MBS Attendance is a business tool used by employers to manage staff attendance. The app connects to a WordPress server operated and controlled entirely by the employer. myBad Studios does not collect, access or store any employee or business data.
Overview
This Privacy Policy applies to the MBS Attendance iOS application (the "App") developed by myBad Studios. The App is licensed to businesses (employers) who operate their own WordPress server. All employee records, payroll data and business information are stored on the employer's server — not on myBad Studios' infrastructure.
Data stored on your device
The App stores a small amount of data locally on the device to support its features:
Facial recognition cache — When the employer enables facial recognition clock-in, the App downloads employee photos from the employer's server and generates mathematical representations (embeddings) of each face. These embeddings are stored locally in an encrypted cache file. The original photos are not retained on the device. This data is used solely to identify employees during clock-in and is deleted when the cache is rebuilt or the App is uninstalled.
Authentication token — A session token is stored securely on the device to keep you signed in to the employer's server between sessions. This token does not contain personal information.
Offline clock event queue — When the device has no internet connection, clock-in and clock-out events are queued locally and transmitted to the employer's server as soon as connectivity is restored. Queued events are deleted from the device once successfully synced.
Employee and department cache — A local copy of the employee list and department structure is cached to allow the App to function when offline. This data originates from and is controlled by the employer's server.
Data we do NOT collect
myBad Studios does not collect, transmit or have access to any of the following:
Employee names, photos or identification numbers
Salary, payroll or financial information
Clock-in and clock-out records
Leave requests or balances
Device location
Usage analytics or crash reports
Any other personal or business information
All such data is transmitted exclusively between the App and the employer's own WordPress server. myBad Studios has no visibility into this data.
Biometric data
The facial recognition feature processes employee images to generate face embeddings for identification purposes. This processing occurs entirely on the device using Apple's Vision framework. The following applies:
Face embeddings are stored locally on the device only
They are never transmitted to myBad Studios
They are transmitted to the employer's server only as part of a clock event (the identity match result, not the embedding itself)
Employees must provide explicit consent to the employer before their photos are used for facial recognition
The employer is responsible for obtaining and recording this consent in accordance with applicable law, including the Protection of Personal Information Act (POPIA) in South Africa
The employer's responsibility
The employer who operates the WordPress server is the data controller for all employee information. The employer is responsible for:
Compliance with all applicable privacy laws in their jurisdiction, including POPIA (South Africa)
Obtaining employee consent for biometric data collection
Securing their WordPress server and the data stored on it
Their own privacy policy communicated to employees
Third-party services
The App does not integrate with any third-party analytics, advertising or data collection services. The only external connection the App makes is to the employer's own WordPress server at the URL configured during setup.
Data retention
Local device data (face embedding cache, offline queue, employee cache) is retained only as long as needed for the App to function. Uninstalling the App removes all locally stored data. The employer controls the retention of all data on their server.
Children
The App is intended for use by business supervisors and administrators managing adult employees. It is not directed at children under the age of 13 and myBad Studios does not knowingly collect any information from children.
Changes to this policy
myBad Studios may update this Privacy Policy from time to time. Changes will be posted at this URL with an updated effective date. Continued use of the App after changes are posted constitutes acceptance of the updated policy.