Privacy Policy

What changed in version 1.12 (effective 2026-11-02). One change, to Section 4B. From the day we switch each connection on, a person who may connect the workspace's marketing channels can connect, with "Sign in with Google", a Website or Email channel to Google Analytics and an Ads channel to Google Ads (and a search channel to Search Console, as before) and, with "Connect Mailchimp", an Email channel to Mailchimp. TimerOS shows the list to choose from only to the person who connected, keeps the property, ad account or audience chosen and an encrypted token, and reads monthly totals only: visits, page views and key events from Google Analytics; impressions, clicks, conversions and spend from Google Ads; subscribers, campaigns sent, unique opens and clicks from Mailchimp. Google asks for full access to Google Ads, and Mailchimp's access covers the whole account, but TimerOS only reads. Only people who may see operating expenses see the spend, and no AI employee does; the AI employees that work on marketing read the other numbers, which then go, as prompt content, to the AI model provider that runs them. Disconnecting deletes the token. Because TimerOS can now receive data from Google Analytics, Google Ads and Mailchimp, this is a material change. Section 4B gives the details, including how to withdraw access at Google and at Mailchimp.

What changed in version 1.11 (effective 2026-10-29). One change, to Section 4A, about the AI assistant you may connect to your own TimerOS account, and it widens the assistant's reach: what it can read and what it can approve in your name. From the day we switch it on, when an AI employee asks you to approve a social media post that carries a picture, your connected assistant can receive that picture — scaled down to at most 1,568 pixels on its longer side and without the information stored inside the file, together with its file name and whether the file is marked as made by AI — so that it can show it to you and, when you tell it to, approve the post with that picture or without it; until now it could only reject such a post. It approves a post with its picture only by quoting the picture's fingerprint, which TimerOS gives it only together with the picture, and TimerOS refuses an approval of a picture the post no longer holds. A connection you approved before that day gets this access only once you connect the assistant again and approve a consent page that names the pictures. As before, the data goes to the provider you chose, on your instruction, and a workspace owner or administrator can turn assistant connections off for the whole workspace. The list in version 1.10 of what the connector reads included no pictures; because a picture an AI employee attached to a post can now reach the provider you chose, this is a material change. Section 4A gives the details.

What changed in version 1.10 (effective 2026-10-28). One change: a new Section 4B, about connecting Google Search Console to a search channel in the Marketing section of TimerOS with your own Google sign-in. From the day we switch it on, a person whose role lets them connect the workspace's marketing channels can click "Sign in with Google" on a search channel and allow TimerOS, on Google's consent page, to view that Google account's Search Console data, read only. TimerOS then keeps an encrypted token from Google and uses it to list the Search Console properties that Google account can view, a list it shows only to the person who clicked "Sign in with Google", so that they can choose one, and to read two totals for the one property chosen — how often the site appeared in Google search results and how often it was clicked — for the current month and the month before, every day, again shortly after each restart of TimerOS's servers, and when someone clicks "Refresh numbers"; it never reads the search queries, pages, countries or devices behind them, and nothing else from the Google account. The totals become that channel's numbers, which the people who may open Marketing see and, where the workspace uses them, the AI employees that work on marketing read; the totals then go, as prompt content, to the AI model provider that runs that AI employee. Disconnecting deletes the token and, unless another channel in the workspace still uses a Google sign-in, asks Google to withdraw TimerOS's access. TimerOS's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Because TimerOS can now receive data from a Google account you sign in with, this is a material change. Section 4B gives the details.

What changed in version 1.9 (effective 2026-10-28). One change, to Section 4A, about the AI assistant you may connect to your own TimerOS account, and it widens, slightly, what the assistant can change in your name. Product ideas have a new stage, "Shipped": the idea was built or delivered. With the read-and-write scope, for an idea you may edit in TimerOS, your connected assistant can now also set its stage to Shipped — for an idea without a project, from any stage, and back to New, Exploring, Ready or Parked; for an idea that became a project, only from "In project" to "Shipped". It still never marks an idea "In project" itself: only making a project from the idea does, and only a person, in TimerOS, moves an idea back from "Shipped" to "In project". Like its other changes to an idea, each such change is recorded in the connection's activity journal. The assistant reads nothing new, nothing new reaches the provider you chose, and a connection you approved before needs no new consent. Because the assistant can now change one more thing in your name, this is a material change. Section 4A gives the details.

