MBS Attendance — WordPress Plugin Privacy Policy

Effective date: 10 May 2026

Overview

This Privacy Policy applies to the MBS Attendance WordPress plugin and its companion add-on plugins (MBS Bulk Lunch, MBS Staff Credit) developed and sold by myBad Studios. The plugin is self-hosted software — it runs on your WordPress installation and all data it collects is stored in your own database, under your control.

As the business operator installing this plugin, you are the data controller for all employee information it handles. myBad Studios is neither a data processor nor a data controller for your employees' personal information.

Data collected by the plugin

The plugin stores the following categories of data in your WordPress database on your own server:

• Employee records — name, employee number, national identity number, date of birth, department, role, contact details and employment notes
• Biometric data — employee photos used for ID badge generation and facial recognition via the iOS companion app. Photos are stored in your WordPress media library.
• Attendance records — clock-in and clock-out times, lunch breaks and attendance history
• Leave records — leave requests, approvals, balances and leave history
• Payroll data — pay rates, payroll components, generated payslips, PAYE and UIF deduction records
• Staff credit records — loans, store credit transactions and repayment history (if the MBS Staff Credit add-on is installed)
• System settings — company name, logo, brand colour, tax brackets and payroll configuration

All of the above is stored exclusively in your WordPress database. myBad Studios has no access to any of this data.

Data myBad Studios receives

The only data transmitted to myBad Studios' infrastructure is what is required for software license validation:

• License key — validated against myBad Studios' license server when the plugin is activated and periodically thereafter
• Your site URL — recorded to enforce the activation limit on your license
• Plugin version — recorded to track which version is in use

No employee data, payroll information, attendance records or any other business data is transmitted to myBad Studios at any time.

WooCommerce purchase data

When you purchase MBS Attendance through mybadstudios.com, WooCommerce collects the information necessary to process your order:

• Name and email address
• Billing address
• Payment information (processed by the payment provider — myBad Studios does not store card details)

This information is used to fulfill your order, deliver your license key and provide purchase support. It is stored on mybadstudios.com's WordPress installation and is not shared with third parties except as required to process payment.

Your responsibilities as the data controller

Because all employee data is stored on your server and under your control, you are the data controller for that information. You are responsible for:

• Complying with all applicable privacy laws in your jurisdiction, including the Protection of Personal Information Act (POPIA) in South Africa and the General Data Protection Regulation (GDPR) in the European Union
• Obtaining employee consent before collecting biometric data (photos) for facial recognition purposes
• Providing employees with a privacy notice that explains what personal information you collect and how it is used
• Securing your WordPress server, database and backups against unauthorised access
• Responding to employee requests to access, correct or delete their personal information
• Determining appropriate data retention periods and deleting records no longer needed

Biometric data guidance

The plugin stores employee photos and the iOS companion app generates facial recognition embeddings from those photos. Biometric data is particularly sensitive under most privacy laws. We recommend:

• Obtaining written consent from each employee before uploading their photo
• Documenting that consent using the POPIA consent checkbox built into the employee record
• Allowing employees to opt out of facial recognition — they can still clock in using PIN or QR code
• Using the built-in "Remove biometric data" function to delete photos and embeddings if an employee withdraws consent

Data security

myBad Studios has designed the plugin with security in mind — all API communication between the iOS app and your WordPress server uses HTTPS, authentication tokens expire and are stored securely, and the plugin follows WordPress security best practices. However, the security of your server, database and backups is your responsibility.

Third-party services

The plugin does not send data to any third-party analytics, advertising or data collection services. The license validation calls go only to mybadstudios.com.

The iOS companion app communicates only with your own WordPress server. No data passes through myBad Studios' infrastructure during normal operation.

Data retention

The plugin does not automatically delete any data. You control how long employee records, payroll data and attendance history are retained. We recommend establishing a data retention policy appropriate for your business and jurisdiction.

Children

MBS Attendance is a business management tool intended for use with adult employees. It is not directed at children and myBad Studios does not knowingly collect information from anyone under the age of 13 through this software.

Changes to this policy

myBad Studios may update this Privacy Policy from time to time. Changes will be posted at this URL with an updated effective date. Continued use of the plugin after changes are posted constitutes acceptance of the updated policy.

Contact

If you have questions about this Privacy Policy or about data handling in MBS Attendance, please contact myBad Studios at:
attendancesupport@mybadstudios.com