Automated Processing Notice — On-Device Activity Classifier

Version 1.0 - Effective 2026-05-28 - Last reviewed 2026-06-17 - Owner: Vezoft (a company registered in Bulgaria under company number (EIK) 202823109, with its registered office in Kardzhali, Bulgaria) ("Vezoft", "we", "us") - Status: Published

Issued by: Vezoft Applies to: the on-device two-layer activity classifier in the TimerOS desktop application Companion documents: Privacy Policy Section 3, AI Transparency Notice, Model Card, Subprocessors

One-paragraph summary for workers. TimerOS decides whether your current window is "productive" or "idle" entirely on your own device. Classification uses a built-in list of well-known work and non-work apps and websites, combined with a small on-device classifier that runs locally inside the desktop app — there is no cloud AI service, no model download, and no large language model involved. Your raw window titles and application names are never sent off your device for classification, and any corrections you make to teach the system are stored only on your machine. The system improves itself privately on your computer as you use it; nothing about what you read, write, or watch leaves the device through this feature. No decision with legal or significant effects on you is taken solely on the basis of these labels.

---

1. Purpose of this notice

This document is a standalone transparency notice about automated processing performed by the activity classifier in TimerOS Desktop. It is published to satisfy:

• Article 22 GDPR — the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you;
• Articles 13 and 14 GDPR — the right to information about automated decision-making and the logic involved;
• Article 5(1)(a) GDPR — the principle of transparency;
• Articles 13 and 50 of the EU AI Act — provider transparency obligations for AI systems that interact with natural persons;
• equivalent provisions of the UK GDPR, the CCPA/CPRA (California), and the comprehensive state privacy laws of Colorado, Connecticut, Utah, Virginia, Texas, and Oregon.

It is written in plain language for end-users (workers using TimerOS at work) and for the privacy, security, and works-council reviewers of B2B customers evaluating the product. A more technical companion is the Model Card; the broader feature-level write-up is the AI Transparency Notice.

---

2. What the classifier does, in one paragraph

While the timer is running, the TimerOS desktop app reads the title of your foreground window and the name of the application that owns that window, feeds those two strings into an on-device classifier, and produces a single label — typically productive or idle — together with a confidence score. The label is used to update the colour of the timer bar, to break your tracked time into "productive" and "idle" buckets in your timesheet, and to drive your live "is active now" status visible to your manager. The inputs are discarded from memory after each classification. The label and the aggregate hour totals are the only outputs that may leave your machine, and only to your employer's TimerOS workspace.

---

3. The two layers, in plain language

The classifier runs in two layers, both of which execute on your own computer inside the TimerOS desktop application. There is no separate inference server and no network call made by either layer.

3.1 Layer 1 — Scored rule engine

The first layer is a deterministic pattern matcher. It compares the app name and window title against built-in lists of well-known work apps and titles (IDEs, design tools, ticketing systems, repository hosts) and well-known non-work ones (video streaming, social media, gaming). Each signal is weighted, with higher weight given to exact app-name matches and lower weight to window-title matches (the latter being the main signal for browsers, where the application name says nothing about the open tab). The engine also takes into account overlap between the window title and the names of your assigned projects or current tasks, and meaningful words from your job title (with a stopword filter so generic words like "manager" or "senior" don't dominate).

The engine sums the weighted signals and returns a label, a confidence score, a source tag, and a short human-readable reason string. If no signal matches at all, the engine returns nothing confident and the second layer takes over.

3.2 Layer 2 — Small on-device statistical classifier

The second layer is a small on-device statistical classifier — productive vs idle — that runs as a fallback when the rule engine has no confident signal. It is not a large language model, not generative AI, and not a downloaded third-party model. The model file is only a few tens of kilobytes in size.

• Inputs. A small set of weights over tokens from the app name and the window title. All tokens are lowercased.
• Training. The model is trained on your device from a built-in seed dataset (compiled into the desktop application) plus any corrections you record.
• Local adaptation. Any correction you record through the desktop UI is appended to a bounded local-only list of your corrections, and the model is retrained on seed plus corrections, so it adapts to your workstation over time without ever sending those corrections anywhere.
• Output. A label, a source tag indicating the model layer produced it, and a confidence score so the timer bar always has something to display.

The trained model and your corrections are stored only locally on your computer.

We maintain a model card and an EU AI Act applicability assessment for the classifier, available to competent authorities on request.

---

4. What the classifier reads, and what it does not read

There is no large language model, no downloaded model, no GPU dependency, and no outbound network call from the classifier. The earlier exploratory design that contemplated a locally-running large language model has been removed; the current architecture is strictly stronger for privacy and auditability.

