Legal

Privacy Policy

Last updated: 21 October 2026
Applies to: Idea House Solutions websites, the IDEA House HR employee mobile app (Android & iOS), the IDEA House ERP mobile app (Android & iOS), IDEA House ResPOS restaurant point of sale (web app and Android & iOS staff app), IDEA House MyMemory (Android & iOS personal app), and IDEA House ClassHub (Android & iOS class and schedule app, with a web portal for organizers and administrators at classhub.ideahousesolutions.com), and IDEA House MyCall (private video calling: Android app and web app at mycall.ideahousesolutions.com), and IDEA House Sales Bonus (member and reseller sales bonus app: Android app and web app at salesbonus.ideahousesolutions.com)

Idea House Solutions Co., Ltd (“Idea House,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have when you use our websites or our applications for IDEA House HR, IDEA House ERP, IDEA House ResPOS, IDEA House MyMemory, IDEA House ClassHub, IDEA House MyCall, and IDEA House Sales Bonus (each an “App,” and together the “Apps”).

1. Who this policy covers

This policy covers:

• Visitors to ideahousesolutions.com
• Employees and authorized users of customer companies who use IDEA House HR (web or App)
• Employees and authorized users of customer companies who use IDEA House ERP (web or App)
• Staff of customer restaurants (such as cashiers, waiters, and managers) who use IDEA House ResPOS (web or App)
• Individual users of IDEA House MyMemory (a personal consumer app; not administered by an employer)
• Individual users of IDEA House ClassHub — class members and class organizers who create their own accounts (not administered by an employer)
• Individual users of IDEA House MyCall (a personal video calling app for Android and the web; no accounts, and not administered by an employer)
• Members and resellers of customer businesses who use IDEA House Sales Bonus (web or App), and the administrators who manage it; accounts are created by an administrator
• People who contact us through our inquiry forms

IDEA House HR, IDEA House ERP, and IDEA House ResPOS are workplace products. Your employer (our customer — for ResPOS, the restaurant business that uses it) controls much of the business and people data processed in each service. Where your employer is the data controller, please also review their workplace privacy notices. IDEA House MyMemory is different: it is a personal app you install for yourself. We do not create an account for you on our servers for IDEA House MyMemory, and the employer-administered framing above does not apply to it. IDEA House ClassHub is also not employer-administered: you create your own account, and Idea House operates the ClassHub service. See 2.6 IDEA House ClassHub. IDEA House MyCall is a personal app too: there are no user accounts, and it is not employer-administered. See 2.7 IDEA House MyCall. IDEA House Sales Bonus is a business product, like HR, ERP, and ResPOS: the business that uses it (our customer) creates and manages member and reseller accounts and controls the sales and bonus data in it. See 2.8 IDEA House Sales Bonus.

2. Information we collect

2.1 Account and profile information

When you sign in to IDEA House HR or IDEA House ERP (web or App), we may process:

• Login credentials (such as email, passwords, and authentication tokens)
• Optional two-factor authentication (2FA) codes when your organization enables them
• Profile details (name, role, company association, and related workplace fields for the product you use)
• Multi-company membership and the active company you select
• Preferences such as language, theme, and optional app lock settings

IDEA House ResPOS uses a different sign-in: staff sign in with a company code, branch, and personal PIN rather than an email and password. See 2.4 IDEA House ResPOS.

2.2 IDEA House HR mobile App

To support attendance, claims, and related HR workflows, the IDEA House HR App may collect or access:

• Camera / photos — for attendance selfie verification and profile or document uploads
• Precise location (GPS) — to record punch location and apply employer-configured geofencing rules
• Files and documents — when you upload supporting files (for example, claims or leave attachments)
• Biometrics / device lock — used only on your device to unlock the App when you enable app lock; biometric templates stay on the device and are not sent to our servers
• Profile photo — when you upload or change your profile picture
• Payroll and financial information — your payslips (shown in a list and available as PDF downloads) and your leave balances
• HR requests you submit — leave, overtime, expense claims, and attendance correction requests, along with manager approvals or rejections of those requests
• Company policy documents — policies and documents your employer publishes for you to view in the App
• Push notification tokens — to deliver work-related notifications via Firebase Cloud Messaging
• Device / installation identifiers — to manage signed-in sessions and notification delivery

Location and camera access are requested only when needed for a feature (for example, clocking attendance). You can deny permissions in system settings; some features may then be unavailable.

2.3 IDEA House ERP mobile App

The IDEA House ERP App is a companion for document approvals, expense claims / cash advances / reimbursements, compact reports, in-app and push notifications, and account security. It is not the full ERP web application. Based on the current mobile app, it may collect, access, or store:

• Account and company data — email/password sign-in, optional 2FA codes, authentication tokens, profile fields, role/permission context, and multi-company membership (including the active company you select)
• Approval workflow data — documents waiting for your approval (for example quotations, invoices, purchase orders, bills, and expense documents), including detail you view and Approve / Reject actions with optional comments
• Expense workflow data — expense claims, cash advances, reimbursements, and related line items you create or manage when your employer grants expense rights
• Reports content — permission-gated summary metrics you choose to view (for example outstanding AR/AP, cash position, bank balances, and profit & loss summaries)
• Photos and files you choose to upload — profile photo (image files via the device file picker) and optional activity-log note attachments on expense records (for example images, PDF, and common document types). The App does not use continuous camera capture or attendance selfies
• Business document PDFs — when available, you may preview PDFs in the App or download/share them through the device share sheet; sharing with another app is under your control
• Biometrics / device lock — optional Face ID / fingerprint unlock over a stored session on your device. The App uses the operating system’s biometric prompt and only receives a success or failure result; your fingerprint, face, or other biometric data never leaves your device and is never sent to or stored by Idea House (not used as a server-side login method)
• Push notification tokens — to deliver work-related notifications, the App uses Google Firebase Cloud Messaging (FCM) through the Firebase SDK (firebase_core / firebase_messaging). The App obtains an FCM registration token and sends it to our servers so we can address notifications to your device; Google processes this token and basic device information to deliver push notifications, as described in the Google Privacy Policy. ERP uses a dedicated Firebase project, separate from IDEA House HR. Local notifications may also be shown while the App is in use
• On-device storage — session tokens and related account/company data in the platform secure store; preferences such as theme and (when applicable) the API service URL your organization configures, stored on the device

The IDEA House ERP mobile App does not use precise location (GPS) for attendance punch or geofencing, and the current Android/iOS packaging does not declare location or camera permissions for that purpose. Those features apply to IDEA House HR only. The App does not include advertising SDKs or Firebase Analytics / Crashlytics in its current dependency set. You can deny notification or file access in system settings; some features may then be unavailable.

