1 Introduction
Welcome to LaoHeavyRentals ERP ("the App"), operated by Lao Heavy Rentals Co., Ltd. ("we", "our", or "us"). This Privacy Policy explains how we collect, use, store, and protect information when you use our application (mobile and web).
By downloading or accessing the App, you agree to the practices described in this Privacy Policy. If you do not agree, please uninstall the mobile app or discontinue use of the web app.
2 Information We Collect
We collect the following categories of information when you use the App:
| Category | Examples | Purpose |
|---|---|---|
| Account Data | Name, display name, email address, phone number, employee role, and the password you choose (stored only as a one-way hash) | Authentication, access control, and profile management |
| Sign-up Data | When you create an account in the App: your name, your phone number or email address, and the company you ask to join | Creating your account and sending your request to join to that company's administrator |
| Verification Codes | One-time 6-digit codes sent to your phone (SMS) or email when you sign up or reset your password; kept only as a one-way hash and deleted within 2 days | Confirming that the phone number or email is yours |
| Usage Data | Login timestamps, screens visited, actions taken | System monitoring and audit trail |
| Business Data | Work requests, purchase requests, rental contracts, HR requests, maintenance work orders, procurement records, goods receipts, task acknowledgments, quick-action assignments | Core ERP functionality |
| Device Data | Device type, operating system, browser, app version | Technical support and compatibility |
| Photos / Files | Equipment defect photos, goods-receipt evidence photos (optional, user-initiated) | Attached to maintenance work requests and goods receipts |
| Chat & Messaging Data | Direct and group chat messages, @mention references, conversation membership | Internal employee communication via the built-in P2P and group chat feature |
| Push Notification Tokens | Device or browser push token (if notifications are enabled) | Delivering task alerts, approval notifications, and chat mentions to your device |
3 How We Use Your Information
Information collected is used exclusively for:
- Authenticating your identity and enforcing role-based access control (RBAC)
- Processing and routing business requests (maintenance, procurement, HR, rental)
- Generating reports and dashboards for management
- Maintaining an audit trail of all actions for compliance purposes
- Providing technical support and resolving app issues
- Delivering real-time push notifications and in-app alerts for task assignments, approvals, SLA breaches, and @mentions
- Facilitating internal direct and group chat communication between authorized employees
- Recording task acknowledgment decisions (accept / decline) and associated timestamps for work orders and quick-action tasks
We do not use your data for advertising, profiling, or any purpose unrelated to company operations.
4 Data Sharing and Disclosure
We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:
- Within the company: Data is shared with authorized managers, HODs, finance, and HR staff as required by your role and the workflow. Chat messages are visible to conversation participants only.
- Service providers: Trusted cloud hosting and database providers who are contractually bound to keep data confidential.
- Push notification services: Device push tokens are transmitted to Expo's push notification infrastructure, which relays alerts via Apple APNs (iOS) and Google Firebase Cloud Messaging / FCM (Android). No message content is stored by these platforms beyond delivery.
- Legal obligations: If required by Lao PDR law, court order, or regulatory authority.
- Business transfer: In the event of a merger or acquisition, with the same privacy protections maintained.
5 Data Storage and Security
All data is stored on secure servers. We implement industry-standard security measures including:
- Encrypted data transmission via HTTPS/TLS
- Real-time communication secured over WebSocket with tenant-scoped message routing
- JWT-based session authentication with token expiry
- Role-based access control — employees can only access data relevant to their role
- Regular security reviews and access audits
- Database backups and recovery procedures
6 Data Retention
We retain your data for as long as your employment or contract with Lao Heavy Rentals Co., Ltd. is active, and for up to 5 years after termination for legal and audit compliance purposes.
Business records such as rental contracts, purchase orders, maintenance logs, and task acknowledgment audit trails may be retained longer in accordance with Lao PDR commercial and tax regulations.
Chat messages are retained for operational continuity and compliance audit purposes. Soft-deleted messages are removed from display but may be retained in backup storage for up to 90 days.
7 App Permissions
The App may request the following device or browser permissions:
| Permission | Reason | Required |
|---|---|---|
| Camera / Photo Library | Attach equipment defect photos to work requests, capture goods-receipt evidence photos, take the check-in selfie, and scan a company's QR code to ask to join it | Optional |
| Location | Record where you check in or out, so attendance is logged at the correct work site (only while you check in or out) | Optional |
| Microphone | Speak instead of typing in the AI assistant and in search | Optional |
| Internet Access | Communicate with the ERP server and receive real-time updates | Required |
| Push Notifications | Receive alerts about pending approvals, assigned tasks, SLA deadlines, and chat @mentions | Optional |
All permissions are requested at the time of use. You may revoke permissions at any time through your device or browser settings.
8 Children's Privacy
This App is designed for use by company employees and is not intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has accessed the App, please contact us immediately.
9 Your Rights
As a user of this App, you have the right to:
- Access — Request a copy of the personal data we hold about you
- Correction — Request correction of inaccurate personal information (you may also update your display name directly in the App's Settings)
- Deletion — Delete your account at any time from inside the App: Settings → Delete account, or, before you have joined a company, Delete account on your account screen. Your sign-in, email address, phone number and photo are removed at once; your name stays only on records your company must keep, such as approvals and printed documents
- Objection — Object to specific uses of your data
- Portability — Request your data in a machine-readable format
To exercise any of these rights, please contact your HR department or the system administrator.
10 Third-Party Services
The App may use the following third-party services, each governed by their own privacy policies:
- Google Play / Apple App Store — Mobile app distribution platforms
- Expo (React Native) — Mobile app framework and over-the-air updates
- Expo Push Notification Service — Routes push notifications to Apple APNs (iOS) and Google Firebase Cloud Messaging / FCM (Android); only device tokens and notification payloads are transmitted
- TelBiz (Laos) — Delivers verification codes by SMS to Lao mobile numbers; receives only the phone number and the code
- Email provider (SMTP) — Delivers verification codes by email; receives only the email address and the code
- Face check service (AIDC Tech) — When your company turns the attendance face check on, compares your check-in selfie with your profile photo
- Google Gemini — Answers questions you ask the AI assistant, using the work data the question needs
- Cloud Hosting Provider — Secure server infrastructure
We recommend reviewing the privacy policies of these services independently.
11 Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and notify users through the App or by email. Continued use of the App after changes constitutes acceptance of the updated policy.
12 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us: