Privacy Policy

Last updated: 12 July 2026

This policy explains what personal data BANTAY ("we", "us") collects when you use bantayhse.com and app.bantayhse.com (the "Service"), how we use it, and the choices you have.

1. Data we collect

• Account data — name, email address, password (stored as a secure hash), organization and project names, regulatory-authority preference.
• HSE records you create — observations, toolbox talks, permits, incidents, inspections, training records, and similar entries, which may include photos, voice notes, and names of personnel involved (entered by your organization).
• Technical data — device/browser information and logs needed to operate, secure and rate-limit the Service.
• Payment data — handled by our payment partner (merchant of record); we do not store card numbers.

2. How we use data

• To provide the Service: storing and syncing your records, generating reports and dashboards, sending notifications you enable.
• To operate AI features (e.g. document generation, voice transcription/translation): the relevant content is sent to our AI processor solely to produce the output and is subject to usage quotas. We do not use your content to train models.
• To secure the Service, prevent abuse, and comply with legal obligations.
• We do not sell personal data, and we do not use your HSE records for advertising.

3. Multi-tenant isolation

Each organization is an isolated tenant. Access controls are enforced at the database level (row-level security): members see only their own organization's data. Public QR pages expose only the specific record referenced by the code, via rate-limited endpoints.

4. Where data is stored

Data is hosted with our cloud providers (Supabase/AWS infrastructure and Vercel). Data may be processed in regions outside your country; we choose reputable providers with industry-standard security certifications.

5. Retention and deletion

• HSE records are retained while your organization's account is active — safety records often carry statutory retention duties, so we default to keeping them.
• You can export your data at any time from the app.
• On written request from an organization owner after account closure, we will delete the organization's data within a reasonable period, unless retention is legally required.

6. Workers' personal data

Organizations may record names and details of workers (e.g. on badges, training records, incident reports). The organization is the controller of this data and is responsible for informing its personnel; BANTAY processes it on the organization's behalf to provide the Service.

7. Cookies and local storage

The app uses browser local storage strictly to function: session tokens, offline caching, and your device preferences. The marketing site does not use advertising or third-party analytics cookies.

8. Your rights

Subject to applicable law (including UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection), you may request access, correction or deletion of your personal data, and object to or restrict certain processing. Contact us to exercise these rights.

9. Changes

We will post updates to this policy on this page and update the date above. Material changes will be communicated in the app.

10. Contact

Privacy questions or requests: allanmanumbas@yahoo.com