On Android, the IDEA House ERP App (package com.ideahouse.erp_approvals) requests only these permissions:

• INTERNET — to connect securely to your organization’s ERP service
• POST_NOTIFICATIONS — to show work-related push and local notifications (you can turn this off in system settings)
• USE_BIOMETRIC — to show the operating system’s biometric prompt when you enable optional app lock

Profile photos and attachments are chosen through the system file picker, which does not give the App general access to your files.

2.4 IDEA House ResPOS

IDEA House ResPOS is a restaurant point-of-sale system used by a restaurant’s staff for tables, takeaway orders, the kitchen display, payments, and cash shifts. It includes a web app (which can be installed as a Progressive Web App on a POS terminal or tablet) and a staff mobile App for waiters and cashiers (Android & iOS). Each restaurant branch chooses where its ResPOS server runs: on the restaurant’s own local server (a PC on the restaurant’s network, the default) or on the ResPOS cloud service. Based on the current product, ResPOS may collect, process, or store:

• Staff accounts — staff name, role (cashier or manager), branch, active status, and a 4–8 digit sign-in PIN. PINs are stored only as salted one-way hashes, never in readable form. Repeated wrong PINs trigger a temporary sign-in lockout, and sign-in sessions use authentication tokens that expire after 12 hours
• Restaurant setup — company and branch names and codes, currency, tax and service charge rates, enabled payment methods, discount presets, floor tables, menu categories and items (including prices, availability, stock levels, and optional menu photos uploaded by managers), option groups, and printer settings
• Orders and kitchen data — dine-in and takeaway orders, including the table, guest count, items, selected options, order and item notes, course and hold status, the staff member who handled the order, and kitchen display / ticket status
• Payments and cash shifts — payment method (cash, card, QR, or mobile money, as enabled by the restaurant), amounts, cash tendered and change, tips, refunds, and cash shift records (opening float, counted cash, expected cash, variance, and the staff who opened and closed the shift). ResPOS records only the payment method and amount; it does not collect or store card numbers, bank account details, or QR / mobile-money account details
• Manager adjustments and audit log — discounts, tax or service charge waivers, voided items, refunds, cancellation of empty orders, and staff changes are recorded in an audit log with the staff member responsible, the time, and details. Discounts, waivers, voids, and refunds require a written reason, which is stored with the record. Discounts, waivers, refunds, and staff management are limited to managers
• Web app storage in the browser — the ResPOS web app keeps your session token and the last company code you entered in the browser’s local storage, and keeps a working copy of tables, menu, orders, and branch settings, plus a queue of changes made while offline, in the browser’s local database so service can continue during a short network outage. Queued changes are sent to the restaurant’s ResPOS server when the connection returns
• Mobile App storage on the device — the ResPOS server address you enter, the last company code and branch, and your theme preference are stored in app preferences on the device; your sign-in session (authentication token and staff / branch details) is stored in the platform secure store (iOS Keychain / Android Keystore) and is removed when you sign out

Optional cloud sync. A restaurant that runs a local server may choose to connect it to the ResPOS cloud service. A manager can then upload the branch’s data to the cloud after a cash shift is closed. The upload includes branch settings, staff names and roles, tables, the menu, closed (paid, merged, or cancelled) orders, payments, and closed cash shifts. Staff PIN hashes are not included in this upload. The upload is protected by a company sync token that is stored on the restaurant’s server and is not shown again in settings. In cloud mode, the restaurant’s devices connect to the ResPOS cloud service directly, and a small ResPOS Print Service on the restaurant’s PC receives tickets from the cloud and prints them on the restaurant’s printers.

ResPOS is built around restaurant operations and staff accounts. It does not create diner or customer profiles and has no fields for diners’ names, phone numbers, or email addresses; diners are recorded only as a guest count on an order. Order and item notes are entered by staff for kitchen and service purposes and should not be used to record diners’ personal information. The ResPOS mobile App does not request camera, photo library, location (GPS), microphone, contacts, biometric, or push notification permissions, and ResPOS does not include advertising or analytics SDKs.

On Android, the IDEA House ResPOS App (package com.ideahouse.respos) requests only one permission:

• INTERNET — to connect to your restaurant’s ResPOS server over the restaurant’s Wi-Fi or the internet

The ResPOS mobile App does not connect to printers itself and does not use Bluetooth, USB, or location. When staff send an order to the kitchen or print a bill or receipt, the App asks the restaurant’s ResPOS server to print, and the server (or the ResPOS Print Service on the restaurant’s PC) sends the ticket to the restaurant’s own printers. The App only shows the printer status reported by the server.

Who creates ResPOS accounts. Idea House sets up each restaurant company and its branches. Staff accounts (name, role, branch, and PIN) are created, changed, deactivated, and deleted by the restaurant’s managers in ResPOS. There is no self sign-up in the App.

On iOS, the App asks for Local Network access so it can reach the restaurant’s ResPOS server on the restaurant’s Wi-Fi to take orders and print tickets.

2.5 IDEA House MyMemory

IDEA House MyMemory is a personal AI memory assistant for Android and iOS. You save notes as text, voice, or photos on your phone, ask questions in plain English, and receive answers that come only from your saved memories (with tappable sources). Notes that mention a date or time can become reminders or alarms with phone notifications. Based on the current product:

• Memories and media on the device — text notes, voice recordings, photos, titles, tags, search embeddings, and related reminder/alarm records are stored in a local SQLite database and media files on your phone. We do not host your memories on Idea House servers
• AI processing with your key — you choose an AI provider (Google Gemini by default, or OpenAI) and supply your own API key. The App calls that provider only to transcribe voice, read/describe photos (including text in images), create search embeddings, detect reminder/alarm candidates, and write answers. Your API keys are stored in the iOS Keychain / Android Keystore via platform secure storage and are not included in backups
• What is sent to the AI provider — depending on the feature you use: the voice recording to transcribe; photos to read and describe; memory text to create search embeddings; note text to detect a reminder; and, for Ask, your question, the recent chat turns, the most relevant saved memories, and downscaled copies of their photos. Spoken questions are deleted from the phone after transcription. The Ask chat is kept only while the App is open and is not saved
• Clipboard check for a Gemini key — to make setup easier, the App may read the clipboard once when you return from the Google AI Studio key page, or once per session when the Gemini settings tab is shown without a saved key. It only looks for a Gemini-key-shaped value, offers it for you to save, and does not send or store the clipboard otherwise
• Optional encrypted cloud backup — if you enable backup, memories (the database, including embeddings), photos, voice recordings, and reminders are encrypted on the phone and saved to your own Google Drive app-private folder (Android; drive.appdata scope) or the App’s private iCloud container (iOS, when the capability is available). You set a backup password; a 256-bit key is derived with Argon2id and files are encrypted with AES-256-GCM. The cloud holds salt/parameters and ciphertext only. Automatic backups can keep the derived key in Keychain/Keystore. You may also export or import an encrypted backup file yourself
• Google Sign-In (Android, only for Drive backup) — Google Sign-In is used only to let you authorize the App’s access to its own hidden folder in your Google Drive (drive.appdata scope). The App cannot see your other Drive files, and your Google account details are not sent to Idea House. You can use the App without signing in
• Encrypted in transit; nothing sent to Idea House — all network requests the App makes (to the AI provider you chose and to Google Drive) use HTTPS. The App sends your memories, recordings, photos, reminders, and API keys only to those services, never to Idea House, and we do not sell or share them
• No Idea House account for IDEA House MyMemory — IDEA House MyMemory does not require signing up with us. There is no IDEA House MyMemory user account or memory store on our servers. The App does not include advertising SDKs or analytics / crash-reporting SDKs in the current product

On Android, the IDEA House MyMemory App (package com.ideahouse.mymemory; display name “IDEA House MyMemory”) requests these permissions:

• INTERNET — to call the AI provider you chose and, if you enable it, Google Drive backup
• RECORD_AUDIO — to record voice memories and spoken questions
• POST_NOTIFICATIONS — to show reminder and alarm notifications (Android 13+)
• RECEIVE_BOOT_COMPLETED — to restore scheduled reminder/alarm notifications after the phone restarts
• SCHEDULE_EXACT_ALARM — to schedule reminders and alarms at an exact time when the system allows it (Android 12+; the App may fall back to inexact timing if exact alarms are not permitted)
• USE_FULL_SCREEN_INTENT — so an alarm can open a full-screen alarm UI when ringing (where the system grants this; otherwise a high-priority notification is used)
• WAKE_LOCK — to keep the device awake briefly while an alarm rings
• VIBRATE — for reminder and alarm vibration patterns
• ACCESS_NETWORK_STATE — to honour the optional Wi-Fi-only setting for automatic backups

Camera and photo picking use the system camera / photo-picker flows, so the App does not declare a general camera or broad storage permission on Android. Permissions that third-party libraries would otherwise add but the App does not use (biometric / fingerprint and foreground service) are removed from the Android build. The App does not request location, contacts, or biometric permissions.

On iOS, the App shows these usage descriptions when asking for access:

• Microphone — “IDEA House MyMemory uses the microphone to record voice memories and spoken questions.”
• Camera — “IDEA House MyMemory uses the camera to take photos you want to remember.”
• Photo Library — “IDEA House MyMemory lets you pick photos from your library to save as memories.”

Notification permission is requested at runtime for reminders and alarms. Background modes for fetch and processing support scheduled encrypted backup when available. iCloud backup requires a configured iCloud capability on the device/account.

2.6 IDEA House ClassHub

IDEA House ClassHub is a class and schedule service. Organizers create classes (for example yoga) and their sessions; members browse classes, join or leave them, hold waitlist places, and follow organizers; and Idea House administrators manage users, classes, and organizer billing. ClassHub has a mobile App (Android & iOS) and a web portal at classhub.ideahousesolutions.com, where organizers and administrators sign in (members use the mobile App) and where the public account deletion page is published. ClassHub data is stored on servers operated by Idea House. Based on the current product, ClassHub collects, processes, or stores:

• Account information — your email address, display name, role (member, organizer, or administrator), when the account was created, whether it is disabled, and when you last changed your display name (a name can be changed once every 6 months). If you sign up with email, your password is stored only as a one-way hash
• Email sign-up verification — when you sign up with email, we check that your email domain can receive mail (a DNS lookup) and email you a 6-digit code that expires after 15 minutes. Until you confirm it, we hold your pending sign-up (email, display name, chosen role, password hash, and the code stored only as a hash)
• Sign in with Google or Apple — if you choose Google Sign-In, the App requests the email and profile scopes, and we receive your name, email address, and profile photo from Google. If you choose Sign in with Apple (iOS), the App requests your name and email, which may be a private relay address. We store a Google or Apple account identifier to link your ClassHub account; if the email matches an existing ClassHub account, the sign-in is linked to it. For Sign in with Apple we may also store an Apple refresh token, used only to revoke ClassHub’s access when you delete your account. Organizers and administrators can also use Google sign-in (and Sign in with Apple, when enabled) on the web portal. We never receive your Google or Apple password
• Profile photo (optional) — you can take a photo with the camera or choose one from your photo library, and crop it on the device. If you sign in with Google and have no ClassHub photo yet, we copy your Google profile photo. Photos are resized to a square JPEG and stored on our server. Your photo is shown to other Class Hub users with your display name. You can remove it at any time
• Classes and schedules — what organizers enter: class title, description, class type, location (free text), capacity, session dates and times, session notes, custom class types, and cancellations with an optional reason
• Bookings, waitlists, and follows — the classes you join or leave, any waitlist places you hold, when you joined, and the organizers you follow
• Direct messages — an organizer and a member who follows them can send each other one-to-one text messages in the App (up to 2,000 characters; no photos or files). Messaging is available only while that follow is active, and either side can write first. We store each conversation (the organizer and the follower, when it started, and a preview of the latest message), and for each message its text, who sent it, and when; we also store when each side last opened the conversation, used to show unread counts. Messages cannot be edited or deleted in the App. Messages are stored on servers operated by Idea House (hosted by MonsterASP) and are shown only to the two people in the conversation. When you receive a message while you do not have that conversation open, we send a push notification and add an entry to your in-app notification inbox showing the sender’s display name and the start of the message text (up to about 140 characters)
• Notifications and time zone — the push notification token for your device (Firebase Cloud Messaging), its platform (Android or iOS), and when it was last used; your in-app notification inbox (titles, messages, and read status) and a record of session reminders sent to you; and your device’s time zone (for example Asia/Yangon), used to show and schedule times in your local time
• Contact support — if you send a message from Contact support in the App, we store your display name and account email, the phone number you enter, the messaging app you prefer us to use (Viber, Line, or WhatsApp), and your message. The message is emailed to our support inbox, and a copy is emailed to you
• Organizer billing — organizers can create classes free during a free period; after that, an organizer pays for a plan outside ClassHub (by bank or mobile wallet transfer, using the QR code or account number shown) and uploads a payment slip or screenshot as evidence through the web portal. We store the uploaded image, the plan, amount and currency, the payment method chosen, any note the organizer adds, the review status, administrator notes, who reviewed it and when, the organizer’s paid-through date, and an audit record of each step. ClassHub does not process card payments or collect card or bank account numbers from organizers
• Account deletion requests — if you request deletion on the web, we store the email address you enter, an optional reason, the request status and dates, and the confirmation link token (stored only as a hash)
• Storage on your device or browser — the App keeps your sign-in token and theme preference in app storage on the device; the web portal keeps your sign-in token and table layout preferences in the browser’s local storage. The sign-in token is removed when you sign out

Device permissions. On iOS, ClassHub asks for Camera (“Take a profile photo for your ClassHub account.”) and Photo Library (“Choose a profile photo for your ClassHub account.”) access only when you set a profile photo, and asks for permission to send notifications. On Android, the App declares the POST_NOTIFICATIONS permission so it can show push notifications (Android 13+); profile photos are picked through the system camera and photo picker. ClassHub does not request location, microphone, or contacts permissions. Firebase is used only for push notifications (Firebase Cloud Messaging); the App does not include advertising, analytics, or crash-reporting SDKs. On Android the App is published as com.ideahouse.classhub.class_hub and on iOS as com.ideahouse.classhub.classHub.

Who creates ClassHub accounts. You create your own account in the App, as a member or an organizer: with email and password (you choose your role when signing up), or with Google or Apple sign-in (you confirm your display name and choose member or organizer once, after the first sign-in). Administrator accounts cannot be created by self sign-up. Administrators can change a user’s role and disable an account.

2.7 IDEA House MyCall

IDEA House MyCall is a private one-to-one video calling service, available as an Android app and as a web app at mycall.ideahousesolutions.com. Two devices (phones or browsers) pair once using a 6-digit invite code; after that, each can call the other. There are no user accounts: you do not sign up, and we do not ask for your email address or phone number. The Android App is published as com.ideahouse.mycall (display name “IDEA House MyCall”). Based on the current product, MyCall collects, processes, or stores:

• Your display name — the name you type (up to 40 characters). It is sent to the MyCall signaling server at mycall.ideahousesolutions.com when you pair, shown to the person you pair with, and included in incoming call notifications sent to that person
• Invite codes — when you create an invitation, the server issues a random 6-digit code linked to a new private contact room. The code is valid for 10 minutes and both people confirm before pairing completes. An unused invitation and its code are deleted automatically when they expire
• Pairing records on our server — once two phones pair, the server stores, for that pair only: a random room identifier, the two display names, a random credential for each phone, and (if incoming call ringing is on) each phone’s Firebase Cloud Messaging push token. While a call is ringing or in progress, it also keeps a short-lived call record (a random call ID, which phone is calling, and an expiry time); this is deleted when the call ends, after 45 seconds if it is not answered, and after at most 55 minutes for an answered call
• Saved contacts on your phone — your display name and your contacts (room identifier, credential, and the other person’s name) are stored only in the App’s private storage on your phone. Android backup is disabled for the App, so this local data is not included in device or cloud backups. In the web app, your display name and contacts are stored in your browser’s local storage for the site
• App code — the Android App and the web app ask for a 5-digit app code before showing your contacts. On Android the code is checked on the phone and is not sent to us. In the web app, the code you enter is sent over HTTPS to our server, which only checks it and replies whether it is correct; the entered code is not stored on the server or in the browser, and the unlocked state lasts only until the page is reloaded or closed. Attempts are covered by the server’s request rate limit. This code is a shared access gate, not a personal account or password
• Push notifications for incoming calls (Android) — so calls can ring when the App is closed, the App registers its Firebase Cloud Messaging token with our server. A call notification contains the caller’s display name, the call and room identifiers, and when the ringing expires; it does not contain audio or video. On the phone, an incoming call appears as a high-priority pop-up notification with Answer and Decline buttons. You can turn ringing off in the App, which removes the token from our server. The web app does not use push notifications; it rings only while the page is open
• Camera and microphone — used only during a live call that you start or answer (in the web app, your browser asks for permission). Audio and video are sent directly between the two phones using WebRTC (encrypted in transit), or, when a direct connection is not possible, through a Cloudflare TURN relay that forwards the encrypted media. Calls are never recorded or stored by the App or by Idea House
• IP addresses — as with any internet calling service, your IP address is processed by our signaling server (including to rate-limit requests and prevent abuse) and by Cloudflare. To connect a call, WebRTC shares network addresses with the other phone, so the person you call may be able to see your IP address unless the call uses the relay. This applies to both the Android App and the web app
• No analytics, ads, or AI — the Android App and the web app do not include advertising, analytics, or crash-reporting SDKs, and does not use AI processing. Firebase is used only for push notifications (Firebase Analytics collection is disabled). The App does not request location, contacts, storage, or Bluetooth permissions

On Android, the App requests CAMERA and RECORD_AUDIO (for video calls), MODIFY_AUDIO_SETTINGS (to route call audio), INTERNET and ACCESS_NETWORK_STATE (to connect calls), POST_NOTIFICATIONS (to show incoming call notifications, Android 13+), and VIBRATE (for ringing). Incoming calls are shown as standard notifications; the App does not use full-screen call screens or full-screen intents.

2.8 IDEA House Sales Bonus

IDEA House Sales Bonus lets a business record member sales, branch stock, and sales bonuses, and lets members and resellers see their own information. It is available as a web app at salesbonus.ideahousesolutions.com and as an Android App published as com.ideahouse.salesbonus (display name “Sales Bonus”). The Android App is a secure in-app browser (WebView) that opens only the Sales Bonus web app over HTTPS; the business screens and data stay on the Sales Bonus server. The web app and its API (apisalesbonus.ideahousesolutions.com) are served through Cloudflare over HTTPS. There is no self sign-up and no third-party (Google, Apple, or social) sign-in: every account is created by an administrator of the business, with one of these roles: System Admin, Admin, Reseller (one branch), or Member (own bonus report only). Sales Bonus does not take payments and shows no ads. Based on the current product, Sales Bonus collects, processes, or stores:

• Member records — member ID, name, NRC (national ID) number, date of birth, address, and the member who introduced them (sponsor), entered by an administrator
• Login details — username, password (stored only as a salted hash), role, and assigned branch or member record. After sign-in, the web app keeps a sign-in token (valid for up to 12 hours) in the app’s browser storage on your device
• Profile photo (optional) — if you add one from your profile menu, it is resized to a small square image and stored with your account. You can change or remove it
• Sales and stock records — sales vouchers (invoices) with date, member, branch, items, quantities, and prices; stock purchases and transfers between branches; and cancellation records (time and the username of the person who cancelled)
• Bonus calculations — bonus periods and the calculated bonus amounts for each member, based on their own purchases, purchases by members they introduced, and sales at a branch they operate
• Business and branch details — the business’s name, address, phone, email, and registration ID, and each branch’s invoice contact details, which are printed on invoices
• Downloaded files — invoice and transfer PDFs and Excel exports you choose to download are created for you and, in the Android App, handed to your device’s share sheet so you can save or share them. What happens to a file after that is under your control
• Device storage — the App’s WebView keeps the sign-in token, cookies, cache, and display preferences (such as theme and column layout) on your device
• No location, analytics, or ads — Sales Bonus does not track your location and does not include advertising, analytics, crash-reporting, or push notification SDKs. We do not sell Sales Bonus data or share it for advertising

On Android, the App requests only the INTERNET permission. To add a profile or item photo, it opens the system file picker; it does not request camera, storage, location, or contacts permissions.

2.9 Website inquiry forms

If you contact us through our website, we collect the details you submit (such as name, email, company, and message). If you use Google sign-in on the inquiry form, we receive basic profile information (name, email, and profile picture) from Google to help prefill the form.

2.10 Technical information

We may automatically collect limited technical data such as IP address, browser or device type, and basic usage logs needed to operate, secure, and improve our services.

3. How we use information

We use information to:

• Provide and operate IDEA House HR, IDEA House ERP, IDEA House ResPOS, IDEA House MyMemory, IDEA House ClassHub, IDEA House MyCall, IDEA House Sales Bonus, and related services (for workplace products, for your organization; for IDEA House MyMemory and IDEA House MyCall, for you as an individual user)
• Authenticate users and protect accounts
• Process HR workflows such as attendance, leave, claims, payroll, and recruitment that you or your employer use
• Process ERP workflows such as document approvals, expenses, reports, activity notes, and related notifications that you or your employer use
• Process restaurant workflows in IDEA House ResPOS such as table and takeaway orders, kitchen tickets, payments, cash shifts, reports, manager adjustments, and audit records that your employer uses
• For IDEA House ClassHub, let organizers publish classes and sessions, let members join and leave them (including waitlists), show organizers who has joined their classes, let members follow organizers, let organizers and their followers exchange direct messages, verify email sign-ups, send push and in-app notifications (booking and waitlist updates, new classes from organizers you follow, reminders about 15 minutes before a session, cancellations, and new direct messages), show times in your time zone, respond to support messages, and review organizer payment evidence to activate paid plans
• For IDEA House MyCall, pair two devices with an invite code, check the web app code, relay call signaling between them, ring the other phone with a push notification, connect live video calls, and prevent abuse (for example, rate-limiting requests)
• For IDEA House Sales Bonus, record member sales vouchers, stock purchases, and branch transfers; calculate, review, and post bonuses for each period; show members their own bonus reports and resellers their branch’s records; and generate invoice and transfer PDFs and Excel exports
• Send service notifications you or your employer enable
• For IDEA House MyMemory, support on-device storage of your memories, optional encrypted backup/restore to your own cloud or backup file, and AI features you trigger with your own provider key (transcription, photo reading, search embeddings, reminder detection, and answers grounded in your memories)
• Respond to customer and partner inquiries
• Maintain security, prevent abuse, and troubleshoot issues
• Comply with legal obligations

We do not sell your personal information.

