privacy-2026-10-22-r2 · Effective October 22, 2026 · Current version.
Banay OS Privacy Policy
Effective Date: October 22, 2026
1. Who we are and what this covers
In plain English: This policy explains how Banay OS handles personal information.
This Privacy Policy describes how Dom's Workshop, Inc. ("Provider", "we") collects, uses and shares personal information in connection with Banay OS (the "Service"). Business customers ("Customers") use the Service to run their companies. When we process personal information that a Customer or its users enter (for example, about the Customer's clients or crew), we do so on the Customer's behalf as its service provider or processor, and the Customer's own privacy notice governs. Capitalized terms not defined here have the meanings in the Banay OS Terms of Service.
2. Information we collect
In plain English: We collect account details, your business data, and, only when features are used, location, photos, voice and device information.
Account and profile: name, username, role, email, phone (and whether the email and phone were verified, with the time), home address (optional, used for commute and leave-time reminders), language preference and password (stored only as a salted hash).
Business content (Customer Data): clients' names and contact details, job addresses, estimates, invoices, payments, contracts, e-signatures, receipts, materials, schedules, tasks, notes, chat messages, photos, videos, files and reports.
Location: for time clock, crew GPS, door-hanger routes and, if the company turns it on, the mileage log. Collected only while a user is clocked in (from clock-in to clock-out, or during a door-hanger shift), and only after the user accepts the in-app location notice. The mileage log is off for new companies; when the owner turns it on, drives are recorded only while the driver is clocked in and inside the company's work hours, after the driver accepts the mileage notice (see Section 7). On the native Apps location may continue in the background during a clocked-in shift, with a visible indicator. During setup, the app may ask the phone for its location once to check that the permission works; that reading is not sent to us or stored. Detailed location is deleted after 90 days.
Incident reports: if a user files an incident report (for example an injury, property damage or a safety hazard), the description, photos, video and voice notes, which may include health information about the people involved.
Audio and transcripts: voice notes, AI Update recordings, site walkthroughs, and (if enabled) AI phone calls, plus their transcripts and translations.
Electronic-signature records: signer name, signature image or typed signature, IP address, device and browser, timestamps, consent text and document hashes.
Integration data: data you choose to connect, for example Google Calendar events, Google Drive files the app creates, Gmail messages (receipts and inbox triage, if enabled), Quo texts, calls, voicemails and transcripts, and hours exported for payroll.
Device and usage: IP address, device and browser type, push-notification tokens, log data, setup and permission status, and an activity and audit log of actions in the Service.
Payments: processed by Stripe. We receive payment status and limited details. We do not store full card numbers.
3. How we use information
In plain English: We use the information to run the Service, power its AI features, keep it secure, and improve it. We do not sell it.
To provide and operate the Service and its features (time clock, estimates, e-signature, filing, scheduling, chat, notifications and reports).
To power AI features, including estimating, receipt reading, transcription, translation, summaries, drafting and automated actions.
To secure the Service, prevent fraud and abuse, keep audit trails, and troubleshoot problems.
To communicate with you about the Service, including notices, support and changes to terms.
To improve and develop the Service, including using aggregated or de-identified data.
To comply with law and enforce our terms.
We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use location data for advertising.
4. How we share information
In plain English: We share data only with the service providers that make the app work, with public map services (addresses and map coordinates only), with integrations you turn on, or when the law requires it.
Service providers (subprocessors): hosting (DigitalOcean), AI model providers (currently xAI, for estimating, vision, transcription, translation and image generation), email delivery, and, if enabled, Bland AI (calls) and Stripe (payments).
Maps and address lookup. To turn addresses into map pins, suggest addresses as you type, show the address near a clock-in, and estimate drive times, our servers send the address text or the map coordinates (never names or contact details) to public mapping services: OpenStreetMap's Nominatim, komoot's Photon and the U.S. Census Bureau geocoder. Maps in the app load map images directly from OpenStreetMap's tile servers, which receive your device's IP address and the area being viewed. These services are not under contract with us and handle that data under their own privacy policies.
Integrations you connect: Google, Quo, Gusto and others, as directed by the Customer.
Within the Customer's company: according to the roles and permissions the Customer configures.
