Privacy Policy

Fabric Square (“Fabric Square”, “we”, “us” or “our”) provides a multi-tenant Software-as-a-Service platform built for fabric, apparel and rental businesses, covering human-resource and people management, payroll, sales and invoicing, procurement, inventory, production (stitching), finance, reporting, analytics and optional AI-assisted features.

This Policy applies to all visitors, account holders, employees of our customer organisations and other individuals whose information is processed through the Services. By using the Services, you acknowledge that you have read and understood this Policy.

Controller and processor roles. For account registration, billing and our own business operations, Fabric Square acts as the data controller. Where a customer organisation uploads or manages information about its own employees, workers, customers or suppliers, that organisation is the controller of such data and Fabric Square acts as a data processor handling the data on its behalf and on its instructions, as described in our Terms & Conditions.

We collect the following categories of information:

a. Account and identity information

• Name, email address, telephone number, password (stored only in hashed form) and profile photograph.
• Optional personal details such as date of birth, gender, address and nationality where provided as part of an employee profile.

b. Business and organisation information

• Company name, registered and trading address, industry, team size, website and contact details.
• Tax and statutory identifiers such as GSTIN and PAN, used for invoicing and compliance.

c. Operational data you submit through the Services

• Employee and HR records, attendance, leave, holidays and payroll and salary information.
• Bank and payment details of employees or counterparties (such as bank account number, IFSC code and UPI ID) where you choose to record them for payroll or settlement purposes.
• Customer, supplier, sales, purchase, inventory, measurement, production and financial records that you create within the Services.

d. Billing information

• Subscription plan, billing cycle, invoices, payment status and payment/order references. Card and bank-credential entry is handled directly by our payment partner. Fabric Square does not collect or store your full card number, CVV or banking passwords.

e. Technical and usage information

• Device and browser type, operating system, IP address, approximate location, log data, and information about how you interact with the Services, collected for security, troubleshooting and improvement.

f. Communications

• Support tickets, emails and other correspondence you send to us.

g. Enquiry and interest information from website visitors

You can contact us, register interest in a demo, vote for features and send feedback from our public website without creating an account. When you do, we collect:

• Your name, business name, mobile number, email address, city, state, the kind and size of your business, and how and when you would prefer to be contacted.
• The features you tell us you are interested in, any software you say you use today, and any free-text you choose to write about your difficulties, feedback or other notes.
• Feedback messages, the category you select for them, and an email address if — and only if — you choose to provide one so that we can reply.
• A randomly generated visitor identifier held in your browser, and a salted, non-reversible hash of your IP address. We do not store your IP address itself for these forms; the hash is used only to compare one submission against another so that we can limit automated abuse, and standard technical information such as your browser type, described in section (e) above.

We use this information to contact you about a demonstration if you have asked for one, and — in aggregate — to decide what to build next. We do not create an account for you, and nothing on these forms is a purchase.

We use the information we collect to:

• Provide, operate, maintain and secure the Services;
• Create and administer accounts, authenticate users and enable multi-tenant access controls;
• Process subscriptions, payments, invoices, renewals and refunds;
• Deliver core functionality such as payroll, billing, reporting, inventory and production workflows;
• Provide optional AI Assistant and AI Forecasting features on eligible plans;
• Send transactional and service messages by email and, where enabled, WhatsApp notifications;
• Provide customer support and respond to your requests and grievances;
• Monitor, detect and prevent fraud, abuse and security incidents;
• Improve and develop the Services and analyse usage in aggregate; and
• Comply with applicable laws, tax obligations and lawful requests.

We process personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. Depending on the context, our processing relies on your consent, the performance of a contract with you, our legitimate business interests, or compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time by contacting us, although this may limit your ability to use certain features.

On eligible subscription plans, the Services offer AI Assistant and AI Forecasting features. When you use these features, relevant business data may be transmitted to third-party AI service providers solely to generate the requested response or forecast. The AI Assistant is designed to operate on a read-only basis over your data, and its use is logged. We take reasonable steps to work with providers that do not use your business data to train their general models; however, the processing terms of each provider also apply. If you prefer not to use AI features, you may use a plan that does not include them.

Where your organisation enables WhatsApp notifications, message content and the recipient telephone number are shared with our messaging partner to deliver bills, reminders and other operational communications. You are responsible for ensuring that you have a valid basis to message your recipients.

We use strictly necessary cookies and similar storage to keep you signed in, remember your preferences (such as theme and language) and secure your session. We may also use limited analytics to understand and improve performance. You can control cookies through your browser settings, but disabling essential cookies may prevent the Services from functioning correctly.

Our public website also stores four items in your browser’s local storage, none of which is a cookie and none of which is sent to any third party: fs_visitor_id, a random identifier that groups your own submissions together; fs_votes, the list of features you have voted for so that the page can show your own choices back to you; fs_lead_source, a single word recording how you first reached us — for example a search engine, a social profile, or a link someone shared; and fs_basket, the plan and add-on selection you configured while exploring our pricing, so that it can be carried forward for you. fs_basket is never sent to any third party, is not submitted with an enquiry, and is cleared once it has been used. If you send us an enquiry, both fs_visitor_id and fs_lead_source are submitted to us along with it — the first so we can group it with anything else you have sent us, the second so we can tell which of our own channels people find us through. Neither holds any browsing history and neither identifies you by name. You can clear all four at any time through your browser’s site-data controls, with no effect on anything else.

Where we have enabled it, our public forms are protected by Cloudflare Turnstile, which may set its own cookies or storage in order to tell a person apart from an automated script. Cloudflare processes this data as our service provider.

We do not sell your personal data. We share information only as necessary to operate the Services, namely with:

• MongoDB Atlas — Primary application database hosting.
• Amazon Web Services (AWS S3) — Secure storage of uploaded files and documents (India region).
• Vercel — Application hosting and content delivery.
• Payment gateway partner (an RBI-authorised payment aggregator) — Payment processing and settlement.
• AiSensy — WhatsApp business notifications (where enabled).
• AI service providers (e.g. Groq, Google, OpenRouter, Anthropic) — Powering AI Assistant and AI Forecasting features (Pro plan).
• Email delivery provider (SMTP) — Transactional and account-related emails.

We may also disclose information to comply with applicable law, regulation, legal process or enforceable governmental request; to enforce our Terms; to protect the rights, property or safety of Fabric Square, our users or others; and in connection with a merger, acquisition or sale of assets, in which case we will require the recipient to honour this Policy.

Application data is hosted with reputable cloud infrastructure providers, and uploaded files are stored in cloud storage located in India. Some of our sub-processors may process limited data outside India. Where data is transferred across borders, we take reasonable steps to ensure it remains protected in line with this Policy and applicable law.

We implement reasonable technical and organisational security measures to protect your information, including:

• Encryption of data in transit using industry-standard TLS;
• Storage of passwords in salted, hashed form;
• Encryption of sensitive integration credentials at rest;
• Role-based, multi-tenant access controls; and
• Audit logging of sensitive administrative actions.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security, and you are responsible for keeping your login credentials confidential.

We retain personal and business data for as long as your account is active and for a reasonable period afterwards as needed to provide the Services, resolve disputes, maintain financial and tax records, and comply with our legal obligations. Records that we are required by law to keep (such as invoices and tax records) are retained for the period prescribed by applicable law. When data is no longer required, we delete or anonymise it.

Enquiry, interest, vote and feedback data submitted through our public website by people who are not account holders is retained for up to 24 months from the date of submission, and is deleted or anonymised sooner if you ask us to.

Subject to applicable law, you may have the right to access, correct or update your personal data, request deletion, withdraw consent, and raise a grievance regarding our processing. Account holders can manage much of their information directly within the Services. To exercise any right, please contact us using the details below. We may need to verify your identity before acting on a request.

If you submitted an enquiry, a feature vote or feedback through our public website and never created an account, you have the same rights of access, correction and deletion. Write to us using the contact details below, from the email address or quoting the mobile number you gave us, and we will locate and remove your submission.

If you are an individual whose data was uploaded by a customer organisation (for example, as an employee record), please direct your request to that organisation, which acts as the controller of such data. We will assist our customers in responding to such requests.

The Services are intended for businesses and their authorised personnel and are not directed to children. We do not knowingly collect personal data directly from children. If you believe a child has provided us personal data, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Services after an update constitutes acceptance of the revised Policy.

For any questions, requests or grievances regarding this Policy or your data, you may contact our Grievance Officer, Fabric Square at the details below. We aim to acknowledge and address grievances within the timelines required under applicable law.