Welcome to GateFlow VMS ("we," "our," or "the Platform"). This Privacy Policy explains how GateFlow VMS collects, uses, processes, stores, and protects personal information gathered through our Visitor Management System mobile applications (iOS and Android), receptionist interfaces, and enterprise management tools.
1. Information We Collect
When an individual checks into a facility or uses the GateFlow VMS application, we may collect the following categories of data:
A. Live Camera Photographs
During Step 1 of the visitor registration process, the application utilizes the device's front-facing camera to capture a mandatory live photograph of the visitor. This photo is used exclusively for:
- Real-time visual identity verification by the host employee prior to granting entrance approval.
- Issuance of temporary digital visitor passes.
- Historical security audit logs for on-premise security monitoring.
B. Visitor Contact & Identity Details
- Personal Details: Full Name, Mobile Phone Number, and Email Address.
- Affiliation: Company, vendor, or organization name represented by the visitor.
- Visit Details: Purpose of visit (e.g., Business Meeting, Interview, Vendor / Delivery, Facility Maintenance).
- Host Designation: Name and department of the host employee being visited.
C. Access Timestamps & Logbook Data
- Exact check-in date and timestamp.
- Host approval/rejection timestamp and notes.
- Check-out date and timestamp recorded upon visitor departure.
D. Employee & Administrative Information
For host employees and receptionist personnel: Corporate email address, employee ID, role-based access credentials, device token identifiers for Firebase Cloud Messaging (FCM) push notifications, and configuration domain details.
2. How We Use Collected Information
The information gathered through GateFlow VMS is processed strictly for legitimate workplace security and administrative purposes, including:
- Facilitating seamless check-in and checkout workflows at enterprise facilities.
- Dispatching instantaneous real-time mobile push notifications to host employees regarding visitor arrivals.
- Enabling host employees to approve or deny entry requests from their mobile application.
- Generating digital entry passes and automated visitor records.
- Maintaining an accurate, real-time building headcount for emergency evacuations and disaster management drills.
- Fulfilling legal, statutory, and regulatory workplace compliance audits.
3. Device Permissions Required
To deliver core functionality, GateFlow VMS requests the following system permissions:
- Camera Permission: Required solely to capture the visitor's live photo at check-in. The camera is only active during the photo capture step and is never operated in the background.
- Push Notifications (FCM): Required for host employees and reception staff to receive immediate entry alerts and approval status updates.
- Network / Internet: Required to communicate securely with multi-tenant enterprise backend servers and synchronize audit logs.
4. Data Storage, Security & Multi-Tenancy
GateFlow VMS implements multi-tenant architecture to ensure that every organization's visitor logs, employee directories, and photos remain strictly isolated. We protect data through robust technical safeguards:
- All data transmitted between devices and our cloud servers is encrypted using industry-standard TLS (Transport Layer Security).
- Stored visitor images and records are encrypted at rest with AES-256 encryption.
- Access to administrative logs is restricted via role-based access control (RBAC) and authenticated sessions.
5. Data Retention & Erasure
Visitor logs and captured photographs are retained based on the data retention policy configured by the subscriber enterprise (typically between 30 to 180 days, or as mandated by applicable security and industry regulations). Once the retention period lapses, visitor records and photo files are securely deleted or anonymized.
6. Third-Party Sharing
We do not sell, rent, or monetize personal information. Data is only shared with:
- Cloud Infrastructure & Push Notification Providers: Secure enterprise hosting partners and Google Firebase Cloud Messaging (FCM) strictly to deliver application notifications.
- Law Enforcement & Regulatory Authorities: Only when compelled by valid legal process, court orders, or applicable law for public safety investigation.
7. Visitor Rights
Depending on your jurisdiction, you may hold rights to:
- Request access to historical visitor records associated with your phone number or email.
- Request rectification of inaccurate personal records.
- Request erasure of your visitor information, subject to statutory physical security and workplace retention laws.
8. Contact Us Regarding Privacy
If you have questions, concerns, or requests regarding this Privacy Policy or how your visitor data is processed in GateFlow VMS, please contact our dedicated Privacy & Security Office: