Privacy policy

InHouse gives a venue its own cashless balance: people top up and pay at that venue with a tag, a card or the InHouse app. This page explains what we keep about you, why, and what you can do about it.

Who is responsible

For your InHouse app account, InHouse is responsible for your data. For your guest record at a venue (your balance, top-ups and purchases there), that venue decides what is kept and InHouse stores it on its behalf. Questions about either go to [email protected].

What we keep

• Your account: the email address and phone number you sign in with.
• Your guest record at each venue: a name, phone, email or the venue's own number, if staff add them, and the tag you pay with. Tags are stored only as a one-way hash, never what the tag holds.
• Your money records: top-ups, purchases, transfers to friends, refunds, and how each top-up was paid (for example cash or Bit). We never see or store card numbers.
• Notifications we sent you, and your phone's push token.
• Technical data: IP addresses and request logs, used to keep the service running and to stop abuse.
• Page statistics for our websites: which page was opened, from which site and country, and the kind of device and browser. No cookies, and nothing that identifies you: a visitor is counted with a value that changes every day and cannot be traced back.

The app uses your camera only to read QR codes and NFC only to pay or send money. Neither leaves your phone as images or recordings.

Why

• To run your balance, payments and refunds.
• To send sign-in codes and notifications you asked for.
• To prevent fraud, such as copied tags or reused codes.
• To let venues keep the records the law requires of them.

Who else sees it

• Staff of a venue see your records at that venue only.
• Service providers that help us run InHouse: our hosting, Cloudflare (network), our email provider (sign-in codes) and Google and Expo (push notifications). They act on our instructions only.
• Authorities, when the law requires it.

We do not sell your data or use it for advertising.

How long

Your account stays until you delete it. Money records stay as long as the venue must keep them for tax and accounting law; after your account is deleted they no longer carry your name or contact. Logs are kept for a short time only.

Your rights

Under Israel's Protection of Privacy Law you may see the data we keep about you, ask us to correct it, and ask us to delete it. You can delete your account yourself in the app, see deleting your account, or email [email protected].

Age

InHouse is for people aged 13 and over. People aged 13 to 17 need permission from a parent or guardian, who can also ask to see or delete their data.

Security

Everything travels over HTTPS. Sign-in codes expire after five minutes, pay codes after one minute, and tags can be disabled the moment they are lost.

Changes

When this policy changes we update the date above, and tell you in the app if the change matters to you.