4. How we share information

We may share information with:

• Your employer — as the organization that administers your IDEA House HR, IDEA House ERP, and/or IDEA House ResPOS account (for ResPOS, the restaurant’s managers can see staff activity such as orders, payments, shifts, and the audit log)
• Service providers — trusted vendors that help us host, deliver email, or send push notifications (for example, cloud hosting, email delivery, and Firebase Cloud Messaging — including a dedicated Firebase project for IDEA House ERP, separate from IDEA House HR), under appropriate confidentiality and security commitments. For push notifications, Google processes FCM registration tokens and basic device information under the Google Privacy Policy
• For IDEA House Sales Bonus — the business that uses it — the business’s System Admins and Admins can see all member, sales, stock, and bonus records; a reseller can see the records for their own branch; a member sees only their own bonus report. Your name and invoice details appear on invoice PDFs that the business may give to you or keep
• For IDEA House Sales Bonus — service providers — the web app and its API are served through Cloudflare, which provides HTTPS and processes requests (including your IP address) to deliver them, under the Cloudflare Privacy Policy
• Legal authorities — when required by law or to protect rights, safety, and security
• For IDEA House MyMemory — AI providers you choose — when you use Ask, voice, photo, reminder detection, or indexing, the App sends the relevant content to the provider you selected (Google Gemini or OpenAI) using your API key. Those providers process data under their own policies: Google Privacy Policy / Gemini API terms, and OpenAI Privacy Policy. On the Gemini free tier, Google may use data to improve its products (as noted in the App and product README)
• For IDEA House MyMemory — your own cloud backup — if you enable backup, encrypted backup files are stored in your Google Drive app-private folder or your iCloud container. Idea House does not receive the backup password or the plaintext of those files. Signing in with Google for Drive backup uses Google’s sign-in under Google’s policies; the App requests only the Drive app-data scope
• For IDEA House ClassHub — other users — when you join a class, its organizer can see your display name, profile photo, and whether you are enrolled or waitlisted (and since when). Any signed-in ClassHub user can see an organizer’s display name, profile photo, follower count, class types, and upcoming classes. Your email address is not shown to other members or organizers. Direct messages are visible only to the organizer and the follower in that conversation; the ClassHub web portal does not show them to administrators, although, as the operator of the service, Idea House has technical access to the database where they are stored. Idea House administrators can see account details (including email address), classes, payment submissions, support messages, and deletion requests to operate the service
• For IDEA House ClassHub — service providers — the ClassHub server, its database, and uploaded files (profile photos and payment evidence) are hosted by MonsterASP; the web portal is hosted on Cloudflare. Emails (sign-up codes, support message copies, deletion confirmation links, and account-deleted notices) are sent through Resend, which processes your email address and the message content to deliver them. Push notifications are delivered through Google Firebase Cloud Messaging (a Firebase project dedicated to ClassHub), which processes your device token and the notification content (for direct messages, the sender’s display name and the start of the message text) under the Google Privacy Policy
• For IDEA House ClassHub — Google and Apple sign-in — if you choose Google Sign-In, Google shares your name, email address, and profile photo with us under the Google Privacy Policy; if you choose Sign in with Apple, Apple shares your name and email (or relay address) under Apple’s Privacy Policy. The web portal sign-in page loads Google’s sign-in script (and Apple’s, when Sign in with Apple is enabled there)
• For IDEA House MyCall — the person you pair with — your display name is shared with the one person you pair with, and is shown when you call them. During a call, your audio, video, and network address are shared with that person
• For IDEA House MyCall — service providers — the signaling server and pairing records run on Cloudflare Workers and Durable Objects, and calls that cannot connect directly are relayed through Cloudflare’s TURN service, under the Cloudflare Privacy Policy. Incoming call notifications are delivered through Google Firebase Cloud Messaging, which processes your device token and the notification content (the caller’s display name and call identifiers) under the Google Privacy Policy

For IDEA House MyMemory, there is no employer administrator who can see your memories through our systems, because we do not hold them. For IDEA House MyCall, there is no employer administrator, and we never receive or store call audio or video. For IDEA House Sales Bonus, we do not sell data or share it with advertisers or data brokers, and the App uses no third-party analytics, advertising, or push services.

5. Data retention

We retain personal information for as long as needed to provide the services, meet employer/customer retention requirements, resolve disputes, and comply with legal obligations. When data is no longer required, we delete or anonymize it where practicable. In particular:

• Account data (profile, login details, and preferences) is kept while your account is active and is deleted within 30 days after a deletion request is confirmed or your account is closed, except for records described in Account and data deletion that must be kept for legal or accounting reasons
• Push notification tokens are removed when you sign out of the App or when the token expires or is no longer valid
• Server logs (such as IP address, device type, and request logs used for security and troubleshooting) are kept for up to 90 days, unless needed longer to investigate a specific security incident
• Backups roll off automatically within 30 days
• IDEA House ResPOS restaurant records (orders, payments, cash shifts, and the audit log) are kept for as long as the restaurant needs them for its business, tax, and accounting requirements. When a restaurant runs ResPOS on its own local server, that data stays on the restaurant’s server under the restaurant’s control; the server log and backup periods above apply to data held on our servers (cloud mode and cloud sync)
• IDEA House MyMemory — memories, media, and reminders remain on your device until you delete them in the App or uninstall the App (which removes local App data). Optional backups remain in your Google Drive / iCloud (or in backup files you exported) until you delete them there; Idea House does not retain a copy on our servers
• IDEA House ClassHub — account, profile photo, booking, follow, direct message, and notification data is kept while your account is active. When you delete your account (in the App, on the web portal, or by confirming a request from our deletion page), it is deleted immediately and permanently, as described in Account and data deletion. Push tokens are removed when you sign out and switched off when Firebase reports them invalid. Direct messages have no separate expiry; they are kept until either person in the conversation deletes their account. Pending email sign-ups expire after 15 minutes. Unconfirmed deletion requests expire after 24 hours and are removed automatically. We keep organizer subscription payment records (amount, currency, plan, payment method, dates, and status) for accounting and legal purposes, anonymized so they are no longer linked to your name, email, or account; a deletion log entry that contains no personal data; a record of the deletion request (email address, optional reason, dates, and outcome) as proof the request was handled; and messages you sent through Contact support (see below). We may remove accounts and associated data that are inactive, incomplete, fake, spam, or that violate our terms, with or without prior notice.
• IDEA House MyCall — your display name and saved contacts stay on your phone (or in your browser’s local storage, for the web app) until you remove a contact, uninstall the App, or clear the site’s data in your browser. Web app codes you enter are not stored. Invite codes and unused invitations are deleted automatically after 10 minutes. Call records are deleted when the call ends (unanswered calls after 45 seconds; answered calls after at most 55 minutes). Pairing records on our server (room identifier, the two display names, and the two device credentials) have no automatic expiry and are kept while the pairing may still be used; push tokens are removed when you remove the contact, turn off ringing, or Firebase reports the token is no longer valid. Call audio and video are never stored
• IDEA House Sales Bonus — member, account, sales, stock, and bonus records are kept while the business uses Sales Bonus and as long as it needs them for its business, tax, and accounting requirements. Cancelled vouchers and transfers are kept as marked reference records, and posted bonus periods cannot be reopened. When an administrator archives a member or login, it is hidden and can no longer sign in, but its records are kept so past sales and bonuses stay correct. Sign-in tokens expire after 12 hours

