Privacy Policy

Spark Management ("Spark", "We", "Our", or "Us"), operated by Flirty Spark Global, is committed to safeguarding customer data, personal employee records, and biometric vectors. This Privacy Policy details how we collect, process, store, and protect your information when you access our cloud workforce operating system, mobile applications, or facial recognition verification terminals.

Spark's 3D Face ID module is built on strict zero-raw-image retention principles: - Zero Image Storage: We never record, upload, or store raw photographs or video streams of facial scans on cloud servers. - Local Hashing: When an employee performs a verification, local device sensors extract a 128-dimensional mathematical vector (numerical embedding). - One-Way Encryption: Biometric vectors are encrypted using non-reversible one-way hashes before being compared against tenant records. - Anti-Spoofing Liveness: Liveness detection operates strictly in volatile device memory during the 0.4s scan window and is immediately discarded upon completion.

To provide automated payroll, attendance tracking, and workforce analytics, Spark processes: - Account & Organization Data: Admin contact name, business email, GSTIN/Tax ID, organization address, billing phone number. - Employee & Staff Directory: Employee full names, staff IDs, job titles, department assignments, salary structures, bank account payout details, EPF/ESIC numbers. - Operational & Log Data: Clock-in/out timestamps, GPS geo-fence coordinates (if enabled by administrator), IP addresses, device identifiers, and audit logs.

We process tenant data strictly for explicit operational purposes: 1. Calculating accurate monthly staff attendance, overtime, late punch penalties, and automated payroll payouts. 2. Generating real-time executive dashboards, shift schedules, and client billing ledgers. 3. Enforcing enterprise security controls, preventing proxy check-ins, and maintaining immutable audit trails. 4. Sending automated WhatsApp / Email payslips, shift notifications, and system status alerts.

Spark enforces strict logical data isolation across all database environments: - Row-Level Security (RLS): Customer records are partitioned by unique Tenant IDs. No tenant can access or view another organization's records under any circumstances. - Encryption Standards: All data in transit is encrypted via TLS 1.3. Data at rest is encrypted using AES-256 standard encryption key architecture. - Cloud Infrastructure: Data is hosted in SOC 2 Type II certified datacenters (AWS / Google Cloud Asia-South Region, Mumbai, India) with redundancy and hourly backups.

Spark complies with the Digital Personal Data Protection Act (DPDP Act 2023, India) and EU GDPR standards: - Right to Access & Correction: Organization admins and employees can inspect and correct personal profile information at any time. - Right to Erasure (Data Purge): Upon subscription cancellation or explicit tenant request, all associated customer data, employee records, and vector hashes are permanently purged within 30 calendar days. - Data Processing Addendum (DPA): Enterprise clients can request a signed DPA covering regional data localization requirements.