What changed in version 1.8 (effective 2026-10-27). One change, to Section 4A, about the AI assistant you may connect to your own TimerOS account, and it widens the assistant's reach: what it can read and what it can change in your name. From the day we switch it on, when you ask it to, your connected assistant can also list the product ideas in your workspace's Ideas section — for each, its title, summary, stage and owner, when it was last updated and the project it became — and read an idea: its summary, the notes people wrote, the notes AI employees wrote (with the AI employee's name), the text of the notes and text boxes on its canvas (never the drawings, shapes or images), its stage, the title of the meeting it was filed from and the project it became, never more than you can see in TimerOS. Every person in the workspace can read every idea in TimerOS; the Customer's clients never can. What people and AI employees wrote in an idea is passed to the assistant marked as data rather than as instructions. With the read-and-write scope, it can file a new idea in your name, with a title, a summary and a colour, and, for an idea you may edit in TimerOS, change its title, summary, colour and stage (New, Exploring, Ready or Parked) and add text at the end of its notes; it never replaces or deletes notes, never deletes an idea, never draws on the canvas and never changes an idea's owner. It can also create a project from an idea, through the same step by which it creates any project — it puts a plan in front of you and creates the project only once you have approved it — and the idea is then marked "In project". Each change it makes to an idea is recorded in the connection's activity journal, like its other changes; when it adds to an idea's notes, the entry keeps the notes as they were before, so that the change can be reversed. Making a project from an idea is the one change that cannot be reversed for the idea: it stays "In project". A connection you approved before that day gets this access only once you connect the assistant again and approve a consent page that names your workspace's product ideas. As before, the data goes to the provider you chose, on your instruction, and a workspace owner or administrator can turn assistant connections off for the whole workspace. The list in version 1.7 of what the connector reads included no product ideas; because ideas and notes written by other people and by AI employees can now reach the provider you chose, this is a material change. Section 4A gives the details.

What changed in version 1.7 (effective 2026-10-27). One change, to Section 4A, about the AI assistant you may connect to your own TimerOS account, and it widens the assistant's reach: what it can read and where it can post in your name. From the day we switch it on, when you ask it to, your connected assistant can also list the meetings and trainings you organise, attend or observe and in which AI employees take part — for each, its title, start and end time, status and who takes part in it — and read their rooms: the messages people and AI employees wrote there and the minutes once they are saved, never more than you can read yourself. With the read-and-write scope, it can post a message in your name in the room of such a meeting, but only while the meeting is running. Each such message is marked, with the assistant's name, as sent through the connector, and everyone in the room, people included, sees the mark; a message that mentions an AI employee wakes it exactly as a message you typed would, using one of the turns the meeting allows its AI employees; these messages count toward the same limit of 30 messages an hour as the assistant's messages in chat. A connection you approved before that day gets this access only once you connect the assistant again and approve a consent page that names your meetings with AI employees. The assistant still reaches no client conversation, no group with a client's contacts, no incident war room, and no chat between people only, including a meeting with no AI employee in it. As before, the data goes to the provider you chose, on your instruction, and a workspace owner or administrator can turn assistant connections off for the whole workspace. The list in version 1.6 of what the connector reads included no meeting room; because messages other people wrote in a meeting room, and the meeting's minutes, can now reach the provider you chose, this is a material change. Section 4A gives the details.

