed. Sign-ups that never verify their email are deleted after 7 days. |
| Action logs | 365 days. Records of payments, company closure and terms acceptance are kept until the company is closed. |
| Email logs | 90 days. |
| Conversations with the website AI assistant | We do not store the content, only counters used for rate limits. The conversation stays in the open page and is gone when you close it. |
| Export file when closing a company | Deleted with the company's data 24 hours after the download, or when the owner confirms it is saved, or 7 days after packing if never downloaded. |
| Server backups | Encrypted once a day, with each backup kept for 3 days and then deleted automatically. |
When the owner or a manager deletes an employee, that person's hours, screenshots, device, sign-in and clock-in records, and log entries mentioning their email are deleted at once. Copies in backups remain for up to 3 days.
When a company is closed all its data is deleted, and copies in backups remain for up to 3 days. After that, only items no longer linked to the company remain: public blockchain transaction records, reconciliation records of manually confirmed payments, and one closure log entry with only the company's number. If an email address is also used by another account, email and log records about that address stay. Operational alerts and support messages sent to us live in Telegram or a mailbox and are not deleted automatically with company data.
Expiry or suspension does not by itself delete company data, but retention periods keep running.
6. Sub-processors and third parties
We use the following third parties. We do not sell data to them.
| Third party | Purpose | Data involved |
|---|---|---|
| Cloud hosting providers | Running the application, the database, screenshot storage, encrypted backups and our own mail relay. | All data on the servers; backups are encrypted before leaving the server. |
| Cloudflare | DNS, CDN and proxy; forwarding mail sent to [email protected] to our mailbox. | All traffic to the website and from the app passes through Cloudflare, which terminates HTTPS on its network, so content in transit (including screenshots) passes through its systems. Also IP addresses and mail sent to the support address. |
| Commercial mailbox provider | Holding support mail. | What you send to [email protected]. |
| Recipients' email providers | Receiving the notification emails sent by our mail relay. | Recipient address, name, company name, invitation and invoice links, and other email content. |
| Telegram | Sending operational alerts to us; chats when users contact us at @yuankui666. | Alerts contain company names, seats, expiry dates, amounts, invoice numbers, transaction hashes and wallet addresses, plus platform administrators' emails and the IP addresses of unusual sign-ins. No screenshots, hours or employee names. Also what you send in chats. |
| Anthropic | Generating replies for the AI assistant on the website. | What you type into the assistant and the current conversation. No IP addresses, accounts, hours or screenshots. Please do not enter personal information. Anthropic may keep requests for a limited time under its own policies. |
| TronGrid and the TRON blockchain | Looking up USDT sent to our receiving address, to confirm payments. | A query contains only our receiving address and API key, with no company or employee details. Transfers on the blockchain (amount, addresses, time) are public. |
The website uses no third-party analytics or advertising tools. We may change or add sub-processors and will update this table; see the Data Processing Terms for how companies are told.
7. International transfers
Our servers are currently in Asia and Europe, with backups on a server in another location. Cloudflare and Telegram operate globally. Data may therefore move outside the company's or the employee's country, to places with different levels of protection.
If the company's local law has requirements for international transfers (for example contract clauses, assessments or filings), the company should assess this and contact us before using the service. We do not state that any specific transfer requirement has been met.
8. Security measures
We currently use these measures:
- The website and the app use HTTPS, and the app refuses unencrypted server addresses (except local testing).
- Passwords are stored only as salted hashes (PBKDF2-HMAC-SHA256). After sign-in the app keeps only a device token, and the server stores only that token's hash.
- Data is separated by company and role permissions are checked on every request; sign-in and password reset attempts are limited; forms are protected against CSRF.
- Daily encrypted backups to another server, kept for 3 days.
- Server administration accepts key-based sign-in only, a firewall limits ports, platform administrators' views are logged, and the servers have monitoring and alerts.
These measures have limits: the service does not currently offer two-step sign-in, and the database and screenshot files on the main server are not separately encrypted (they rely on server access controls). No system is perfectly secure. We hold no security certification and make no such claim.
9. Cookies
The website sets only the cookies it needs to work, none for advertising or tracking:
| Name | Purpose | Lasts |
|---|---|---|
| sw_sess | Sign-in for owners and managers | 7 days |
| sw_emp | Sign-in for employees | 7 days |
| sw_csrf | Protects sign-in and sign-up forms | Browser session |
| sw_lang | Remembers your language | 1 year |
| sw_viewas | Used by platform administrators for the read-only view | Browser session |
Cloudflare may set its own cookies for security purposes.
10. Your rights
Depending on the applicable law, you may have the right to access, correct, delete or obtain a copy of your personal data, to restrict or object to some processing, to withdraw consent, and to complain to an authority. These rights and their conditions vary by place.
Employees: please contact your company first. The company decides how this data is used and can correct details, change the retention period or delete an employee in the dashboard. You can sign in on the web at any time to see your own hours, screenshots and sign-in records. If you contact us, we will normally pass your request to your company or ask you to contact it directly, unless the law requires us to handle it ourselves.
Owners, managers and anyone exercising rights over data we control: please contact [email protected]. We may need to verify your identity.
11. Children
The service is not for anyone under 18, and companies must not invite or record them. If you find an account belonging to a minor, please contact us and we will require the company to deal with it or delete the data.
12. Changes and contact
We may update this policy and will post the new version and date on this page. We will announce major changes in the service or by email.
The operator of the Banshao service: [email protected], Telegram @yuankui666, or the /contact page.
Contact: Telegram @yuankui666 · [email protected]