---

5. Where the processing happens and what leaves your device

The classifier code itself never opens a network socket. Other parts of the desktop app may separately transmit the result (a category label such as productive and its confidence) to your employer's TimerOS workspace, because the label is what your timesheet is made of — but the underlying window title and application name remain on your device.

---

6. Determinism and reproducibility

For a given installed version of TimerOS Desktop, both layers are deterministic. The same (app name, window title) input — with the same project/task context for the rule engine — always produces the same label, the same confidence, and the same reason string. This matters in three ways:

1. Auditability. If you or your employer ever question how a particular minute of your time was classified, the answer is reproducible. We can re-run the classifier against the same input and get the same output without depending on a remote service whose behaviour may have drifted.
2. No silent change. The model weights ship inside the installer. We cannot quietly update the classifier's behaviour from a server. New behaviour requires a new desktop release with its own version number and its own changelog entry.
3. Explainability. Every result carries a source tag and a short reason string, so even non-technical reviewers can see why a label was assigned.

---

7. Article 22 GDPR — no solely-automated decision with legal or significant effects

The classifier does not, by itself, produce any decision about you that has legal or similarly significant effects within the meaning of Article 22(1) GDPR.

• The classifier outputs a descriptive label about your current foreground window, not an evaluative judgement about you as a worker.
• Decisions about your employment, pay, working hours, discipline, promotion, performance rating, or continued engagement must, under the TimerOS Terms of Service and the Customer Data Processing Agreement, be taken by a human manager based on broader evidence — not on the classifier's output alone. This is a contractual restriction on every TimerOS customer.
• The classifier does not aggregate labels into a "productivity score" that is then used to rank, sort, or compare workers. Such a feature is not implemented.
• The classifier does not feed any external HR, payroll, or workforce-analytics system without your employer's deliberate configuration of an integration, and any such integration is documented in your employer's monitoring notice (see the internal monitoring-notice templates maintained by Vezoft for Customer reference).

If your employer were to use the classifier's output as the sole basis for a decision that produces legal or significant effects on you — for example, terminating your contract because a daily idle percentage crosses a threshold, with no human review — that would be a use outside the contractual scope of TimerOS and would also be a likely breach of Article 22 by your employer. You can complain to your employer's privacy contact, to TimerOS at privacy@timeros.ai, and to your local data protection authority.

---

8. Legal basis for the on-device processing

The processing performed by the classifier on your device falls into the broader workplace-monitoring lawful basis chosen by your employer (the controller) and disclosed in your local monitoring notice. The two bases relied upon in practice are:

• Article 6(1)(b) GDPR — performance of a contract to which the data subject is party (your employment or services contract), where time tracking is part of the agreed deliverable (typical for hourly contractors and remote workers); or
• Article 6(1)(f) GDPR — legitimate interests of the employer in accurate time tracking, project costing, and client billing, balanced against your rights and freedoms through the safeguards listed below.

TimerOS, as processor, does not select the lawful basis — the controller does, and discloses it in the monitoring notice it gives you. The safeguards that make the legitimate-interest balancing test defensible include: on-device processing, no content capture, no screenshot or keystroke logging, the rights listed in Section 10 below, the determinism property in Section 6, and the contractual prohibition on solely-automated decisions in Section 7.

No special categories of personal data (Article 9 GDPR) are intentionally processed by the classifier. If a window title incidentally reveals a special category — for example, the URL of a health-related article in a browser tab — the title is held in memory for one classification cycle and discarded; it is not written to disk, not sent off device, and not used to train any model except your own local corrections list if you choose to record a correction.

---

9. Retention

The locally-stored model and corrections never leave your device. Uninstalling TimerOS Desktop removes them.

---

10. Your rights, and how to exercise them

You have, at minimum, the following rights with respect to the classifier:

1. Right to be informed — this notice, the Privacy Policy, and your employer's monitoring notice.
2. Right to human intervention (Article 22(3) GDPR). You may ask, at any time, that any assessment about you that referenced the classifier's output be reviewed by a human — typically your manager or your employer's HR contact. TimerOS will assist if asked.
3. Right to express your point of view and contest the result (Article 22(3) GDPR). If you disagree with a label, you can record a correction directly in the desktop app. The correction takes precedence in any aggregation, is stored only on your device, and is used to retrain your local model.
4. Right to opt out of the AI layer. In Settings → Activity Detection → Tracking mode, you can switch from Automatic to Rule-based — the on-device AI/ML layer is turned off and only the deterministic rule engine classifies your activity — or to Manual, where there is no automatic classification at all and you set your own state. The timer bar continues to function in every mode.
5. Right to stop monitoring temporarily. Stop the timer. While stopped, the classifier is not running, no window titles are read, and no labels are produced.
6. Right to rectification (Article 16 GDPR) of any labels that have already been sent to your employer's workspace. Contact your employer; TimerOS will support the request.
7. Right to erasure (Article 17 GDPR) of stored labels, subject to your employer's statutory retention obligations.
8. Right to lodge a complaint with your local data protection authority. A list is at edpb.europa.eu/about-edpb/about-edpb/members_en. You do not need to contact us or your employer first.

To exercise these rights with respect to TimerOS as a service provider: privacy@timeros.ai. With respect to your employer (the controller of your workplace data): contact the privacy or HR contact named in your local monitoring notice.

---

11. How to correct a classification

If the classifier labels something incorrectly — for example, a code-editor window labelled "idle" because you were reading on screen and not typing, or a video tutorial labelled "idle" when you were watching it as part of your work — you can correct it:

1. Open the dashboard window and go to Settings → Activity Detection.
2. Under Current Activity, review the current app/window and its label.
3. Click Mark Productive or Mark Idle to correct it.

The correction is stored only locally on your computer. The next time the on-device classifier retrains in the background, it incorporates your correction so the same app and title will be classified correctly in future. Corrections train the on-device AI model, so they apply in Automatic mode; they never leave your device, and are erased when you uninstall TimerOS Desktop.

---

12. How to turn off the AI layer

The on-device AI/ML layer is optional. You can turn it off without disabling the rest of TimerOS:

1. Open the dashboard window.
2. Go to Settings → Activity Detection → Tracking mode.
3. Choose Rule-based (deterministic rules only, AI off) — or Manual (no automatic classification; you set your own Productive/Break state).

In Rule-based mode:

• The classifier uses only the deterministic scored rule engine.
• When the rule engine has no confident match, the activity is left unclassified rather than guessed — it is not recorded as productive.
• Your on-device model and corrections remain stored locally (they simply aren't used) and are removed when you uninstall TimerOS Desktop. You can switch back to Automatic at any time.

---

13. Storage sub-processor for the resulting label

The label produced by the classifier, once transmitted as part of your timesheet, is stored in the MongoDB Atlas database operated for your employer's tenant. The relevant facts for transparency:

• Sub-processor legal entity: MongoDB, Inc., 1633 Broadway, 38th Floor, New York, NY 10019, USA; EEA contracting via MongoDB Ltd (Ireland).
• Data Processing Agreement: the MongoDB DPA is auto-incorporated into the Cloud Terms of Service, with the EU 2021 Standard Contractual Clauses (Module 2 controller-to-processor and Module 3 processor-to-processor), the UK IDTA addendum, Swiss FADP modifications, and EU-US Data Privacy Framework certification.
• Region pinning. For EU customers, the Atlas cluster is a dedicated tier (M10+) pinned to an EU region — aws-eu-central-1 (Frankfurt) or aws-eu-west-1 (Ireland) — with AES-256 encryption at rest, so data at rest does not leave the EU. Atlas does not auto-route based on caller geography; the region is selected in the tenant-provisioning code path.
• Operational access. MongoDB operates "follow-the-sun" support through the affiliate entities set out in MongoDB's published affiliate list. The SCCs cover those transfers.
• Downstream chain. Our EU Atlas clusters run on top of AWS in the EU (Frankfurt / Ireland). The current full sub-processor list is maintained at timeros.ai/legal/subprocessors and changes are notified via the DPA's change-notice mechanism with a 30-day objection window.

A dated PDF snapshot of the current MongoDB DPA is archived in legal/vendors/ for the Article 30 records of processing.

---

14. Where this notice is surfaced

This notice is linked from:

• the Privacy Policy (Section 3, "About the AI activity classifier");
• the desktop app's Settings → Activity Detection panel (a "Learn more" link opens the published version of this document);
• the desktop app's first-run onboarding screen (a "How is my activity classified?" link);
• the AI Transparency Notice for B2B customers;
• the Model Card for technical reviewers.

---

15. Changes to this notice

Material changes to the classifier — adding a new input signal, changing what the classifier reads, changing where it runs, adding a new layer, changing the lawful basis — are notified to Customers via the DPA's change-notice mechanism with at least 30 days' advance notice, and to end-users via the desktop app's onboarding screen on first run after the change. Non-material changes (clarifications, formatting, typo fixes) are published with an updated version line at the top.

---

16. Contact

• Privacy and data-subject requests: privacy@timeros.ai
• Security incidents: security@timeros.ai
• General support: support@timeros.ai
• Postal: Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address)
• EU Representative: Not required — Vezoft is established in Bulgaria (EU Member State).
• Data Protection Officer: Not appointed — Vezoft is below the thresholds in GDPR Art. 37(1)(b) and (c).