What changed in version 1.6 (effective 2026-10-26). One change, to Section 4A, about the AI assistant you may connect to your own TimerOS account, and it widens what the assistant may decide in your name. Version 1.5 said the assistant never decides a request to publish content, to send e-mail or a message to a client, to approve a change request, to hire or for a workforce plan, a payment or a spending-cap change, a push or merge in a public repository, or any other request TimerOS keeps for a person. From the day we switch it on, when you ask it to for that exact request, your connected assistant can decide those too, with the read-and-write scope: it can approve, in your name, a post with the exact text and time you approved, an e-mail or a message to a client with the exact text you approved, a change request, a workforce plan with the details you give for each hire, a payment or a spending-cap change of the amount shown, a deletion, the linking or creation of a repository, the resolution of an incident, and a question an AI employee asked you, with the option you picked. For each of these the assistant is instructed to show you first the exact text, amount or target and what will happen, and to decide only after you confirm it in that conversation; the decision must quote a confirmation code tied to exactly what was shown, and TimerOS records with the decision a fingerprint of what you confirmed, never the text itself. A push or merge whose code changes cannot be read in full is still never approved this way. Everything else stands: the decision is yours, taken by the same route and under the same rules as in TimerOS, marked on the request as taken through the connector with the assistant's name, undoable by you within 7 days where TimerOS can undo what it did — some things cannot be taken back, such as a sent e-mail, a message a client has received, a payment, a published post or a deletion, and the assistant tells you so before you confirm — and at most 20 decisions an hour. A connection you approved before that day keeps the kinds it had; you add the rest by connecting the assistant again and approving a consent page that names them. For a reply an AI employee drafted to an e-mail or a support ticket, or a message it drafted to a client, the assistant can now also read what the request's card in TimerOS shows you with it: the e-mail it replies to, the ticket with its messages, or the latest messages of the conversation with the client, and, for a workforce plan, the names of your workspace's shifts and of the access roles an AI employee can be given; beyond that it reads nothing more than before. Because the assistant can now take, in your name, decisions that reach your clients and the public, approve payments and change the AI employees of your workspace, and can read the e-mail, ticket or client conversation such a draft answers, this is a material change. Section 4A gives the details.

What changed in version 1.5 (effective 2026-10-26). One change, to Section 4A, about the AI assistant you may connect to your own TimerOS account. From the day we switch on access to approval requests, when you ask it to, your connected assistant can also read the approval requests that the workspace's AI employees filed with you, waiting for your decision or already decided: what the AI employee asks, the reason it gave, the items of the request, why the request came to you and, for a push or merge of code, the code changes, with every line in which TimerOS detects a secret removed. It never reaches a request a person filed (such as leave, a transfer, an expense or pay), another person's request, or a request addressed to another person. With the read-and-write scope, it can also approve or reject such a request in your name. The assistant is instructed to decide only when you ask it to for that exact request, and each decision must quote the request's exact title. The decision is yours, is taken by the same route and under the same rules as when you decide in TimerOS, and TimerOS shows on the request that it was taken through the connector, with the assistant's name. An approval given through it can be undone by you within 7 days, as an AI employee's approval can; a rejection stands. The assistant never decides a request to publish content, to send e-mail or a message to a client, to approve a change request (its client is told of the decision), to hire or for a workforce plan, a payment or a spending-cap change, a push or merge that is in a public repository or whose code changes cannot be read in full, or any other request TimerOS keeps for a person, such as a deletion or a question the AI employee asked you to decide; those it can only read and advise you on. Code in a private repository whose merge it approved may be deployed by the workspace's own pipeline, as when you approve the merge in TimerOS. A connection you approved before that day gets this access only once you connect the assistant again and approve a consent page that lists these requests. As before, the data goes to the provider you chose, on your instruction, and a workspace owner or administrator can turn assistant connections off for the whole workspace. The list in version 1.4 of what the connector reads included no approval requests; because content written by AI employees, code included, can now reach the provider you chose, and because the assistant can take a decision in your name, this is a material change. Section 4A gives the details.

What changed in version 1.4 (effective 2026-10-24). One change, to Section 4A, about the AI assistant you may connect to your own TimerOS account. From the day we switch it on, when you ask it to, your connected assistant can also read your one-to-one chats with the workspace's AI employees and the team threads you are in that include AI employees — the messages you, your colleagues, and the AI employees wrote there, and never more than you can read yourself. From that same day, if you can see the workspace's social account settings, it can also read the name and platform of each of the workspace's social accounts whose final reviewer is an AI employee. A connection you approved before that day gets this access only once you connect the assistant again and approve a consent page that lists these chats. With the read-and-write scope, it can post a message in those chats and threads in your name. Each such message is marked, with the assistant's name, as sent through the connector; it reaches and wakes the AI employees exactly as a message you typed would. The assistant still reaches no client conversation, no group with a client's contacts, no incident war room, no meeting room, and no chat between people only, and it still cannot read Client Portal chat. As before, the data goes to the provider you chose, on your instruction, and a workspace owner or administrator can turn assistant connections off for the whole workspace. The list in version 1.3 of what the connector reads included no chat; because chat messages written by other people can now reach the provider you chose, this is a material change. Section 4A gives the details.

