Privacy Policy

Scope

This policy applies to websites, applications, and services owned or operated by IdeasX, Inc., including:

• IdeasX, including ideasx.com, its field notes, and the Start-up game;
• K2-QR, including k2qr.com and its QR creation, management, and scan features;
• Papasito, including papasito.app and its dating and communication features; and
• K2Membership, including its merchant, member, membership, and redemption experiences.

A product may show an additional notice at the point where information is requested. That notice supplements this policy. It does not permit us to sell personal information or use it for cross-site behavioral advertising.

Information we handle

The exact information depends on the service and features you choose.

Information you provide

• Contact and account information, such as an email address, name, authentication code, and support request.
• Transaction information, such as a selected plan, purchase status, merchant, membership, or payment reference. Payment processors handle full card details.
• Content you create or send, including QR content and settings, profile information, photos, messages, media, reports, game commands, and feedback.
• Information needed for a chosen feature, such as dating preferences, date of birth, approximate or precise location, a membership profile photo, or merchant configuration.

Information created by normal service use

• Basic security and operations data, such as IP address, browser or device type, request time, error details, and activity needed to prevent abuse or diagnose a failure.
• On IdeasX, display and accessibility preferences stored in your browser. The Start-up game processes commands and game state; optional generated dialogue may send the relevant game context to the configured model provider.
• On K2-QR, QR configuration and account activity. Dynamic QR scans may create functional analytics such as IP address, approximate location derived from IP, device, operating system, browser, referring page, and scan time. K2-QR may also keep hashed identifiers for rate limiting and attribution needed for its affiliate program.
• On Papasito, profile, matching, swipe, response, message, moderation, and safety activity. Matching signals may include time spent, profile sections viewed, and decision patterns. These signals support matching, safety, and product operation—not advertising.
• On K2Membership, merchant and member identifiers, membership and subscription status, profile photo when used, redemption and reservation activity, Clover references, and operational audit events.

Information from others

We may receive information from a payment provider, a merchant, another user, a platform integration, or a service provider when needed to complete a transaction, deliver a membership benefit, investigate a report, or support the service.

How we use information

We use information for specific service purposes:

• provide the feature or transaction you requested;
• authenticate accounts and preserve sessions;
• process purchases, memberships, refunds, and billing events;
• deliver QR redirects, matching, messaging, membership, and redemption functions;
• send requested service messages, receipts, security alerts, and support replies;
• protect users, prevent fraud and abuse, moderate content, and enforce our Terms;
• diagnose failures and improve service reliability and usability; and
• comply with legal, tax, accounting, and dispute-resolution obligations.

Depending on where you live, the legal basis may be performance of our agreement with you, your consent, compliance with law, or our legitimate interest in securely operating and improving a service you requested. We balance legitimate interests against your rights and do not use that basis for unrelated advertising.

Consent and permissions

Some processing is necessary to perform a requested service. For example, an email address is needed to send an email sign-in code, and a dynamic QR request must be processed to redirect a scanner. We do not describe those required operations as optional consent.

We request consent when the choice is genuinely optional or when law requires it. This includes marketing, nonessential analytics, optional sensitive profile fields, and device permissions such as location, camera, microphone, photos, or notifications. Your device controls these permissions. You may deny or withdraw them, although the related feature may not work.

Withdrawing consent affects future processing. It does not undo processing already performed lawfully or information we must retain for security, accounting, disputes, or other legal duties.

Email and SMS

Service messages

We may send messages you request or that are reasonably necessary for authentication, receipts, membership or redemption activity, account security, safety, support, and service changes. Turning these off may require stopping the related service.

Marketing messages

Marketing email or text messages require a separate opt-in where required. Consent is not a condition of purchase. Message frequency varies and carrier message or data rates may apply. You can unsubscribe from marketing email using its unsubscribe link. For marketing texts, reply STOP to opt out or HELP for help. We may send one confirmation of an SMS opt-out.

We do not sell or share mobile numbers, SMS consent records, or email addresses with third parties for their own marketing. We disclose them only to delivery and support providers acting for us, or when law requires it.

Cookies and local storage

IdeasX uses local browser storage for functional display and accessibility preferences. Our products may use cookies or local storage for authentication, security, language, preferences, checkout state, and other requested features.

We do not use advertising cookies or cross-context tracking pixels. If we introduce optional nonessential analytics, we will identify them and request consent where required before enabling them.

When information is shared

We disclose only what is reasonably needed for these situations:

• Service providers. Hosting, authentication, notification, file storage, support, diagnostics, AI, payment, and fraud-prevention providers process information under their contracts with us. These may include Walden services, Stripe, Clover, email or SMS carriers, and an optional model provider.
• People involved in the feature. Papasito profiles and communications are shown to intended users; K2Membership data is shared with the relevant merchant or member; and K2-QR scan information may be shown to the QR owner.
• Safety and law. We may disclose information when reasonably necessary to protect a person, investigate abuse, respond to valid legal process, or establish and defend legal claims.
• Business changes. Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to this policy and applicable law.

We do not sell personal information or share it for cross-context behavioral advertising.

Retention and deletion

We keep information only as long as reasonably needed for the purpose described here. The period depends on the data and service:

• account and product data generally remains while the account or service relationship is active;
• content and messages remain until deleted, expired, or removed under product or safety rules;
• QR, membership, redemption, and transaction records remain while needed to deliver the service and resolve support, accounting, fraud, or dispute issues;
• security and operational logs are kept for a limited period appropriate to investigation and reliability needs; and
• backups roll off under normal schedules rather than being edited immediately.

When information is no longer needed, we delete, de-identify, or aggregate it. A deletion request may not remove records we must preserve for legal obligations, fraud prevention, safety, accounting, chargebacks, or legal claims. We restrict those retained records to the required purpose.

Your choices and rights

Depending on where you live, you may ask to access, correct, export, or delete personal information; restrict or object to processing; withdraw consent; or appeal a denied request. California residents may also request information about collection and disclosure and may opt out of sale or sharing. We do not sell or share personal information as those terms are used for cross-context behavioral advertising.

Use in-product account controls where available, or email admin@ideasx.com. Tell us which service you use and what you want us to do. We may verify your identity and authority before acting. We will not discriminate against you for exercising a privacy right.

You may also use an authorized agent where law permits. If you believe we handled a request incorrectly, reply to our decision and ask for an appeal. You may complain to the privacy or data-protection authority where you live.

Security and international transfers

We use administrative, technical, and physical safeguards appropriate to the information and service, including access controls, encryption in transit, limited credentials, and security monitoring. No internet service can promise perfect security. Please use unique credentials and tell us promptly if you suspect misuse.

IdeasX is based in California and works with providers and users in multiple countries. Information may be processed outside your state or country. Where required, we use contractual and other safeguards intended to protect information during international transfers.

Children

Papasito is strictly for adults age 18 or older. The other services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without legally valid parental authorization. If you believe a child provided information improperly, contact us so we can investigate and delete it where required.

Changes and contact

We may update this policy when our services, practices, or legal obligations change. We will change the effective date and provide additional notice when a change materially affects your rights or requires new consent.