1.Who we are
TexPass (gettexpass.com) makes free digital passports for fabric lots: one page with the certificates and test reports for a batch, shared by link or QR code. TexPass is run by the TexPass team.
Under the DPDP Act 2023 we are the data fiduciary for the personal data described here: we decide why and how it is used. The companies that host and process data for us are our data processors.
TexPass is a service for businesses. Most of what you put on TexPass is business information (fabric details, certificates, test reports). This policy covers the personal data that comes with it, such as your name, email and phone number.
2.What we collect
| What | Details |
|---|---|
| Account details | Your name, email address and phone number, and your password (stored by Firebase Authentication, never readable by us). The phone number is stored as you type it and is not verified yet. |
| Company details | Company name, type, city, country and (optionally) GSTIN, entered by you or by us for a pilot company. |
| Passport content | Product details, lot numbers, composition, where the fabric was made, and the documents you upload (certificates, lab reports, invoices, photos). Documents can contain names, addresses and signatures of people at your company or your suppliers. |
| Orders and payments | What you ordered, prices, sample delivery details and payment references. We don't receive or store card, UPI PIN or bank account details. |
| Contact form messages | Name, email, phone, company, topic and message you send from the contact page. These are not linked to an account. |
| Buyer requests | The buyer's company name and the items asked for, and which suppliers opened or answered a request. |
| Technical logs | Request time, route and status. Logs never contain your documents, passwords or form contents. |
| View and scan counts | How often a passport is opened or its QR code scanned, in total. We don't store who viewed it or their IP address. |
| Emails we send | Which email we sent to which address, when, and whether it was delivered. |
3.Why we use it
- To create and run your account and sign you in.
- To publish the passports you choose to publish and show them to people with the link.
- To read your documents and suggest the details, which you confirm.
- To check certificates on official registries and coordinate lab tests you or a buyer order.
- To take payments and keep invoices and order records.
- To email you about your passports, orders, tests, buyer requests and certificates that are about to expire.
- To answer messages you send us.
- To stop forged documents, fraud and misuse.
- To count, in total, how TexPass is used so we can improve it.
We use your data only for these purposes. We don't sell it and we don't use it for advertising.
4.Consent and the legal basis
We process your personal data with your consent, which you give by ticking the box when you create your profile. We record which version of this policy you agreed to and when.
Some processing may also fall under the DPDP Act's "legitimate uses", for example keeping invoices because tax law requires it, or a contact form message you send us voluntarily.
- Withdraw consent: delete your account from Your account. Things done before that (for example a passport your company published) aren't undone.
- Optional emails ("your passport was opened", expiry reminders) can be turned off from the link at the bottom of each email, without deleting your account.
5.Automated reading of documents
To fill in fields for you, uploaded documents may be read by an external AI provider, currently Google Gemini, which may process them outside India. The result is only a suggestion: you check and confirm every field, and automated reading never marks anything as Verified.
If we use a service outside India to read your documents, it only gets what it needs for that task.
6.Where it is stored and who processes it
Uploaded files are private. They open only through links that expire after 10 minutes.
| Provider | What they do for us | Where |
|---|---|---|
| Google Firebase (Firestore) | Database for accounts, companies, passports and orders | Mumbai, India (asia-south1) |
| Google Firebase Authentication | Sign-in, passwords and email sign-in links | Google Cloud |
| Google Firebase App Hosting | Runs the website | Google Cloud |
| Cloudflare (Workers and R2) | Runs the API; stores uploaded files and QR labels | Cloudflare network |
| Google Gemini | Reads uploaded documents to suggest details | May be outside India |
| Email provider (Resend) | Sends account and order emails | Provider's cloud |
| Razorpay | Payment links and payments | India |
| Sentry (only when switched on) | Error reports, without your documents, passwords or form contents | Provider's cloud |
These providers may use the data only to provide their service to us.
7.Who else sees it
- Labs: when a test is ordered, an accredited lab receives the sample and the details it needs to test it (lot number, order reference). Labs issue the reports; TexPass coordinates them.
- Buyers and anyone with a passport link: they see only what the passport shows publicly. Fields and documents you mark private are never shown.
- Buyers who sent you a request: they see which of your published passports you sent them.
- Authorities: only when the law requires it.
8.What is public
- A published passport is visible to anyone with its link or QR code. Passport pages ask search engines not to index them.
- When you withdraw a passport, its link shows that it was withdrawn. Earlier versions are kept so changes stay traceable.
- Your public company page (gettexpass.com/c/…) shows your company name, type, city and country, your verified company certificates and your published passports. It is on by default; you can turn it off in Company settings, and then the page no longer exists. Company pages ask search engines not to index them.
9.How long we keep it
| Data | How long |
|---|---|
| Your account details | Until you delete your account. |
| Company records (published passports and their versions, orders and invoices, test results, the history of verified items) | Kept after a member leaves, because buyers rely on published passports and tax law requires invoices to be kept. Passport codes are never reused. |
| Files from Download my data | Deleted after one day. |
| Emails we sent you | Until you delete your account. |
10.Your rights
Under the DPDP Act 2023 you can:
- Access: download a copy of the personal data we keep about you from Your account → Download my data.
- Correct and update: change your name and phone in the app, or write to us.
- Erase: delete your account from Your account → Delete my account. We delete your name, email, phone and sign-in, the files you uploaded before you had a company, and the emails we sent you, usually within minutes.
- Withdraw consent: by deleting your account (see Consent above).
- Have your grievance answered: see Grievances and your data rights.
- Nominate someone to use these rights for you if you die or can't act: write to the grievance contact.
We answer requests as soon as we reasonably can. If you aren't satisfied with our answer, you can complain to the Data Protection Board of India.
11.Children
TexPass is for businesses. You must be 18 or older to create an account. We don't knowingly collect data about children.
12.How we protect it
Uploaded files are stored privately and opened only through links that expire after 10 minutes. Database rules stop one company from reading another company's data, and only TexPass staff can change trust labels. No system is perfectly secure. If a personal data breach happens, we will tell the affected people and the Data Protection Board as the law requires.
13.Changes to this policy
When this policy changes, we update the date at the top. We record which version you agreed to; if a change matters for how we use your data, we will ask for your consent again.
Questions about this page? Write to hello@gettexpass.com or use the contact page.
TexPass is not a lab or a certification body. Accredited labs issue test reports and certification bodies issue certificates; TexPass coordinates tests and checks certificates on official registries.