What changed in version 1.3 (effective 2026-10-19). From the day we switch it on, the AI employees hired as support engineers in our own workspace read the support tickets you open with us from your TimerOS account — the ticket and the messages in it, with your name and your workspace's name, never your e-mail address — and may draft a reply; a person on our support team reviews, edits and sends every reply, under their own name, and no AI employee sends anything or changes a ticket. A ticket that TimerOS recognises by its words as from or about a job applicant, about pay or a contract, or as a personal-data request is never shown to an AI employee. What an AI employee reads of a ticket goes, as prompt content, through OpenRouter to the AI model providers named in Section 4, in the United States. Sections 1, 2.2, 4 and 5 give the details.

What changed in version 1.2 (effective 2026-10-16). From the day we switch it on, the AI employees in our own workspace to which a person gave one of our addresses read your whole e-mail (except the kinds we never keep), may mark it and sort it into our folders, and may draft a reply; a person at Vezoft reviews, edits and sends every reply, and no AI employee sends e-mail. Your e-mail then also goes, as prompt content, through OpenRouter to the AI model providers named in Section 4, in the United States. When our mail account is switched on, and each time an address is given to an AI employee, the e-mail of the last 30 days in our Inbox is included. In TimerOS the text, the recipients and the attachments of your e-mail are kept encrypted and are deleted after 90 days, with your address and name and the subject; your e-mail domain and the date are kept for a year. Sections 1, 2.1, 4 and 5 give the details.

What changed in version 1.1 (effective 2026-10-16). From the day we switch it on, when you write to one of our own e-mail addresses, such as sales@timeros.ai or support@timeros.ai, TimerOS may make a short summary of your e-mail with an AI model. The summary is for the AI employees in our own workspace, which never read your e-mail itself and never answer it; a person does. Sections 1, 2.1, 4 and 5 give the details: what is summarised and what is not, the US transfer to OpenRouter and Anthropic, and how long it is kept.

This Privacy Policy explains how Vezoft EOOD ("Vezoft", "TimerOS", "we", "us"), a single-member limited liability company incorporated in Bulgaria that operates the TimerOS service (the "Service"), processes personal data when you visit our website, register an account, or use the Service. See the Imprint for our full company details. It is written to satisfy the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), and the comprehensive state privacy laws of Colorado, Connecticut, Utah, Virginia, Texas, and Oregon. It also describes how the on-device AI activity classification feature works, as required by Article 50 of the EU AI Act.

If something here conflicts with a separate written agreement between TimerOS and your employer (the "Customer DPA"), the Customer DPA prevails for processing of employee personal data.

---

1. Who we are, and the two roles we play

TimerOS plays one of two roles depending on whose data is involved.

Controller role. We are the controller of personal data we collect directly: visitors to our website, people who sign up for an account, and people who contact us by email. When you write to one of our own e-mail addresses, the AI employees in our own workspace may also read your e-mail and draft a reply that a person sends (Section 2.1). When you open a support ticket with us from your TimerOS account, the AI employees hired as support engineers in our own workspace may also read it and draft a reply that a person sends (Section 2.2).

Processor role. When a Customer (an employer or contractor) uses TimerOS to track its employees, contractors, or clients, the Customer is the controller of that personal data and TimerOS is the processor. We process that data only on the Customer's documented instructions, as set out in the Customer Data Processing Agreement. If you are an employee of a TimerOS Customer and want to exercise your data rights about your time-tracking data, contact your employer first — they hold the controller obligations. We will help them respond.

---

2. What we collect, why, and the legal basis

2.1 When you visit the website or download an application

AI employees and e-mail to our own addresses. This applies only from the day we switch it on, and only if a person in our own workspace has given one of our addresses to an AI employee. TimerOS then reads the new mail that arrives at that address and, when our mail account is switched on and each time the address is given to an AI employee, the mail of the last 30 days in our Inbox, read or unread. It never reads older mail.

Mail TimerOS holds back. TimerOS recognises some mail by words in it, also in the text of plain-text attachments. The mail is held back if it is:

• from or about a job applicant;
• about pay or invoices;
• about a contract or another legal matter;
• a request about personal data, including a request to exercise your rights.

Such mail is never summarised and never shown to an AI employee. Of such mail TimerOS keeps only your e-mail domain, the date, the address you wrote to, the headers that mark bulk mail and whether it is read, answered or marked important. Where the words miss such a mail, the AI model that writes the summary may recognise it instead, and TimerOS then deletes the text and does not show it to any AI employee. By then, though, the model will have read it; no AI employee will have, because TimerOS shows an AI employee a mail only after this check. A mail the model could not check is never shown to an AI employee. A person can also move a mail into our People, Finance or Legal folder, and an AI employee can hand a mail over to them the same way; TimerOS then deletes its text, its subject and your address and name — at once when an AI employee does it, at its next check of the mailbox when a person does.