Legal and safety: to comply with law, legal process or government requests, or to protect rights, safety and the Service.
Business transfers: to an affiliate or successor entity, or in a merger, acquisition or asset sale.
5. Google user data
In plain English: If you connect Google, we use that data only to provide the features you turned on.
Banay OS's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide user-facing features (calendar sync, Drive filing and backups, and receipt and inbox processing). It is not used for advertising, is not sold, and is not used to train generalized AI models. Humans do not read it except with your consent, for security purposes, or as required by law.
6. AI processing
In plain English: Some features send the data they need to an AI provider to get an answer. The AI can be wrong, so you review its drafts. Your data is not used to train the provider's models.
Which features. Estimating and estimate drafts, receipt and document reading, photo analysis, voice-note transcription, translation, summaries, drafted messages, automated actions, and, when available, the in-app support assistant ("Banay support · AI assistant").
What is sent. Only the data a feature needs for that request, for example the job details and photos for an estimate, a receipt image, or a voice note. Data is sent over encrypted connections to the AI model provider listed in Section 4 (currently xAI).
Training. We don't use Customer Data to train generalized AI models, and we do not sell it. Aggregated or de-identified data we create (Terms Section 8) does not include data received from Google APIs. Under our AI provider's current API terms, it does not use our requests or its answers to train its models. The provider may keep requests for up to about 30 days for security and abuse monitoring, then deletes them.
Support assistant. When available, the support assistant answers using only the asking company's own data that the person asking is allowed to see, plus our general help content, never another company's data. Any fix it makes automatically is recorded in the company's activity log.
Drafts, not decisions. AI results are drafts and can be wrong. Estimates and other drafts may show "AI draft. Review before sending." A person at the Customer reviews and decides what to send, sign, charge or file. We do not use AI to make decisions about people that have legal or similarly significant effects on them.
Google data. Data received from Google APIs is handled as described in Section 5 and is never used to train generalized AI models.
7. Crew location and mileage
In plain English: The app records a crew member's location only while they are clocked in, and only after they read a notice about it. If the company turns on the mileage log, drives are recorded only while clocked in and inside work hours. Detailed location is deleted after 90 days.
When. Banay OS checks and records a crew member's location only while that person is clocked in, from clock-in to clock-out (for door hangers, during their door-hanger shift), and only after they accept the in-app crew notice. It does not track anyone who is clocked out. Location points sent from the phone outside those times are rejected by the server. On the native Apps, location may continue in the background during a clocked-in shift, with a visible indicator.
What. The location at clock-in and clock-out, and, where the company uses crew GPS, door-hanger routes or the mileage log, route points during the shift.
Mileage log. The mileage log is off for new companies until the owner turns it on, and each driver must accept the mileage notice first. If your company turns on the mileage log, drives are recorded the same way: only while you're clocked in, within your company's work hours, to measure business miles. Nothing is recorded before you clock in, after you clock out, outside work hours, on holidays, on days that are not work days or on a day you mark off, and the server throws away any point taken then. A drive records the date, start and end place, route points, miles, vehicle and business purpose, with an edit history. Your company's owner and admins can see it, and you can see your own. You can stop a drive at any time and turn off auto-detect.
Why. To record hours and the job worked, to support payroll and mileage records, and to show the company where work was done during the shift.
Home address. If a crew member saves a home address, it is used for commute and leave-time reminders. We do not read the phone's location for those reminders.
Who sees it. The owner and office/admin users you choose see location; crew see only their own.
How long. Detailed route points and clock-in and clock-out coordinates are deleted after 90 days (the company can choose a shorter period, not a longer one). The shift summary stays with the time records: times, hours, job, street address label and miles.
Notice. Each crew member gets a copy of the crew notice they accepted and can reopen it in the app. Location is never used for advertising.
8. Text messages
In plain English: When the app helps you text someone, it opens your phone's messaging app and you send the text from your own number. Marketing texts need your express consent, and you can reply STOP.
Texts you send. When Banay OS helps you text a client, crew member or invitee (for example a signing link, an invite or a job update), it opens your phone's messaging app with a draft. You review it and send it from your own phone number. The Customer is the sender of those messages.
Verification codes. When we verify a new company owner or a user, we may text a one-time code to the mobile number given, only after the person ticks this consent next to the phone field: "Text me a verification code. I agree that Banay OS may send one-time verification and account-security texts to this number. No marketing texts. Up to 5 texts for this sign-up. Message and data rates may apply. Reply STOP to opt out, HELP for help." The code is used only for verification and account security, never for marketing. We keep a record of the consent.
Invites. When an owner or admin invites someone by text, the text is sent from the inviter's own phone, not by Banay OS. We store the invitee's name, email or phone number and invite status so the invite works.
Signing codes. If text delivery is set up for a company, a one-time code to sign a document can be sent by text to the number given for that signature. It is used only for that purpose.
Marketing texts. We send marketing texts only to people who have given express consent. Consent is not a condition of purchase. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. We keep a record of the consent.
Imported texts. If a Customer connects a phone service (for example Quo), texts and call records from that line are imported for that Customer.
We do not sell or share phone numbers or text opt-in consent with third parties for their own marketing.
9. Retention and deletion
In plain English: We keep data while your account is active and for a short time after, then delete it. Some records are kept longer because the law requires it.
While your account is active: we keep personal information as needed to provide the Service.
When your agreement ends: if you don't sign a new 12-month agreement, the account becomes read-only on the day after your agreement's end date, and you can export your records and files for 30 days.
When you ask us to delete: we lock the account right away and delete its data within 30 days. Backup copies roll off within about 30 days after deletion.
Payroll and time records: kept as wage law requires (up to 3 years).
Location: detailed route points and clock-in and clock-out coordinates are deleted after 90 days (see Section 7).
Signed agreements, acceptance records and billing records with us: kept after an account is deleted, as needed for tax, accounting and legal claims.
How to ask: End Users may request account deletion in the App (Settings › Account › Delete your account), at use.banay.app/delete-account (no sign-in needed), or by emailing dom@doms-workshop.com. Requests about a Customer's data may be referred to that Customer.
10. Security incidents and breach notice
In plain English: If a breach exposes your personal information, we tell you as soon as possible and tell the regulators the law requires.
If we learn of a security breach involving personal information, we promptly determine whether the information has been or is reasonably likely to be misused. If it has been or is reasonably likely to be misused, or if we cannot tell, we notify the affected people as soon as possible, as New Hampshire law requires (RSA 359-C:20) and as other applicable state laws require. Notice may be delayed only if a law enforcement agency determines that it would impede a criminal investigation or jeopardize national or homeland security.
How we notify: by email, in writing or by phone. The notice describes the incident in general terms, the approximate date of the breach, the type of personal information involved, and a phone number to reach us.
Regulators: we also notify the New Hampshire Attorney General's office (or the regulator the law names), including the expected date of the notice and about how many New Hampshire residents will be notified. If more than 1,000 people must be notified, we also notify the nationwide consumer reporting agencies.
Data we hold for a Customer: when the personal information belongs to a Customer (for example its clients or crew), we notify that Customer immediately after we discover the breach and cooperate with it so it can meet its own notice duties.
11. Security
In plain English: We protect data with reasonable safeguards, but no system is perfect.
We use measures such as encrypted connections (TLS), salted password hashing, role-based access enforced on the server, firewalls, rate limits, audit logs and encrypted backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Your choices and rights
In plain English: You can control permissions on your phone and ask to access, correct or delete your data.
You can turn off location, camera, microphone and notification permissions in your device settings, though some features will then not work. Depending on where you live (for example New Hampshire, California or other states with consumer privacy laws), you may have rights to access, correct, delete or obtain a copy of your personal information, and to opt out of certain processing. Contact dom@doms-workshop.com. We will verify your request and respond as the law requires. Where we process data for a Customer, we will forward your request to that Customer or help it respond. We will not discriminate against you for exercising your rights.
13. Children
In plain English: Banay OS is not for children.
The Service is for business use by adults. It is not directed to children under 16, and we do not knowingly collect their personal information.
14. Changes and contact
In plain English: We will post updates here. Contact us with any questions.
We may update this policy and will post the new version with its effective date. For material changes, we will notify you in the app or by email.
Dom's Workshop, Inc. | 252 Daniel Webster Hwy, Suite 1185, Nashua, NH 03060 | (978) 775-8642 | dom@doms-workshop.com