Privacy Policy

Depending on the features your organization uses, FolksFlow may hold:

• Profile and employment details: name, work email, phone and WhatsApp number, employee code, designation, department, manager, location, employment type, joining and exit dates, and photo.
• Sign-in and security data: your Microsoft account identifier, a securely hashed password if you use one, sign-in times, failed sign-in attempts and password reset requests.
• Work records: timesheets, attendance check-in and check-out times, leave requests and balances, holidays, projects, tasks, comments and file attachments.
• Pay and finance: salary or rates, allowances, deductions and payslips, bank account and tax identifiers (stored encrypted), and project revenue and expenses.
• Communications: chat messages, reminders and notifications, and, if you connect Microsoft 365, the Outlook mail and calendar items FolksFlow shows you.
• Activity records: an audit log of important actions (who changed what, and when) and derived figures such as utilization and performance summaries.

• to let you sign in and keep your account secure;
• to run the HR, project, timesheet, leave, attendance and payroll processes your organization has set up;
• to send notifications and reminders in the app, by email, in Microsoft Teams or on WhatsApp, as your organization and you choose;
• to produce reports on capacity, utilization and profitability for the people in your organization allowed to see them;
• to keep an audit trail, investigate problems and protect the service against misuse.

FolksFlow does not sell personal information and does not use it for advertising. Your organization may use it for its own employment purposes under its own policies.

Each Customer's FolksFlow runs in that Customer's own cloud environment, and its data is stored there, not in a system shared with other Customers. Inside your organization, what each person can see is controlled by roles and permissions. For example, pay details are visible only to people with payroll or finance access.

Wonderfolks does not have routine access to a Customer's deployment. We only access it when the Customer asks us to, for example for support, and only as needed for that purpose.

To check that a deployment is licensed, it contacts the Wonderfolks licensing service, which receives the license key, a deployment identifier, the number of active users, the app version and the IP address the check comes from. No employee records are sent.

We also hold the business contact details of each Customer's administrators, and billing records, to manage licenses and invoices.

Information is shared with these providers only when your organization turns on the related feature:

• Microsoft (Entra ID, Outlook, Teams): for Microsoft sign-in, importing and syncing the employee directory, email, calendar and Teams notifications. Microsoft's handling is covered by the Microsoft Privacy Statement.
• Meta (WhatsApp Business Platform): for WhatsApp notifications, which carry your first name and the notification text, and only if you add your number and opt in.
• Your organization's cloud and email providers, which host the deployment and deliver its email.

Information may also be disclosed where the law requires it, or to protect the rights, safety and security of people and of the service.

FolksFlow uses only the cookies it needs to work: a secure session cookie that keeps you signed in (it expires after 8 hours) and a short-lived cookie used during Microsoft sign-in. There are no advertising or third-party tracking cookies.

Connections are encrypted in transit. Passwords are hashed, and sensitive values such as bank and tax details and integration tokens are encrypted at rest. Accounts lock after repeated failed sign-ins, and important changes are written to an audit log. No system is perfectly secure, so please tell your administrator at once if you notice anything suspicious.

Your organization decides how long information is kept, taking into account its legal obligations such as employment, payroll and tax record keeping. When a Customer stops using FolksFlow, it controls the deletion of its deployment and data. Wonderfolks keeps licensing and billing records for as long as needed for accounting and legal purposes.

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may ask to access, correct or update your personal information, ask for it to be erased where it is no longer needed, withdraw consent you have given, and raise a grievance about how it is handled.

• You can update some details yourself under My profile, and turn WhatsApp notifications on or off there.
• For anything else, contact your organization's HR team or FolksFlow administrator, who manage your information and can act on your request.
• If your request concerns information Wonderfolks holds directly, such as licensing records, your organization can pass it to us through the contact details in its agreement with us.

FolksFlow is a workplace tool and is not intended for anyone under 18.

We may update this policy from time to time. When we do, we will change the date at the top of this page, and for significant changes we will let Customers know in advance.