Privacy Policy
This policy explains how jwslab ("we", "us"), based in Ontario, Canada, collects, uses, discloses and protects personal information in connection with the Onbia app and related services (the "Service"). We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the other privacy laws that apply to you. This policy is also available in French and Korean. If a translation differs from this English version, the English version applies, except that for residents of Quebec the French version applies.
- We collect only what we need to run the Service.
- Your location at check-in is used only to confirm the check-in, and the original coordinates are not kept.
- We do not sell your personal information or use it for advertising.
- You can delete your account at any time from Profile → Delete account in the app.
1. Information we collect
| Type | Information |
|---|---|
| Account | Email address, record of your confirmation that you are 14 or older |
| Optional | Name (a nickname is fine); if you sign in with Apple or Google, the linked account identifier |
| While using the Service | Organizations and groups you belong to and your role, attendance records, points and reward redemptions, notifications and notification settings |
| When you check in | Device location and QR code information (used only to confirm the check-in; the originals are not kept, only the minimum record such as the result) |
| Collected automatically | App installation identifier, push notification token, device type, operating system and app version, usage records, access records (IP address, access time and similar), error records |
If you choose "Hide My Email" with Sign in with Apple, we receive the relay address Apple provides.
2. How we use it
- Account management: verifying you, signing you in, confirming you are 14 or older, closing your account
- Providing the Service: organizations and groups, schedules, check-ins and attendance records, points and rewards, notifications
- Operating the Service: preventing abuse, diagnosing errors, keeping the Service reliable and improving it, statistics that do not identify you
- Answering requests, handling disputes, and responding to violations of the law or our Terms
3. Consent
By creating an account and using the Service, you consent to the collection, use and disclosure of your personal information as described in this policy. You can withdraw consent at any time, subject to legal or contractual restrictions, by changing your device permissions or deleting your account. Some features may not be available without it.
4. Information shared within the Service
The Service is organized into organizations and groups, so the managers of your groups and the admins of your organizations can see your name, role, attendance, points and reward redemptions as needed to run the group. Your email address is not shown to other users. If an organization uses information from the Service outside the Service, that organization is responsible for it under the laws that apply to it.
5. Service providers and where information is stored
We use the service providers below to run the Service. They may process information only on our behalf and must protect it. Your information may be stored and processed in Canada, the United States and other countries where these providers operate, and may be accessible to courts, law enforcement and national security authorities of those countries under their laws.
| Provider | Task | Information | Location |
|---|---|---|---|
| Google LLC (Google Cloud) | Servers and data storage | Information from using the Service | United States |
| Google LLC (Firebase) | Push notifications, crash analysis | Push token, device information, error records | United States and others |
| Apple Inc. | iPhone push notifications | Push token, notification information | United States and others |
| Amazon Web Services, Inc. (Amazon SES) | Sign-in verification emails | Email address, verification code | United States |
We will update this policy if a provider changes. Sign in with Apple or Google, when you choose them, and the map screens in the app (Google Maps, Naver Map) are subject to those companies' privacy policies.
6. Other disclosures
We do not sell, rent or trade personal information. We disclose it outside the Service only with your consent; where the law requires or permits it, such as to comply with legal process or to protect the rights and safety of users and others; or to a successor in a merger, acquisition or transfer of all or part of the Service, which must continue to protect it as described here.
7. Location information
- We check your device location only when you check in to a session that requires it, and we do not collect location while you are not using the app.
- The location is used only to decide whether you are within the check-in area, and the original coordinates are not kept.
- You can change location permission in your device settings at any time. Without it, check-ins that require location are unavailable.
8. Retention
- We keep personal information only as long as needed for the purposes above, then delete it or make it anonymous.
- In particular:
- Group records such as attendance, points and redemptions: kept so group records stay accurate; after you close your account, with your email, name and other identifying information removed
- Records needed to prevent abuse and handle disputes: until that purpose is fulfilled (up to 1 year)
- Access records: up to 90 days
- Information the law requires us to keep: for the period the law sets
9. Security
We protect personal information with safeguards suited to its sensitivity, including encryption in transit, encrypted storage of credentials, role-based access control, limited staff access and cloud data centers with security certifications. No method of transmission or storage is completely secure. If a breach creates a real risk of significant harm to you, we will notify you and the authorities as the law requires.
10. Children
The Service is for people 14 or older and is not directed to children. If we learn we have collected information from someone under 14, we delete it without delay.
11. Your rights
- You may ask to access or correct your personal information, ask us to delete it, or withdraw your consent.
- You can change your name and notification settings in the app's Profile, and close your account under Profile → Delete account. If you cannot use the app, see how to request account deletion.
- Send other requests to the contact below. We may need to confirm your identity, and we respond within 30 days unless the law allows more time.
- The law may limit some requests; if we cannot fulfill one, we will tell you why.
- If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or the privacy authority where you live.
12. United States residents
Depending on the state you live in, you may have the right to know what personal information we hold about you, to access, correct or delete it, and to opt out of its sale, its sharing for targeted advertising, or profiling. We do not sell or share personal information, we do not use it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. Precise location is used only to confirm a check-in you start. To exercise your rights, contact us below; you may use an authorized agent, and we will not treat you differently for exercising them.
13. Quebec residents
If you live in Quebec, the Act respecting the protection of personal information in the private sector also applies, and:
- Location technology: the app's location function is off by default. It runs only when you start a check-in that requires it and you have allowed location permission. We do not use technology to profile you.
- Automated decisions: whether a check-in is accepted is decided automatically from your location, the time and the session's settings, and the app shows you the result. You may ask us what information was used and the main reasons for the result, ask for that information to be corrected, and ask a manager of the group, who can correct attendance records, to review it.
- Portability: you may ask for the personal information you gave us in a structured, commonly used technological format.
- Dissemination: you may ask us to stop disseminating your personal information, as provided by law.
- Outside Quebec: your information may be stored and processed outside Quebec, as described in section 5. Before doing so, we assess whether it will receive adequate protection.
- Confidentiality incidents: we keep a register of incidents, and if one presents a risk of serious injury, we notify the Commission d'accès à l'information and the people affected.
- Governance: our privacy officer (section 15) oversees how personal information is handled, access is limited to those who need it for their work, information is kept and destroyed or anonymized as described in section 8, and complaints are handled by the privacy officer, who replies within 30 days.
- Complaints: if you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec.
14. Cookies and tracking
The app does not collect advertising identifiers and does not track you across other companies' apps or websites. This website does not use cookies.
15. Privacy officer
Our privacy officer is responsible for our compliance with this policy and is the person in charge of the protection of personal information. For questions, requests or complaints, contact:
jwslab Privacy Officer
Email: jws.onbia@gmail.com
16. Changes
We post changes to this policy on this page or in the app before they take effect: 7 days before, or 30 days before for changes that significantly affect your rights.