What an AI employee does with your e-mail. For other mail, an AI employee that holds the address reads your whole e-mail: your address and name, the other recipients, the subject, the date, the text and the list of attachments, with the text of plain-text attachments. It reads no PDF or other attached file. It can mark your e-mail read or important and, except on the mail account that our support inbox also reads, move it between our folders; it never deletes it. It can draft a reply, which goes only to you and to people already on the thread. A person at Vezoft sees your e-mail beside the draft, can change anything in it, and sends it from our address, or rejects it. No AI employee sends e-mail. What the AI employee reads goes, as prompt content, through OpenRouter to the AI model provider that runs it (Section 4), in the United States, with no training on it and no retention after answering. It is also in the record of the AI employee's work sessions on its computer at Hetzner (EU) until 30 days after that session's last activity. The AI employee is instructed never to copy your words, name or address into its memory.

How a summary is made. TimerOS still makes a short summary, for the list of mail and to check, before any AI employee sees your e-mail, that it is not one TimerOS holds back. Vezoft's fleet service (Hetzner, EU) sends Anthropic four things through OpenRouter, both in the United States:

• the subject;
• the whole text, with the text of plain-text attachments: all the text an AI employee may read of your e-mail, so that none of it goes unchecked;
• your e-mail domain, never your address or name;
• the kind of mail TimerOS sorted it into, such as a client's mail or a newsletter.

Anthropic writes a summary of at most 300 characters. The summary is written without naming anyone, and e-mail addresses, links and phone numbers are removed from it. Anthropic does not train on your e-mail or keep it.

How it is kept. In TimerOS, the text, the recipients and the attachments of your e-mail are kept encrypted; your address and name and the subject are kept unencrypted, so that the list of mail can show them. All of it is deleted after 90 days. The text, subject and recipients of a reply are kept in our approval records for 90 days after a person sent or rejected it (an address our mail service refused stays in the record); the reply itself is in our Sent folder at Zoho, with the rest of our mail. Your e-mail stays in our mailbox.

Objecting. You can object at any time by writing to privacy@timeros.ai (Section 7). We will then delete what TimerOS has kept of your e-mail. We will also delete your later e-mail from TimerOS when it arrives.

We do not use Google Analytics, Meta Pixel, HubSpot, Mixpanel, Segment, or any other third-party analytics on our public website at the date above. If that changes we will update the Cookie Policy and this section, and add a consent mechanism where required.

2.2 When you register a TimerOS account

AI employees and support tickets. This applies only from the day we switch it on. An AI employee hired as a support engineer in our own workspace can list and read the support tickets you open with us: the ticket's number, title, status, priority and category, your workspace's name and your name, and the messages in it — yours and our support team's — but never your e-mail address. It changes nothing on a ticket. It can draft a reply: a person on our support team sees your ticket beside the draft, can change anything in it, and sends it, or rejects it; the reply reaches you as that person's reply, on the ticket and by e-mail, under their name. No AI employee sends anything. A ticket whose words show that it is from or about a job applicant, about pay, payroll or salaries, about a contract or another legal matter, or a request about personal data, including a request to exercise your rights, is never shown to an AI employee; a billing question is. What the AI employee reads goes, as prompt content, through OpenRouter to the AI model provider that runs it (Section 4), in the United States, with no training on it and no retention after answering. It is also in the record of the AI employee's work sessions on its computer at Hetzner (EU) until 30 days after that session's last activity. The draft, what the person sent and who sent it are kept in our approval records. You can object at any time by writing to privacy@timeros.ai (Section 7).

2.3 When you use TimerOS as an employee of a TimerOS Customer

When you are an employee, contractor, or worker of a TimerOS Customer, that Customer is the controller of your personal data. You may interact with the Service through any of its surfaces — the desktop application, the web application, the Android companion application (a review / management dashboard), or the per-tenant client portal — but automatic activity tracking and the activity classifier run only on the Windows desktop application; the other surfaces only display and manage data the desktop has already produced (and data you or your manager enter manually).

