Privacy Policy
Your styles, your rolls, your customers and your prices are yours. This page says plainly what we hold, why we hold it, and what you can make us do with it.
Who this covers
Two groups: people reading the public pages, and the fabric companies that subscribe along with the users inside them. Where you load your own customers and suppliers into the system, that data is yours — you decide what happens to it and we act only on your instructions.
What we collect
Your account
- Name, work email and a hashed password. We never store the password itself.
- Your organization and your role in it.
- Sign-in records — time, IP address, browser — kept to catch abuse.
What you put in the system
- Styles, colors, rolls, dye lots, warehouse locations and barcodes.
- Customers, suppliers, purchase orders, invoices, payments, ship-to addresses and payment terms.
- Anything you upload.
We open your data only to run the service, to investigate something you have reported, or where the law compels us.
What we never collect
- Card numbers. Those go straight to the payment processor and never touch our servers.
- Advertising or cross-site tracking identifiers.
- Location beyond the rough region an IP address implies.
Camera, microphone and the assistant
Barcode scanning decodes frames in your browser. No image is uploaded or stored. Voice input records only while you hold the control and only after you grant permission, and is converted to text so the assistant can answer.
The assistant sends your question and the specific records needed to answer it to a third-party AI provider under an agreement that forbids training on your data. We do not train models on your data either. Nothing is sent unless you ask the assistant something.
Why we are allowed to hold it
| Purpose | Legal basis (UK/EU) |
|---|---|
| Running the application and your account | Performance of a contract |
| Billing | Performance of a contract |
| Security and abuse investigation | Legitimate interests |
| Support and service notices | Performance of a contract |
| Analytics on the public pages | Consent |
| Tax and accounting records | Legal obligation |
Who else touches it
- Vercel — hosting and delivery (United States).
- Supabase — database and authentication (United States).
- Stripe — subscription billing and card handling.
- Anthropic — the model behind the in-app assistant.
- Resend — transactional email such as password resets.
- Google Analytics — public pages only, and only if you allow it.
Each is bound to process data only on our instructions. We would also disclose data if the law required it, or in a sale of the business — in which case we would tell you before your data fell under a different policy.
Where it lives and how long
On servers in the United States. For transfers out of the UK, EEA or Switzerland we rely on Standard Contractual Clauses. Your data stays while your subscription is active; after cancellation we hold it 30 days so you can export or come back, then delete it. Ask and we will delete it sooner. Invoices are kept up to seven years because tax law says so. Server logs go in under 90 days.
Keeping it safe
Encrypted in transit and at rest. Access is enforced server-side by role — Owner, Admin, Member, Viewer — and one organization cannot see another’s data. Voids and credit memos are written to an audit log that cannot be edited. No system is perfect; if a breach reaches your data we will tell you and the regulator in the time the law allows.
What you can demand
A copy of what we hold, a correction, a deletion, an export, an objection to processing, or withdrawal of consent — and no worse treatment for asking. Email privacy@textilewizard.com and we answer within 30 days after checking you are who you say you are. Most of it is self-service anyway: inventory, orders and contacts export to CSV from inside the application whenever you like.
California. You have those rights under the CCPA and CPRA, plus the right to know what we collect and why — sections above. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is no “Do Not Sell or Share” process to use.
UK and EEA. You can complain to your supervisory authority; in the UK that is the Information Commissioner’s Office.
Children
This is a business tool, not for anyone under 16, and we do not knowingly collect their data. Tell us if you think we have and it goes.
Cookies
Listed one by one on the Cookie Policy.
Contact
Siamak Kalhor Consulting LLC
[street], [city], CA [zip], United States
privacy@textilewizard.com
Last updated 28 August 2026.