Privacy notice

Version 2026-09-29.

You can save or print this page for your records, or download a PDF copy.

Responsibility and contact

Kevin Tran, carrying on business as Banh in Ontario, Canada, operates Banh Cloud and the Banh websites. Based in Hamilton, Ontario, Canada. Kevin Tran is responsible for privacy inquiries. Contact support@banh.dev.

This notice covers hosted services and websites. Running the open-source software locally does not by itself send workflow inputs to Banh Cloud; the providers and services you configure have their own processing practices.

Information and purposes

We process account identifiers and authentication information to provide access and protect accounts. Our authentication provider handles sign-in credentials; Banh Cloud does not receive your password.

Cloud stores submitted workflow source and versions, run inputs, outputs, decision traces, errors and timing information to execute workflows and provide history. Workflow content needed for inference is sent to our model provider. Avoid submitting secrets or sensitive regulated personal information.

We maintain subscription, payment-status and usage records to administer plans, prevent duplicate charges, enforce allowances and resolve disputes. Our payment provider handles card details; Banh Cloud does not store full card numbers.

We process request and security information, such as network addresses, request times and error information, to operate and protect the service. If you contact support, we receive your contact details and the content you send. Please do not include passwords or API keys in support messages.

Service providers and transfers

We use providers for authentication, payment processing, model inference, hosting, storage and email. They receive information needed for their roles. Information may be processed outside Canada, including in the United States, where local laws and lawful government-access requirements may differ.

Our current inference provider states that it does not use submitted inputs to train or fine-tune models. This is not a zero-retention service. Provider processing is separate from the run-history expiration described below.

We may disclose information when legally required or necessary to investigate abuse and protect people’s rights and security, subject to applicable law.

Retention

New Cloud runs have a detailed-history retention period based on the plan at admission: seven days for Starter and fourteen days for Pro, measured from completion. Expired run records are removed by periodic cleanup.

That window does not apply to all data. Workflow versions remain stored separately. Account records, usage and billing ledgers, operational records, support correspondence and backups have separate retention needs. Cancelling renewal does not automatically delete your account or workflow versions.

We retain account identifiers and workflow versions while the account is in use so you can sign in and keep using deployed workflows. You may request account closure and removal of stored workflow content through support. Some older run records predate automatic expiration; we include these in deletion requests.

Billing, usage and acceptance records are kept where needed to establish what was purchased, reconcile payments, meet tax and accounting obligations, prevent fraud and handle claims. We retain the minimum records needed for those purposes; removing run content does not reset billing usage. Legal holds can extend retention.

Operational logs are retained for troubleshooting and security under the logging provider’s retention settings. Sent operator-alert queue records are removed after 30 days; unresolved delivery records remain until investigated. Support correspondence is kept while resolving the request and where needed to document billing, privacy or other disputes. We review retained support and account-closure records and remove information that no longer serves these purposes.

Deleted data may remain temporarily in restricted recovery backups until those backups expire. Backups are not used to provide ordinary account access. If we restore a backup, we reapply recorded deletion requests. External providers may retain their own records for legal, security or contractual purposes; our run-history window does not set their retention periods.

Our role and your rights

For account administration, billing, security and support, Banh determines why information is processed. Where we handle personal information inside a business customer’s workflows on its instructions, that customer determines its purpose. Contact us about data-processing terms before submitting personal information that requires such an agreement.

Where European or UK data-protection law applies, we rely on performing our contract with you, legal obligations, and legitimate interests in operating and securing the service and resolving disputes, as appropriate to each purpose. Where consent is required, we request it separately and you can withdraw it. Contract acceptance is not consent to unrelated processing. You can ask us about our processing providers and applicable international-transfer safeguards.

Choices and requests

Contact support to request access, correction or deletion of personal information, or to raise a privacy concern. We may verify your identity before acting. Some records may need to remain for legal obligations or disputes; we will explain applicable limits. Depending on applicable law, you may also request restriction or portability, or object to processing. We respond within the applicable legal deadline and explain any permitted extension. You may complain to the Office of the Privacy Commissioner of Canada, your local European supervisory authority, or the UK Information Commissioner’s Office, as applicable.

For information submitted by a business customer about someone else, we may need to coordinate the request with that business. We do not treat a customer’s acceptance of terms as permission to use other people’s data for any purpose.

Websites and age restriction

The public website does not require an account to read documentation or policies. Our website code does not add advertising or analytics trackers. Hosting providers process connection information to deliver and protect the sites. Sign-in and checkout providers use their own cookies and processing practices; their notices are available in those flows.

Banh Cloud is for adults aged 18 and over. If you believe a child has supplied personal information, contact us so we can investigate and remove it where required. We will publish changes to this notice and notify affected customers of material changes where required.