FlowHRMS Privacy Policy

1. Our role

For people who register a company or hold a FlowHRMS account in their own right, Flowacord is the Data Fiduciary. For employees whose work records a company keeps in FlowHRMS, that company is the Data Fiduciary and Flowacord is its Data Processor.

2. What we collect

• Account holders: name, email, mobile number, role, company details, and how you heard about us.
• Employees of our customers: the work records described in the employee notice — contact details, attendance times, location only at check-in and check-out (and at field-visit taps where their company uses field visits), the route during working hours where their company switches route tracking on and they agree, field visits, leave, tasks and photos, salary and payslips, and documents.
• Everyone who signs in: IP address, device and browser details, and sign-in times, for security.
• People who use the FlowHRMS mobile app: a notification token for each phone they sign in on, the kind of phone (Android or iOS) and when it was last used, so we can send their notifications. A phone's token is deleted when they sign out on it, and all of them when the account is closed.
• Consent records: what notice was shown, what was agreed, when, and from which IP address and device.

3. Why, and on what basis

We process personal data to provide and secure FlowHRMS, to support customers, and to meet legal obligations. Named Flowacord staff may access a customer company's data to support that company and to maintain and improve FlowHRMS; each access is recorded, and any change they make is shown to the company as "Flowacord support". We rely on consent given through our notices, and on the legitimate uses the Act permits (including employment purposes, where our customer relies on them). We ask separately for optional purposes such as product updates.

4. Location

FlowHRMS captures an employee's location at the moment they check in or check out, to confirm a permitted place of work, and — where their company uses field visits — at the moment they tap Going out, Reached, End visit or Back at office, to record where they went and the road distance travelled. Employees may refuse location at visit taps; their visits are then recorded without it.

Where a company switches route tracking on for an employee, and the employee agrees, the FlowHRMS app records their location every few seconds from check-in to check-out (about once a minute while they are still), including when the app is closed, with a notification shown on the phone throughout. If the employee also allows “Physical activity”, the app records the steps the phone counts, which way it is facing, and whether they are still, walking, cycling or in a vehicle, to follow the route through short stretches where GPS can't reach and to tell walking from driving. Refusing it changes nothing else. It never records before check-in or after check-out. The employee can see their own route exactly as their manager does. Route points are deleted after 60 days; the day's summary is kept with the attendance record. An employee who refuses is never stopped from checking in; their manager is told the route wasn't shared.

Route data is seen only by the employee, their reporting manager, the head of their department, their company's owner and admins, and anyone else the company allows to see everyone's field visits. It is never sold, never shared for advertising and never used for ads.

5. Sharing and storage

We do not sell personal data or use it for advertising. Service providers who host and operate FlowHRMS process it for us under their terms: Supabase (database, sign-in and private file storage), Cloudinary (photo and document storage), Hostinger (website hosting and email), Expo and Google Firebase Cloud Messaging (delivering notifications to the mobile app: the notification's title and text, and the phone's notification token), Google Maps Platform (maps, and road distances for field visits: the start and end points of each leg), and Razorpay (plan payments made by a company on the website). Most act only on our instructions; Expo and Google Maps Platform may also use what they receive for their own purposes, such as running and improving their services, under their own privacy policies. Data may be processed outside India by these providers where the law permits. We disclose data to authorities only where the law requires it.

6. Security

We use encryption in transit, access controls that keep each company's data separate, least-privilege access for our staff, and logging of security-relevant events. Invitation links and similar tokens are stored only as hashes. We will notify affected people and the Data Protection Board of a personal data breach as the law requires.

7. Retention

Account data is kept while the account is open. When we close an account at its holder's request, nobody can sign in to it again, it is unlinked from every company at once, and its phones get no more notifications. What remains is kept for up to three months and erased or anonymised within 90 days of closure, except what the law requires us or the employer to keep (for example wage, attendance and tax records, which the employer keeps under “Deleted user”). Records of consent are kept for as long as we may need to show that consent was obtained. Security logs are kept for at least one year.

8. Cookies

We use only the cookies needed to keep you signed in and to protect the service. We do not use advertising or tracking cookies.

9. Children

FlowHRMS is not intended for anyone under 18. Customers must not add a person under 18 without verifiable consent of a parent or lawful guardian.

Your rights and how to use them

Under the Digital Personal Data Protection Act, 2023 you may:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct, complete or update it;
• ask us to erase it, where it is no longer needed and the law does not require us to keep it;
• withdraw your consent at any time — as easily as you gave it — from Account → Privacy & consent after signing in, or by writing to us;
• nominate another person to exercise these rights if you die or become unable to;
• raise a grievance with us. We respond within 90 days.

10. Changes

When this policy or a notice changes in a way that affects consent, we publish a new version and ask for consent again before it applies.

Questions, grievances and complaints

Contact our Grievance Officer, Flowacord: help@flowacord.com, +91 89088 88880. Signed-in users can also raise a request from Account → Privacy & consent.

If you are not satisfied with our response, you may complain to the Data Protection Board of India through the online process it provides. Current details are published by the Ministry of Electronics and Information Technology at https://www.meity.gov.in.