Privacy Policy

Spyra One · Last updated 2 November 2026

Spyra One is a workforce and operations application operated by Spyra Labs ("we", "us", "our") at app.spyra.one and in the Spyra One mobile apps for Android and iOS. This policy explains what personal information Spyra One handles, why, and what choices you have.

Spyra One is supplied to organisations, not to the general public. Your employer or the organisation that invited you decides who is given an account and what each role can see. Where that organisation determines how the system is used, it is the data controller and we act as its processor.

Information we handle

Account and profile

Your name, work email address, phone number, profile photo, job role and the companies you belong to. Accounts are created by your organisation; there is no public sign-up.

Attendance

When you punch in or out we record the time, your device's location at that moment, and a photo taken by the app for identity confirmation. Location is captured only at the moment of a punch — Spyra One does not track your position in the background or between punches. Your organisation may define geofences so that punches outside an office are flagged for review.

Human resources and payroll

Employment records, working patterns, leave, salary structure, payroll runs, payslips, advances, statutory identifiers required by law, and bank account details used to pay you. Bank details are encrypted before they are stored.

Work records

Tasks assigned to or by you, due dates, comments, the files and photographs uploaded as proof of completion, verification decisions, payment requests and their approvals, and the resulting performance scores.

Calendar and meetings

Meetings, attendees, availability, booking requests, and — only if you choose to connect it — data from your Google Calendar, described in detail below.

Technical information

Device identifiers used to recognise the device you punch from, push notification tokens, and diagnostic information about errors and crashes so faults can be fixed.

How we use it

To operate the service: attendance, leave, payroll, tasks, approvals and calendars.
To show the right information to the right people, according to your role.
To notify you about work that concerns you, by push notification, email or WhatsApp.
To keep an auditable record of approvals, verifications and payments.
To diagnose faults, secure the service and prevent misuse.
To meet legal, tax and employment obligations.

We do not sell personal information. We do not use it for advertising, and we do not use it to build profiles unrelated to your work.

Google user data

Spyra One offers optional Google features. Neither is required to use the product.

Google Sign-In

If you sign in with Google, we receive your name, email address and profile picture, and use them only to identify you and match you to the account your organisation created.

Google Calendar

If you connect Google Calendar, Spyra One:

reads your events and free/busy times, so meetings and booking pages can avoid clashes;
writes meetings and events created in Spyra One into your Google calendar, and updates them when they change;
shows your Google events inside the Spyra One calendar as read-only entries.

The connection is made only with your explicit consent on Google's own consent screen, is limited to the account you choose, and can be disconnected at any time from your settings in Spyra One. Disconnecting stops all further access. Access tokens are encrypted before storage.

Limited Use. Spyra One's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not allow humans to read it except where you have given explicit permission, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

Who we share it with

Within your organisation, information is visible according to role — for example your HR team can see attendance and payroll, and an approver can see the requests routed to them. Beyond that, we share data only with the service providers that make Spyra One work:

Provider	Purpose
Supabase	Database, file storage and authentication (hosted in India)
Google	Sign-In and Calendar, where you connect them
Firebase Cloud Messaging · Apple Push Notification service	Push notifications to your device
WhatsApp	Work notifications sent to your number
Email provider	Transactional email such as invitations and reminders
Sentry	Crash and error diagnostics

We may also disclose information where the law requires it, or to protect our rights, safety or property.

Keeping it secure

Access is authenticated and scoped by role, and enforced at the database with row-level security so people only reach records they are entitled to. Traffic is encrypted in transit. Bank details and Google tokens are encrypted before they are stored. No system is perfectly secure, but we take these measures seriously and review them as the product changes.

How long we keep it

Operational records — attendance, payroll, approvals and work history — are retained for as long as your organisation needs them and for any period required by employment and tax law. When your organisation ends its use of Spyra One, we delete or return its data on request, subject to those legal retention periods.

Your choices

You can disconnect Google Calendar at any time from your settings.
You can decline camera or location permission on your device, though attendance punching needs them.
You can ask to access, correct or delete your personal information. Because your organisation controls most of this data, we will usually direct such requests to them and assist them in answering you.

Children

Spyra One is a workplace tool and is not directed at children.

Changes

If this policy changes materially we will update the date above and, where appropriate, notify organisations using the service.

Contact

Questions about this policy or your data: nithin@spyra.in.