6. Account and data deletion

IDEA House MyMemory: delete individual memories in the App, delete a cloud backup from Backup & restore if you created one, and/or uninstall the App to remove on-device data. On Android you can also remove all on-device App data in Settings → Apps → IDEA House MyMemory → Storage → Clear storage. To remove a Google Drive backup outside the App, open Google Drive on the web → Settings → Manage apps → IDEA House MyMemory → Options → Delete hidden app data; you can also revoke the App’s access in your Google Account (Security → Your connections to third-party apps & services). Content you already sent to Google Gemini or OpenAI for AI processing is handled under that provider’s retention policy. On iOS, Keychain entries can outlive an uninstall, so remove your API keys in Settings first if you want them gone from the device. Because we do not host your memories on our servers, we cannot delete data we do not hold; contact us only if you need help confirming that.

IDEA House MyCall: there are no accounts, so there is no account to delete. To remove your data:

• Remove a contact — tap the delete icon next to the contact and confirm. This deletes the contact from your phone and removes your push token for that pairing from our server, so it can no longer ring your phone
• Turn off ringing — this removes your push token from our server for all your contacts
• Uninstall the App (or on Android, Settings → Apps → IDEA House MyCall → Storage → Clear storage) — this removes your display name and saved contacts from your phone. Because backup is disabled, they are not restored from a backup
• Web app — remove a contact with its remove button (this deletes it from that browser only), or clear the site data for mycall.ideahousesolutions.com in your browser settings to remove your display name and all saved contacts from that browser

Removing a contact, clearing site data, or uninstalling does not by itself delete the pairing record on our server (the room identifier, the two display names, and the two device credentials). Once neither device keeps the contact, that record can no longer be used by anyone. If you want it deleted, contact us through the contact form and tell us the display names used; we may need details from your phone to identify the pairing. We never hold recordings of calls, so there is no call content to delete.

IDEA House ClassHub: you can delete your account yourself at any time.

• In the App — tap your avatar to open Profile & settings, tap Delete account, enter your current password or type DELETE, and tap Delete forever
• On the web — open classhub.ideahousesolutions.com/delete-account. If you have an email and password, sign in there and confirm with your password or by typing DELETE. If you cannot sign in (for example, you use Google or Apple sign-in, or cannot open the App), enter your account email address (and an optional reason) to request deletion. If it matches an account, we email you a link valid for 24 hours, and your account is deleted only when you open that link and press “Yes, delete my account permanently”. Opening the link alone does nothing. Unconfirmed requests expire and are removed automatically. Administrator accounts cannot be deleted through the emailed link

When you delete your account, in the App or on the web, we immediately and permanently delete:

• Your profile (name, email address, password hash, Google / Apple sign-in identifiers and Apple token) and your profile photo
• Your class bookings and waitlist places, and the organizers you follow or who follow you
• Your direct message conversations and every message in them, including the messages the other person sent you (they are deleted for both people, not anonymised). Message notifications already in the other person’s in-app inbox are not removed
• Your push notification tokens and your in-app notifications
• Class types you created as an organizer
• Payment screenshots you uploaded and the notes you added to them; payments still waiting for review are closed

Also, when you delete your account:

• If you used Sign in with Apple, we ask Apple to revoke ClassHub’s access to your Apple ID
• Classes you organize are cancelled, their upcoming sessions are cancelled, and their members are notified. The cancelled class listings stay in our records without any link to your account
• If you held a seat in a class, the next waitlisted member gets the seat
• We email you a notice when the deletion is complete

We keep, for accounting, legal, support, and proof-of-handling purposes:

• Anonymized records of subscription payments (amount, currency, plan, payment method, dates, and status), no longer linked to your name, email, or account
• A deletion log entry containing no personal data
• A record of the deletion request (email address, optional reason, dates, and outcome) as proof the request was handled
• Messages you sent through Contact support (your name, email address, phone number, preferred messaging app, and message), including the copy in our support email inbox. These are not removed automatically when you delete your account; to have them deleted, contact us through the contact form

Uninstalling the App does not delete your ClassHub account. ClassHub emails come from our no-reply address, no-reply@ideahousesolutions.com (“IDEA House Class Hub”).

If you used Google Sign-In, you can also revoke ClassHub’s access in your Google Account (Security → Your connections to third-party apps & services).

IDEA House Sales Bonus: accounts are created and managed by the business that uses Sales Bonus, so you cannot delete your account in the App. To have your account or member record deleted, ask your organization’s Sales Bonus administrator, or contact us through the inquiry form on our website (include your name, the business, and that you use IDEA House Sales Bonus; we may contact you or the business to verify the request). In the admin screens, an administrator can archive a member or login, which stops it from signing in and hides it from lists; on a confirmed deletion request, we or the administrator delete or anonymize your personal details (such as your NRC number, date of birth, address, login, and profile photo). Sales, invoice, stock, and bonus records the business must keep for legal, tax, or accounting reasons may be retained under the business’s control. You can remove your profile photo yourself from the profile menu. Uninstalling the App or signing out removes the sign-in token from your device but does not delete your account.

