Privacy Policy
Last updated September 29, 2026
This policy describes how Aptiway Technologies Private Limited (“Aptiway”, “we”) collects, uses, and protects information through FlowDesk — the workforce management platform offered as a web application and as the Aptiway FlowDesk mobile app for iOS and Android.
1. Information we collect
We collect only what the product needs to do its job:
| Category | What it includes | Why |
|---|---|---|
| Account information | Name, work email address, role, reporting manager, joining date | Sign-in and identifying your records |
| Employment & payroll identifiers | Employee code, designation, department, work location, gender and date of birth where your organization records them; and, where your organization uses FlowDesk for payroll: PAN, UAN, PF and ESIC numbers, bank account number, IFSC and bank name, and the last four digits of your Aadhaar number only — the full number is never stored | Producing payslips and statutory filings your employer is required to make |
| Attendance & location | Check-in and check-out timestamps, break start and end times, and your device's location at the moment you press any of those four buttons — including the accuracy of that reading, a place name resolved from it, and whether your device reported the location as simulated | Recording attendance against a place of work, and being able to tell a real reading from a simulated one |
| Leave records | Leave balances, requests, approval history, and prior notice you give a manager about arriving late or leaving early | Managing time off |
| Payslips | Payslip documents associated with your account | Letting you view and download your own payslip |
| Issue content | Issues and comments you or your team write inside FlowDesk | Team communication and tracking work |
| Device & connection | A push token issued by Apple (APNs) or Google (FCM), your device model, operating system version, app version, browser user agent, and the IP address your session connects from | Delivering notifications, and letting you and an administrator see which devices are signed in |
2. Location, specifically
The FlowDesk mobile app requests location access only to attach a location to an action you initiate: check-in, check-out, starting a break, and ending a break. It does not request background location access — the app declares no background location permission at all — and it does not track your location at any other time or while it is closed.
Alongside the coordinates we record how accurate the reading was and whether your device reported it as a mock or simulated location. That flag is recorded so an attendance record can be trusted; it is not a judgement about you, and it is visible to your organization's administrators in the same way the rest of your attendance record is.
Declining the location permission does not block you from checking in — the check-in still records, without a location attached.
3. How we use information
Information collected through FlowDesk is used only to:
- Operate the attendance, leave, payroll, payslip, and issue-tracking features described above
- Authenticate you and keep your session secure
- Send you notifications you would reasonably expect (leave decisions, reminders, issue updates)
- Maintain and troubleshoot the service
We do not sell personal information, and we do not use it for advertising, cross-app tracking, or profiling unrelated to the workforce-management purpose above.
4. Who we share it with
Your records stay within your organization's own FlowDesk workspace and the infrastructure that runs it. Within that workspace, what a colleague can see depends on their role: your manager and your organization's HR and administrator roles can see the records their job requires.
We use Firebase Cloud Messaging (Google) to deliver push notifications. To route a notification, Google receives the push token for your device and the text of the notification itself — which is typically a short line such as who acted and what happened. Your attendance history, leave records, payroll identifiers and payslips are never sent to Firebase. If you would rather Google did not receive notification text, turn notifications off for FlowDesk in your phone's settings; the rest of the app continues to work.
5. Where it is held
FlowDesk runs on managed hosting, and your organization's data is held in its own database there. Payslip files are stored outside the public web area and are served only to the person they belong to, or to someone whose role permits it, after that request has been authenticated.
6. Data retention and deletion
Your organization's FlowDesk administrator controls how long records are kept, consistent with their own employment and record-keeping obligations. Some records — payroll and statutory filings in particular — an employer is legally required to retain for a period after employment ends, and those cannot be deleted on request before that period expires.
To request deletion or a copy of your personal data, email support@aptiway.com from your work address, or use the form on our Support page. We acknowledge requests within five working days and act on them within thirty, except where a record must be retained for the reason above — in which case we will tell you which records and why.
Signing out of the app deletes the session tokens held on that device. Uninstalling the app removes everything FlowDesk has stored on the phone. Neither deletes your records on the server, which is what the request above is for.
7. Security
Sign-in tokens are stored in the device's Keychain (iOS) or Keystore (Android) — never in plain, unencrypted storage — and every request between the app and our servers is encrypted in transit. A payslip is requested with your access token in a request header, never in a URL, and is removed from the device as soon as you have viewed or saved it.
8. Children's privacy
FlowDesk is a workplace tool intended for use by employees of an organization and is not directed at children. We do not knowingly collect information from children.
9. Changes to this policy
If this policy changes, we will update the date at the top of this page. Continued use of FlowDesk after a change means you accept the updated policy.
10. Contact us
Questions about this policy or your data can be sent to support@aptiway.com.