Privacy Policy
Passiko Labs Private Limited · accounts.passiko.com
Last updated: 18 October 2026
Effective date: 18 October 2026
1. Who we are
This Privacy Policy explains how Passiko Labs Private Limited ("Passiko", "we", "us", "our") collects, uses, shares and protects your personal data when you use your Passiko account at accounts.passiko.com and any Passiko product you sign in to with it (together, the "Services").
- Legal name: Passiko Labs Private Limited, incorporated in India under the Companies Act, 2013
- CIN: U62011ME2026PTC477024
- GSTIN: 27AARCP5915B1ZA
- Registered office: 543, Shivaji Nagar Road, Near Old Fire Station, Shivaji Nagar, Nanded, Maharashtra 431602, India
- Privacy contact: legal@passiko.com
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), Passiko is the Data Fiduciary for the personal data described in this policy, and you are the Data Principal. We also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
2. What this policy covers
One Passiko account lets you sign in across Passiko Labs' products. Our current and planned products include a free QR code generator, India On Record (an Indian case-timeline news portal), a photography delivery tool, and small web tools. This policy applies to all of them. If a product collects data in a way not described here, it will have its own short privacy notice, which will be shown to you before or when that data is collected and will be read together with this policy.
3. The personal data we collect
We only collect what we need to run the Services.
a) Data you give us
| Data | When |
|---|---|
| Email address | When you sign in with an email magic link |
| Name, email address and profile picture | When you choose "Sign in with Google" (shared with us by Google) |
| Phone number | (Planned feature) When you choose to verify or sign in with a phone OTP |
| Billing details you provide (for example name, billing email, and GST details if you want a GST invoice) | When you buy a paid plan |
| Messages and attachments you send us | When you contact support or make a privacy request |
| Content you upload or create in a product | When you use that product (for example, photos in the photography delivery tool), where that product allows uploads |
b) Data collected automatically
- Sign-in and security data: session tokens, sign-in times, and technical information about the device and browser used to sign in, so we can keep your account secure.
- Usage and analytics data: we use PostHog product analytics, which automatically records interactions such as page views and clicks (autocapture), builds aggregated heatmaps, and measures page performance (web vitals). This can include device, browser, approximate location derived from IP address, and referring page. Session replay (screen recording) is turned off.
- Cookies and similar technologies: see section 10.
c) Payment data
Payments are processed by Razorpay. Your card, UPI, net-banking or wallet details are entered directly with Razorpay. We never see or store your full card details. We receive limited information from Razorpay, such as a payment ID, amount, status, and the payment method type, so we can confirm your purchase and issue invoices.
d) Data we do not intentionally collect
We do not ask for sensitive personal data such as passwords for other services, health information, biometric data, or bank account or card numbers. Please do not send us such information through support. (We do not use passwords for sign-in; we use magic links, Google sign-in and, in future, phone OTP.)
4. Why we use your data, and on what basis
Under the DPDP Act, we process your personal data either with your consent or for a legitimate use permitted by Section 7 of the Act.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your Passiko account; sign you in across Passiko products | Email, Google profile data (name, email, picture), phone number (when available), session data | Consent, given when you create your account and sign in. Where you have voluntarily provided data for this specific purpose and not objected, this is also a legitimate use (Section 7(a)) |
| Send magic-link sign-in emails and one-time passwords | Email address, phone number | Consent |
| Process payments, issue invoices, and handle refunds | Billing details, Razorpay payment records | Consent; and compliance with tax and accounting laws (Section 7) |
| Keep the Services secure, prevent fraud and abuse, and fix bugs | Sign-in, device and usage data | Consent; and legitimate uses permitted by law, including compliance with legal obligations |
| Understand how the Services are used and improve them | Analytics data (PostHog) and analytics cookies | Consent, which you give or refuse through our cookie/analytics consent banner. Analytics run only after you accept |
| Reply to your support and privacy requests | Contact details and messages | Consent |
| Send important service messages (for example, security alerts, changes to these policies, billing receipts) | Email address | Consent and, where required, legal obligation |
| Send product news or marketing | Email address | We do not currently send marketing emails; we send only service and transactional emails. If this changes, we will ask for your separate, opt-in consent first, and you will be able to unsubscribe at any time |
| Comply with law, court orders, or lawful requests from government authorities | Any relevant data | Legitimate use (Section 7) |
Your consent. When we ask for your consent, we will show you a clear notice describing the data and the purpose. You can withdraw consent at any time, as easily as you gave it, by emailing legal@passiko.com (for example, to request deletion of your account). For analytics, you can also change your choice at any time through the consent banner or settings. Withdrawing consent does not affect processing that already happened. After withdrawal, we will stop processing and erase your data within a reasonable time unless the law requires us to keep it (see section 7). Some Services cannot work without certain data; for example, we cannot keep you signed in without your email address.
Consent Managers. Where permitted under the DPDP Act, you may also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India.
5. Who we share your data with
We do not sell your personal data. We share it only with service providers ("sub-processors" or Data Processors) that help us run the Services, under contracts that require them to protect it and use it only on our instructions.
| Sub-processor | What they do for us | Data involved | Where data is processed |
|---|---|---|---|
| Supabase | Database and authentication storage (Postgres) | Account data, product data | India, Mumbai (AWS ap-south-1) |
| Vercel | Website and application hosting | Requests to our websites, including IP address and technical data | Global infrastructure, including outside India |
| Resend | Sending magic-link and service emails | Email address, email content | May include locations outside India |
| Google (Google OAuth) | "Sign in with Google" | Name, email, profile picture (shared by Google with us at your request) | Google's global infrastructure |
| Razorpay | Payment processing | Payment and billing details | India |
| PostHog (US Cloud) | Product analytics | Usage and device data, analytics cookies | United States |
| MSG91 (planned) | Sending SMS one-time passwords | Phone number, OTP message | To be listed here before this feature launches |
Razorpay and Google also act under their own privacy policies for some processing (for example, Razorpay's obligations under Reserve Bank of India rules).
We may also disclose personal data:
- to comply with applicable law, a court order, or a lawful request from a government or law-enforcement authority;
- to protect the rights, safety or property of our users, the public or Passiko, including to prevent fraud;
- to our professional advisers (such as lawyers and auditors) under a duty of confidentiality; and
- as part of a merger, acquisition or sale of assets, in which case the new owner will be bound by this policy or will notify you.
We will keep the list of sub-processors on this page up to date.
6. Transfers outside India
Most account data is stored in India (Supabase, Mumbai). Some of our service providers process data outside India, in particular PostHog (United States), Vercel (global hosting), and Resend (email delivery, which may be processed outside India), as well as Google for Google sign-in.
Section 16 of the DPDP Act allows personal data to be transferred outside India except to countries the Central Government has restricted by notification. We will not transfer personal data to any restricted country. We choose providers that maintain security standards at least as protective as those required under Indian law (including Rule 7 of the SPDI Rules), and our contracts with them require appropriate safeguards.
7. How long we keep your data
We keep personal data only for as long as needed for the purposes above, then erase it, unless the law requires us to keep it longer.
| Data | How long we keep it |
|---|---|
| Account data | While your account is active. When you ask us to delete your account, we erase it within 30 days of your request, except as below |
| Sign-in, security and traffic logs | At least one year, as required by the DPDP Rules for the purposes listed there (such as security and investigating misuse), then deleted once no longer needed for those purposes |
| Invoices, payment and tax records | 8 years, as required by tax and accounting laws (for example, the Companies Act, 2013 and GST laws) |
| Analytics data | 12 months, after which it is deleted or made anonymous |
| Support emails | 2 years after the request is closed |
Backups are rotated, and deleted data is removed from them within 30 days. Data that has been fully anonymised so it can no longer identify you is not personal data and may be kept.