IDEA House ERP, IDEA House HR, and IDEA House ResPOS accounts are created and managed by your employer company (our customer). To delete your account and its associated data:

• Contact your company’s ERP administrator (or HR / IT administrator for IDEA House HR, or a restaurant manager for IDEA House ResPOS). Your administrator handles the request — for example in person or by phone, outside the App — and closes and deletes your account using your organization’s admin tools
• If you cannot reach your administrator (for example, your company no longer uses the product), use the contact form on our website with the subject “Account deletion request”. Please include your name, your company, and the App you use. We may contact you or your company to verify the request

What is deleted:

• Your account profile
• Login details (credentials, 2FA settings, and authentication tokens)
• Device identifiers and push notification tokens
• App preferences linked to your account
• For IDEA House ResPOS, your staff record (name, role, and PIN hash). A restaurant manager can deactivate or delete a staff account in ResPOS settings; signing out of the mobile App removes your session from the device

What may be kept, and why:

• Business records that your employer organization must keep for legal, tax, audit, or accounting reasons (for example approved documents, expense claims, and approval history, or ResPOS orders, payments, cash shifts, and audit log entries — including your name as recorded in the audit log) may be retained. These records remain under your organization’s control and are kept according to its retention requirements
• Copies in our backups, which roll off automatically within 30 days

Once your deletion request is confirmed, your account data is deleted within 30 days. Deleting the App from your device does not delete your account; local data stored by the App on your device is removed when you sign out or uninstall the App.

7. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS) and secure on-device storage of authentication tokens where supported by the Apps. IDEA House ResPOS stores staff PINs only as salted hashes, temporarily locks sign-in after repeated wrong PINs, and stores print service and pairing credentials only as hashes. IDEA House ClassHub stores passwords only as one-way (bcrypt) hashes, and stores email verification codes and deletion link tokens only as hashes. IDEA House MyCall uses random invite codes that expire after 10 minutes, random per-device credentials so only the two paired devices can use a contact room, request rate limits, and WebRTC encryption for call audio and video (including when relayed). IDEA House Sales Bonus stores passwords only as salted PBKDF2-SHA256 hashes, uses sign-in tokens that expire after 12 hours, limits each role to the records it is allowed to see (resellers to their own branch, members to their own bonus), and the web app, its API, and the Android App connect only over HTTPS, served through Cloudflare. When ResPOS runs on a restaurant’s local server, staff devices may connect to it over the restaurant’s own Wi-Fi network without HTTPS; the restaurant is responsible for securing its local network and server. For IDEA House MyMemory, API keys and backup key material are stored in the iOS Keychain / Android Keystore; optional backups are encrypted on device with Argon2id-derived keys and AES-256-GCM before upload. No method of transmission or storage is completely secure; please keep your device, API keys, and backup password protected. If you forget the IDEA House MyMemory backup password, the backup cannot be restored.

8. Children’s privacy

Our workplace products are intended for use by adults. IDEA House MyMemory and IDEA House ClassHub are likewise intended for adults, as are IDEA House MyCall and IDEA House Sales Bonus. IDEA House ClassHub is not directed at children and is intended for users aged 18 and over. We do not knowingly collect personal information from children.

9. Your choices and rights

Depending on your role and applicable law, you may be able to:

• Review or update profile information in the relevant App or through your employer’s admin tools
• Turn off location or camera permissions in device settings (IDEA House HR attendance and related features)
• Turn off notification, microphone, camera, or photo/file access in device settings where an App requests them (including IDEA House MyMemory)
• For IDEA House MyMemory: change or clear your AI provider keys in Settings; delete memories or reminders in the App; disable or delete encrypted backups; or uninstall the App
• Disable optional app lock / biometrics in App settings
• Choose whether to download or share business document PDFs from IDEA House ERP via the device share sheet
• For IDEA House ClassHub: change your display name (once every 6 months) or remove your profile photo in Profile & settings; leave classes or unfollow organizers (unfollowing closes direct messaging with that organizer; past messages stay visible to both of you until either account is deleted); turn off notifications in device settings; or delete your account in the App or on the web (see Account and data deletion)
• For IDEA House MyCall: change the display name used for new pairings (existing contacts keep the name you paired with); turn off camera, microphone, or notification permission in device or browser settings; turn off incoming call ringing in the Android App; remove (unpair) a contact; uninstall the App; or clear the site data for the web app (see Account and data deletion)
• For IDEA House Sales Bonus: add, change, or remove your profile photo; choose whether to download or share invoice PDFs and Excel exports; and ask your organization’s Sales Bonus administrator to correct or delete your details, or contact us through the inquiry form (see Account and data deletion)
• Request access, correction, or deletion through your company’s ERP administrator (or HR / IT administrator for IDEA House HR, or restaurant manager for IDEA House ResPOS), or through the contact form on our website if you cannot reach them (see Account and data deletion)

Because IDEA House HR, IDEA House ERP, and IDEA House ResPOS are often administered by your employer, many requests for those products are handled through that organization’s HR, IT, or company administrator, or for ResPOS, a restaurant manager. IDEA House Sales Bonus is administered by the business that uses it, so requests are handled through its Sales Bonus administrator. IDEA House MyMemory is not employer-administered; you control the data on your device and in your own backups. IDEA House MyCall is not employer-administered either; you control your contacts on your device or in your browser.

10. International processing

Information may be processed in countries where we or our service providers operate. We take steps appropriate to the circumstances to protect personal information during such transfers.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the website or Apps after an update means you acknowledge the revised policy.

12. Contact us

If you have questions about this Privacy Policy or our privacy practices, please contact us using the contact form on our website.

IDEA HOUSE SOLUTIONS CO., LTD
Upper Pazundaung Road, No. 319, Room 3(B), Sat San Ward,
Mingalar Taung Nyunt Township, Yangon 11171, Myanmar
Website: https://ideahousesolutions.com
Contact: contact form on our website