Privacy Policy

Account & Identity Information

When you register as a resident, admin, or guard, we collect your name, mobile number, email address, and flat/building details. Society admins may also provide the society's registered address.

Biometric Data (Face Vectors)

To enable face recognition at gates, we collect and store facial embeddings — mathematical representations derived from your face photo. These are not photographs; they are numerical vectors that cannot be reverse-engineered into your image. Face enrolment is voluntary; you can use OTP-based entry instead.

Visitor & Entry Logs

The platform records the name, photo ID, purpose, and entry/exit timestamps of every visitor. This data is owned by the society and is accessible to society admins and residents of the relevant flat.

Device & Usage Data

We collect basic device identifiers (for push notifications), app version, and anonymised usage analytics to improve the product. We do not sell this data.

We use the information we collect to: • Authenticate users and control access to the platform • Power face recognition and OTP verification at gates • Send push notifications for visitor arrivals, emergency alerts, and notices • Generate maintenance bills and ledger entries • Provide customer support • Comply with legal obligations We do not use your data for advertising and we do not sell personal data to third parties.

Storage

Resident and operational data is stored in our PostgreSQL database hosted on secured servers. Face embeddings are stored in a separate, access-controlled vector database. Uploaded photos (visitor IDs, staff faces) are stored on encrypted object storage.

Security Measures

All data in transit is encrypted with TLS 1.2+. Passwords are hashed using bcrypt. API access requires JWT authentication. Role-based access control ensures users can only access data relevant to their flat, building, or society.

Retention

Visitor logs are retained for 12 months by default. Face embeddings are deleted immediately upon resident off-boarding or on request. Account data is deleted within 30 days of account termination.

We share data only in the following circumstances: • Within the society: Resident entry data is visible to the society admin, building admin, and the resident of the relevant flat. Guard logs are visible to admins. • Service providers: We use trusted sub-processors (hosting providers, notification services) who are bound by data processing agreements. • Legal requirements: We may disclose data if required by law, court order, or to protect the safety of our users. We never sell, rent, or trade personal data to marketers or advertisers.

Depending on your jurisdiction, you may have the right to: • Access the personal data we hold about you • Correct inaccurate data • Request deletion of your data (right to erasure) • Withdraw consent for face enrolment at any time • Port your data to another service To exercise these rights, contact us at contact@sparrowsecurity.online. We will respond within 30 days.

The Sparrow Security marketing website (sparrowsecurity.online) uses only essential session cookies required for basic functionality. We do not use tracking or advertising cookies. The resident mobile app does not use cookies.

Sparrow Security is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided personal data, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify registered admins of material changes via email or in-app notification at least 14 days before the change takes effect. The 'Last Updated' date at the top of this page will always reflect the current version.

If you have questions or concerns about this Privacy Policy or the data we hold, please contact us at: Email: contact@sparrowsecurity.online Sparrow Security, India