TimerOS processes the following on the Customer's instructions:

The locally-processed data is read in memory, fed into the classifier (a scored rule engine combined with a small on-device statistical classifier — no cloud AI service, no model download, no large language model, no network call), discarded, and never sent to TimerOS servers or to any third party. Only the resulting activity status (one of: productive, idle, break, overtime, off_work, offline) and the aggregate hours-per-bucket totals are sent to the Customer's workspace.

TimerOS does not take screenshots, record the screen, capture keystrokes, record audio or video, read your browsing history or your bookmarks, or transmit the names of the applications, windows, or website domains you use.

How the website domain is obtained, precisely. Where the condition in the table above is met, the desktop app asks the browser for the address of the tab in front of you — through the operating system's accessibility interface, not from the title bar — and immediately reduces it to the site name and, where it reads as a word rather than an identifier, the first section of the path. The deeper path, the query string and the fragment are dropped at that moment: they are never classified, never stored, and never transmitted. Browser-internal pages and local files are rejected before anything is extracted. What is kept is discarded after classifying the site.

2.4 When you are a client of a TimerOS Customer using the Client Portal

2.5 Manual and edited time entries

Time entries are not exclusively produced by the timer. Either the employee or an authorised manager may create a time entry manually (for example, to record work performed offline) or edit an existing time entry (for example, to correct a wrong project assignment, a missed clock-out, or an inaccurate duration).

• Audit log. Every create, edit, and deletion of a time entry is recorded in an append-only audit log capturing who made the change, when (UTC timestamp), and the full before/after state of the affected fields. The audit log is append-only — no TimerOS interface (UI or API) can edit or delete an entry; this is enforced at the application and database layer.
• Visible "Edited" badge. Time entries that have been manually created or subsequently edited are displayed in the desktop app, the Customer's dashboard, and the Client Portal with a visible "Edited" badge, so reviewers can distinguish them from timer-captured entries.
• GDPR basis. This mechanism supports the accuracy principle in GDPR Art. 5(1)(d) (personal data must be accurate and, where necessary, kept up to date) and the right to rectification under GDPR Art. 16 (you can request correction of inaccurate personal data). If you are an employee and you believe a time entry about you is inaccurate, ask your employer to correct it; the corrected entry will carry the "Edited" badge and the change will be visible in the audit log.
• Retention. The audit log for a time entry is retained for the same statutory period as the underlying payroll record (see Section 6), so that the evidentiary trail for any pay calculation remains intact for as long as the payroll record itself.

---

3. About the AI activity classifier (EU AI Act Art. 50 notice)

The TimerOS desktop app includes an on-device AI feature that gives your current foreground activity one of two labels — "productive" or "idle" — together with a confidence score. The desktop timer then uses that label, together with how long you have been idle and your shift schedule, to decide how the time shows up on your timesheet — as productive, idle, break, overtime, or off-work time. When the desktop timer is not running, your activity status is recorded as "offline". This notice tells you how it works.

• Where it runs. Entirely on your device. We do not send your window titles, application names, or website domains to any cloud AI service. The classifier consists of (a) a scored rule engine that matches application names, window-title substrings, and — for supported browsers, subject to the condition in Section 2.3 — the active tab's website domain against built-in lists of well-known work and non-work apps and websites and against any rules your employer has defined, combining signals such as application match, title match, website-domain match, and overlap with your assigned project, task, and job-title keywords; and (b) optionally, a small on-device statistical classifier whose weights are included with the desktop installer (a few tens of kilobytes, not a multi-gigabyte language model). No cloud AI service, no model download, no large language model. This is a deliberate privacy upgrade over earlier designs that contemplated a locally-running large language model: the current architecture removes the entire class of risks associated with shipping or downloading a multi-gigabyte generative model, removes any local inference server, and removes any background process that touches your activity data. We maintain a model card and an EU AI Act applicability assessment for the classifier, available to competent authorities on request.
• What it sees. The title of the currently-foreground window, the name of the running application, and — for supported browsers, subject to the condition in Section 2.3 — the domain of your active browser tab and the first section of its path (e.g. nova.bg, console), at the moment of classification. It does not see the contents of files, the body of emails, your stored browsing history or bookmarks, or anything you type. It obtains the tab's address from the browser in order to reduce it to that domain and path section; the rest of the address is dropped at the moment of reading and is never classified, stored, or transmitted.
• What it outputs. The classifier itself produces a binary label ("productive" or "idle") and a confidence score (0–1). The desktop timer then maps that binary label, together with idle-time and your shift, into one of six activity-status values stored on the TimerOS servers as the activity_status field of your employee record: productive, idle, break, overtime, off_work, or offline. The field is overwritten each time the status changes. Past labels are not stored as a log; only the current status plus aggregated hour totals are persisted.
• What it is not. The classifier is not an automated decision-making system in the sense of GDPR Art. 22. The classifier does not, by itself, produce any decision affecting your employment, pay, discipline, or promotion. The Terms of Service require Customers to make those decisions through human review of broader evidence. Under EU AI Act Art. 6(3), TimerOS positions this classifier as a system that performs a "narrow procedural task" (mapping a window title to one of a finite set of labels) and is not "high-risk" within the meaning of Annex III.
• Human oversight. You and your employer can override any classification through the timer bar. Classifications can be reviewed and corrected at any time, and your corrections are stored only on your device. In the desktop app's Settings → Activity Detection → Tracking mode you can switch to Rule-based (AI/ML layer off, rule engine alone) or Manual (no automatic classification — you set your own state). The rule engine is deterministic for a given installed version, so the same activity always receives the same classification.
• Accuracy and limitations. The classifier is approximate. For example, a Stack Overflow tab you are reading may be labelled "idle" because you are not typing or clicking, even though you are doing real work. Both you and your employer should treat the labels as indicative, not exact.