8. How we protect your data
We use reasonable security practices and procedures appropriate to the data we hold, as required by the DPDP Act and the SPDI Rules, including:
- encryption of data in transit (HTTPS/TLS) and at rest with our database provider;
- passwordless sign-in (magic links, Google sign-in, OTP), so we never store your password;
- access controls so only authorised people who need data for their work can access it;
- logs and monitoring to detect and investigate unauthorised access; and
- contracts with service providers that require them to keep data secure.
No system is perfectly secure. If a personal data breach happens, we will inform affected users without delay, in plain language, explaining what happened, the likely consequences, what we are doing about it, and what you can do. We will also report it to the Data Protection Board of India and, where required, to CERT-In, within the timelines required by law.
9. Your rights
Under the DPDP Act you have the right to:
- Access information: get a summary of the personal data we process about you, how we process it, and who we have shared it with.
- Correction, completion and updating: ask us to correct inaccurate or misleading data, complete incomplete data, or update it.
- Erasure: ask us to delete personal data that is no longer needed, or after you withdraw consent, unless the law requires us to keep it.
- Withdraw consent at any time (see section 4).
- Grievance redressal: complain to us and get a response (see section 13).
- Nominate: nominate another person to exercise your rights on your behalf if you die or become unable to act because of incapacity.
How to exercise your rights: email legal@passiko.com from the email address linked to your account, with the subject "Privacy request". We may need to verify your identity before acting. We will not charge you for reasonable requests.
Your duties. The DPDP Act also asks you to give accurate information, not impersonate anyone, and not file false or frivolous complaints.
If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.
10. Cookies
We use a small number of cookies and similar technologies (such as local storage).
| Type | Why | Can you turn it off? |
|---|---|---|
| Essential | Keep you signed in across Passiko products, keep sessions secure, and remember basic preferences | No. The Services cannot work without them |
| Analytics (PostHog) | Help us understand how the Services are used, measure performance, and improve them | Yes. Analytics cookies are set and analytics run only after you accept them in our consent banner. You can change your choice at any time through the banner or settings, or by emailing legal@passiko.com. You can also block cookies in your browser settings |
We do not use advertising cookies or allow third parties to track you for advertising. If this ever changes, we will update this policy first.
11. Children
The Services are only for people aged 18 or older. Under the DPDP Act, a "child" is anyone under 18.
- We do not knowingly collect personal data from anyone under 18.
- We do not carry out tracking, behavioural monitoring, or targeted advertising directed at children.
- If we learn that we have collected personal data from someone under 18, we will delete it. If you believe this has happened, please write to legal@passiko.com.
12. Google sign-in (Google API Services disclosure)
When you choose "Sign in with Google", Google shares your name, email address and profile picture with us. We use this information only to create and sign you in to your Passiko account and display your name and picture in your account. We do not use it for advertising, we do not sell it, and we do not share it with others except our sub-processors as needed to provide the Services (section 5).
Passiko's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Passiko from your Google account at any time at myaccount.google.com/permissions.
13. Grievance Officer
If you have a concern or complaint about how we handle your personal data, please contact our Grievance Officer:
- Name: Akshay Jondhale
- Designation: Director & CEO (Grievance Officer)
- Email: legal@passiko.com
- Address: Passiko Labs Private Limited, 543, Shivaji Nagar Road, Near Old Fire Station, Shivaji Nagar, Nanded, Maharashtra 431602, India
We will acknowledge your grievance within 48 hours and resolve it within 15 days. We will never take longer than the time allowed by applicable law.
14. Changes to this policy
We may update this policy when our Services, providers or legal obligations change. The "Last updated" date at the top shows the latest version. If we make a significant change, such as a new purpose or a new kind of data, we will tell you by email or in the product before it takes effect and, where the law requires, ask for your consent again.
15. Contact
- Privacy and legal: legal@passiko.com
- Support: support@passiko.com
- General: hello@passiko.com
See also our Terms of Service and Support & Contact pages.