Privacy Policy

Effective October 19, 2026

Tymosoft ("we", "us") complies with Japan's Act on the Protection of Personal Information ("APPI") and related laws when handling personal information through Baitoworks, our shift, attendance and payroll service (the "Service"), and this website. This policy explains what we collect, how we use it and how we protect it.

1. Operator

• Name: Tymosoft
• Address: 10th Floor, CEO Building, Lot HH2-1, Me Tri Ha Urban Area, Pham Hung Street, Tu Liem Ward, Hanoi, Vietnam
• Representative: Nguyen Trong Hieu
• Contact: [email protected]

2. Scope and our role

This policy covers two kinds of information:

• Information we collect ourselves: about website visitors, people who contact us, request documents or sign up, and the contacts of businesses that use the Service ("Customers"). We handle it as the business responsible for it under the APPI.
• Information Customers enter into the Service: about their employees and staff ("Staff"). We handle it on the Customer's behalf, only as needed to provide the Service. Customers are responsible for informing Staff of the purposes of use and obtaining any consent required.

3. Information we collect

3.1 On this website

• What you enter in the contact and document request forms: name, email, phone number or LINE ID, company or store name, number of staff, what you are interested in, display language.
• Ad measurement data: where you came from (utm parameters, ad click IDs, etc.).
• Data kept in your browser: your chosen language, and the name and email you entered when requesting documents (so you do not have to type them again).

3.2 In the Service

• Account information: name (including kana reading), email, phone number, address, date of birth, gender, nationality, emergency contact, profile photo.
• Residence documents: number, expiry date and images of residence cards (在留カード), passports and student cards; school name and enrollment period.
• Shifts and attendance: shift preferences, assigned shifts, clock-in/out times, GPS location at clock-in/out, face photo at clock-in/out, face match results.
• Payroll: hours worked, pay rates, allowances, deductions and other data needed to calculate pay.
• Communication: messages, attachments, notification read status.
• Device: tokens used to send push notifications.

Location is read only when Staff clock in or out. The app does not track location continuously.

4. Purposes of use

4.1 Information we collect ourselves

• To answer inquiries, send documents, and arrange demos and quotes.
• To tell you about the Service (new features, pricing, etc.). You can opt out at any time.
• To handle contracts, billing, support and important notices for Customers.
• To improve this website and our advertising, and to analyze usage.

4.2 Information in the Service (handled on the Customer's behalf)

• To provide the Service's features: scheduling, attendance, payroll, document expiry tracking and messaging.
• To prevent attendance fraud: location checks, face matching, detecting reused photos.
• To fix problems, keep the system secure and provide support.
• To improve the Service using statistics processed so that no person or business can be identified.

We do not use information in the Service for our own advertising or for any purpose other than those above.

5. Face photos and face matching

• Face matching runs only if the Customer turns it on. The photo taken at clock-in/out is compared with the photo the Staff member registered to calculate a similarity score, using Amazon Rekognition by Amazon Web Services (Tokyo region).
• By default, face photos taken at clock-in/out are deleted automatically 180 days after they are taken. Attendance records and match results are kept. The retention period can be changed by agreement with the Customer.
• To detect reused photos, we keep a hash calculated from each photo. A face cannot be rebuilt from this hash.
• Match results are used only to confirm attendance.

6. Automatic reading of residence documents

Reading text from images of residence cards and other documents is enabled only if the Customer agrees to use it. When enabled, images are sent to an external AI service (models such as Google's Gemini, via OpenRouter, Inc.). Reading results are deleted after 30 days; fields saved to the Staff record are kept.

7. Disclosure to third parties

We do not disclose personal information to third parties without consent, except where the law allows it (when required by law, to protect life or property, to cooperate with public authorities, etc.).

8. Service providers

We entrust part of the processing to the providers below and supervise them appropriately:

9. Transfers outside Japan

Some providers in section 8 are located in the United States. We use them only after confirming they have systems in place that meet the standards of the APPI. For the US privacy framework, see the website of Japan's Personal Information Protection Commission. You can request information about these measures through the contact in section 14.

We are based in Vietnam. Our staff may access information from Vietnam to operate, maintain and support the Service, with the same security measures described in section 10. We also comply with Vietnam's personal data protection laws.

10. Security measures

• Encrypted connections (HTTPS).
• Uploaded files are kept in private storage and shown only to signed-in users through signed links that expire.
• A separate server and database for each Customer.
• Role-based access; two-factor authentication for administrators.
• Regular backups; staff training and supervision of service providers.

11. Retention

• Website inquiries: as long as needed to follow up, up to 3 years after the last contact.
• Service data: for the term of the contract. After the contract ends, the Customer has 60 days to export its data; it is then deleted, including from backups over time.
• Face photos at clock-in/out: 180 days (default).
• Residence document reading results: 30 days.
• Support chats: 180 days.
• In-app notifications: 7 days.

12. Demo environment

Data in the demo environment (demo.baitoworks.com and the demo app) is wiped and rebuilt regularly. Please do not enter information about real people.

13. Cookies and browser storage

• This website stores your chosen language and document request details in your browser (localStorage).
• We may use analytics tools (such as Google Analytics) and advertising tags. In that case, browsing data is sent to those providers through cookies. You can turn cookies off in your browser settings.
• Videos are embedded in privacy-enhanced mode (youtube-nocookie.com) and connect to YouTube only when you press play.

14. Your rights and contact

We respond to requests for disclosure, correction, addition, deletion, suspension of use, suspension of third-party provision and disclosure of third-party provision records, as required by law. Information in the Service is managed by the Customer, so Staff should first contact their employer; we will work with the Customer. We may ask you to verify your identity.

Contact: [email protected]

15. Changes

We may change this policy when the law changes or as needed. Changes take effect when posted on this page.

The Japanese version of this policy is authoritative. The Vietnamese and English versions are reference translations.

Terms of Service →