Privacy Policy

FlowHRMS is provided by Flowacord (“we”, “us”). It is an attendance, leave, task and payroll-input system that businesses use for their staff.

We have two roles, under the Digital Personal Data Protection Act, 2023:

• For your own account — when you register a company or hold a FlowHRMS account in your own right, Flowacord is the Data Fiduciary: we decide how your account details are used.
• For employees’ work records — the company that employs you is the Data Fiduciary. Flowacord is its Data Processor and handles those records only on the company’s instructions.

Contact: help@flowacord.com, +91 89088 88880. More in section 19.

• The FlowHRMS website and web app at hrms.flowacord.com.
• The FlowHRMS Android app (com.flowhrms.app), published on Google Play by Flowacord.
• Emails and support we provide about FlowHRMS.

It does not cover how your employer uses FlowHRMS records in its own HR processes; ask your employer about that.

What is recorded depends on the features your company switches on.

What we do not collect: biometric data, contacts, call logs, SMS, browsing history, or advertising identifiers. FlowHRMS has no fields for Aadhaar, PAN or bank account numbers (see section 7 for documents that may contain them).

• You — what you type, and the photos and files you choose to upload.
• Your employer — admins and HR add employees and their employment and pay details.
• Your device — location when you check in or out, and the camera when you take a photo, only with your permission.
• Automatically — IP address and browser or device details when you consent, sign up or verify an address.

We use personal data to provide, secure and support FlowHRMS and to meet legal obligations. We rely on the consent you give through our notices, and on the legitimate uses the Digital Personal Data Protection Act, 2023 permits — including employment purposes where your employer relies on them. Optional uses, such as product updates, are asked for separately and can be refused.

Named Flowacord staff may open a customer company’s account to support it and to maintain and improve FlowHRMS. Each access is recorded, and any change is shown to the company as “Flowacord support”.

• A company owner can register a company on the website or in the Android app. Employees are added or invited by their company’s admin.
• You sign in with your email address and password. Sign-in is handled by our database and sign-in provider; FlowHRMS never stores your password.
• On your phone, the app keeps your sign-in session, your basic profile and (if you ask it to) your email address in the device’s encrypted secure storage. Signing out removes them.

FlowHRMS records salary structures, payroll lines, adjustments and payslips that your employer prepares. You can see your own payslips; within your company, only people whose role includes payroll access can see others’ pay.

FlowHRMS does not have fields for bank account numbers and does not make payments to employees. If your employer asks you to upload a document such as a cancelled cheque or a bank statement, that document is stored like any other upload (section 10).

Company owners who buy a plan pay through Razorpay. Card and bank details are entered with Razorpay; FlowHRMS receives only the payment reference and outcome.

Your company may set a workplace area. A check-in outside it, or too close to its edge to be sure, is flagged for your manager to review. A check-in with a location the phone reports as simulated is refused.

• The Android app asks for location while you are using it. It asks for location all the time only if your company has switched route tracking on for you, after showing you what is recorded and asking you to agree.
• When you open the Attendance screen, the app reads your location to show it before you check in. It is sent to FlowHRMS only when you tap Check in or Check out.
• When you check in or out with your location, FlowHRMS saves the latitude, longitude and accuracy at that moment, and the distance from your workplace. It does not track you between check-in and check-out unless route tracking applies to you (below).
• An admin who checks someone in or out from their own phone sends the admin’s location with that entry. An admin setting up a workplace can use their current location to fill in its coordinates.
• Where a company uses field visits, location is also saved at each visit tap — and you can refuse it; visits are then recorded without location.
• Route tracking. Where your company switches it on for you and you agree, the app records your location every few seconds from check-in to check-out (about once a minute while you are still) — even when the app is closed — with your battery level and whether a fake-location app was used. If you also allow “Physical activity”, it records the steps your phone counts, which way it faces, and whether you are still, walking, cycling or in a vehicle, to follow your route where GPS can’t reach; refusing it changes nothing else. Android shows a notification the whole time. It never records before check-in or after check-out, and stops the moment you check out. You see your own route exactly as your manager does. Your route is seen only by you, your reporting manager, the head of your department, your company’s owner and admins, and anyone else your company allows to see everyone’s field visits; it is never sold, shared for advertising or used for ads. Route points are deleted after 60 days; the day’s summary stays with your attendance. You can stop sharing your route at any time in the app (My route, or Privacy & consent) without affecting check-in. If you refuse, you still check in as usual and your manager sees that your route isn’t shared. You can change your choice any time in Account → Privacy & consent.

You can turn location off in your phone’s settings at any time. The app’s Attendance screen needs location to check you in or out, so while it is off, ask your admin or manager to record your attendance.

• The app uses the camera only when you choose to take a photo — for example, proof that a task is done.
• Photos and files are chosen with Android’s own picker; the app does not read your gallery.
• Uploads — profile photos, task proof, documents and receipts — are kept in private storage. They open through links that expire after a short time. Opening a document or proof file on the website is recorded in the activity log.
• Within your company, documents are visible to you and to people whose role includes document access.

Tasks, comments, proof of work, leave requests and approvals are visible to the people involved and to those with the right role in your company. Please do not put more personal detail — for example about your health — in a leave reason than your employer needs.

Within your company

Your company’s admins, HR and managers see records according to the roles your company sets. Each company’s data is kept separate from every other company’s.

Service providers

These providers process data for us, under their terms. Most act only on our instructions. Expo and Google Maps Platform may also use what they receive for their own purposes, such as running and improving their services, under their own privacy policies; we pass them only what they need (a phone’s notification token and the notification’s text; the start and end points of a field-visit leg).

Legal disclosures

We disclose data to authorities only where the law requires it.

We do not sell personal data or share it for advertising.

• Connections to FlowHRMS are encrypted in transit: the website accepts only HTTPS, and plain HTTP is redirected to it.
• Each company’s data is kept separate, and staff access follows least privilege.
• Passwords are handled by our sign-in provider and never stored by FlowHRMS. Invitation links and verification codes are stored only in a scrambled (hashed) form.
• Uploaded files are private and open through short-lived links.
• Security-relevant actions, document views and support access are logged.
• Backups are encrypted before they are stored.

No system is completely secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

• Your own account is kept while it is open. When we close it at your request, nobody can sign in to it again, it is unlinked from every company at once, and your phones get no more notifications. What remains is kept for up to three months and erased or anonymised within 90 days of closing, except what the law requires us or your employer to keep.
• A company account that is closed can export its data for 30 days; after that we delete it, except what the law requires us to keep, such as tax invoices.
• Employees’ work records are kept by your employer for as long as it needs them and as the law requires (for example wage and attendance records). Ask your employer about its retention.
• Proof of consent and of requests you make is kept for as long as we may need to show it. Security logs are kept for at least one year.
• Backups are encrypted. Data deleted from FlowHRMS can remain in a backup taken before the deletion until that backup is deleted; we do not restore it into use.

To ask for your account and data to be deleted, see Account Deletion. Our team closes the account and confirms it to you by email; the rest is then erased automatically within 90 days.

Under the Digital Personal Data Protection Act, 2023 you may:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct, complete or update it;
• ask us to erase it, where it is no longer needed and the law does not require us to keep it;
• withdraw your consent at any time, as easily as you gave it;
• nominate another person to exercise these rights if you die or become unable to;
• raise a grievance with us.

Signed in on the website, go to Account → Privacy & consent to make a request or withdraw consent, or write to us. We respond within 90 days. For work records, ask your employer’s admin or HR first; we will pass your request to them.

You can also turn off location or camera access in your phone’s settings at any time.

FlowHRMS is not intended for anyone under 18. Companies must not add a person under 18 without verifiable consent of a parent or lawful guardian.

The FlowHRMS database, sign-in and website file storage run in Supabase’s Mumbai (India) region. Some of our other service providers may process data outside India, where the law permits.

When our practices change we update this page. If a change affects what you consented to, we publish a new version of the notice and ask for your consent again before it applies.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India through the online process it provides; current details are published by the Ministry of Electronics and Information Technology at meity.gov.in (opens in a new tab).