Privacy Policy

1. Who we are

PassOS is a configuration-first access platform used by organizations to manage people, memberships, pass requests, approvals, QR credentials, access decisions, notifications, and related operational records. In this policy, “PassOS,” “we,” or “us” means the PassOS service operator.

When an organization invites you or enters information about you, that organization may decide why the information is collected and how it is used. In that situation, the organization may also have its own privacy notice and may be the first place to request access, correction, or deletion of organization-managed information.

2. Information we collect

Depending on how PassOS is configured by your organization, we may process:

• Account and identity information: name, email address, password verification and recovery records, account status, and session or device security records. PassOS stores password hashes rather than your raw password.
• Organization and profile information: organization membership, role, unit or member profile details, contact methods, identity records, relationships, family or related-person records, and communication preferences.
• Access and pass information: pass requests, pass types, approval and lifecycle status, validity dates, selected sites or zones, access conditions, QR credential references, scan attempts, and access decisions.
• Communication information: support messages, notification preferences, email delivery metadata, and mobile push-notification tokens when you grant permission to receive notifications.
• Operational and security information: timestamps, browser or device information, request correlation data, audit events, and information needed to detect, investigate, prevent, or recover from misuse and security incidents.
• Files and organization records: information included in files, imports, exports, or other records that an organization chooses to store in PassOS. These files are handled as private organization data and are not public by default.

We do not ask for more information than is needed for the configured workflow. Please do not enter sensitive information into free-text fields unless your organization has told you that it is required for a specific access or support process.

3. How we use information

• create and secure accounts, sign-in sessions, verification, and recovery;
• connect you to the organization and profile that authorized your access;
• process pass requests, approvals, schedules, QR credentials, and access decisions;
• send service, security, invitation, and workflow notifications;
• provide support and troubleshoot service or account problems;
• maintain tenant separation, audit trails, fraud prevention, and platform security;
• operate backups, retention, privacy requests, legal holds, and recovery workflows; and
• comply with legal obligations and enforce our agreements.

PassOS does not sell personal information or use it for targeted advertising. We do not use QR credentials as a general-purpose tracking system; credentials are issued and checked for the access workflow and are subject to expiry, rotation, and authorization controls.

4. Sharing and disclosure

We may disclose information only as needed for the purposes described above:

• Within your organization: to authorized administrators, approvers, support users, or other personnel according to the organization’s roles and policies. Access is intended to remain limited to the relevant organization.
• Service providers: to providers that host or operate databases, queues, private file storage, email delivery, or mobile push notifications. Providers receive only the information needed to perform their service and must protect it under their applicable agreements.
• Legal and safety disclosures: when required by law, legal process, court order, or when reasonably necessary to protect users, organizations, PassOS, or the public from fraud, abuse, or security threats.
• Business changes: if PassOS is involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and legal protections.

PassOS is designed for tenant isolation. Platform-level reports are intended to use aggregate information rather than expose raw personal records across organizations.

5. Cookies, sessions, and local storage

PassOS uses essential browser storage and cookies to maintain a secure session, protect form submissions, and remember the organization selected for the current session. The mobile app stores session material in the device’s protected secure storage and may keep a limited, read-only portal snapshot for approved offline presentation of the interface. PassOS does not use these essential mechanisms for advertising tracking.

6. Security

PassOS uses access controls, tenant checks, encrypted or tokenized handling for selected high-risk values, masked views, short-lived and rotating credentials, audit records, and private file grants. No internet service can guarantee absolute security. You are responsible for protecting your password, device, invitation links, and any QR credential shown to you, and for reporting suspected unauthorized access promptly.

7. Retention and deletion

We keep information for as long as needed to provide the service, maintain account and organization records, complete access and audit workflows, resolve disputes, meet legal obligations, and protect security. Retention can differ by record type and organization policy.

Deletion, correction, and anonymization workflows are subject to identity verification, authorization, active legal holds, security needs, and applicable retention obligations. Backups and append-only security or audit evidence may continue to contain limited information for the period required to protect the service and prove past actions.

8. Your choices and rights

Depending on your location and the role of your organization, you may have rights to request access to, correction of, deletion of, restriction of, or objection to the processing of your personal information. You may also be able to change notification preferences or revoke mobile notification permission in your device settings.

Send a request to privacy@passos.store. We may need to verify your identity and may ask you to contact your organization administrator first where the organization controls the relevant record. We will not ask you to send a password, private key, QR token, or other secret by email.

9. Children

PassOS is an access-management service for organizations and families. It is not directed to children as a standalone audience. Where an organization creates a related or family profile for a child, the organization is responsible for obtaining any consent and providing any notices required by applicable law.

10. Changes to this policy

We may update this policy when the service, providers, or legal requirements change. The “Last updated” date above identifies the current version. Where required, we will provide additional notice through the service or by email.