If you have questions about how the classifier handled a specific period of time, email privacy@timeros.ai.

---

4. Who we share data with

We share personal data only with the following categories of recipients, and only as needed:

iOS / Apple distribution is planned but not yet active; Apple is not currently an active sub-processor.

A complete and current list is at /legal/subprocessors. The Customer DPA grants Customers the right to object to new sub-processors with 30 days' notice. AI assistant providers that a user connects to their own account through the TimerOS connector (Section 4A) are not listed here because they are not our sub-processors: the user, not Vezoft, engages them.

We do not sell personal data (CCPA/CPRA definition) and we do not share personal data for cross-context behavioural advertising.

---

4A. Connected AI assistants

What the feature is. If you have a TimerOS account, you may connect an AI assistant of your choice (for example Claude, made by Anthropic) to that account through the TimerOS connector — a Model Context Protocol (MCP) server that we host at https://api.timeros.ai/mcp. To connect, you sign in to TimerOS from the assistant (with your password and, where enabled, your two-factor code) and approve, on a consent page that names the assistant and the workspace, the access it asked for — read only, or read and write — and, as a separate ticked checkbox you may untick, work on your incidents and change requests. From then on, when you ask it to, the assistant can read your work — projects, tasks, teams, people, goals, clients, invoices, expenses, and the profit report — and, from the day we switch it on, your one-to-one chats with the workspace's AI employees, the team threads you are in that include AI employees and, if you can see the workspace's social account settings, the name and platform of each of its social accounts whose final reviewer is an AI employee, and, from the day we switch on access to approval requests, the approval requests the workspace's AI employees filed with you, and, from the day we switch on access to meetings, the meetings and trainings you organise, attend or observe and in which AI employees take part, with their rooms, and, from the day we switch on access to product ideas, the product ideas in your workspace's Ideas section; with the wider scope, it can also create and update projects, tasks, subtasks, task notes, and operating expenses, attribute your own unassigned tracked time to your tasks, and, from that same day, post a message in those chats and threads in your name, and, from the day we switch on access to approval requests, approve or reject in your name an approval request an AI employee filed with you, of the kinds described below, when you ask it to for that request, and, from the day we switch on access to meetings, post a message in your name in the room of such a meeting while the meeting is running, and, from the day we switch on access to product ideas, file a product idea in your name, change an idea you may edit in TimerOS, add text to its notes and create a project from it. A connection you approved before that day has no access to these chats; you add it by connecting the assistant again and approving a consent page that lists your chats with AI employees. A connection you approved before the day we switch on access to approval requests has no access to them; you add it by connecting the assistant again and approving a consent page that lists the approval requests AI employees filed with you. A connection you approved before the day we widen the kinds the assistant may decide (version 1.6) keeps the kinds it had; you add the rest by connecting the assistant again and approving a consent page that names them. A connection you approved before the day we switch on access to meetings (version 1.7) has no access to them; you add it by connecting the assistant again and approving a consent page that names your meetings with AI employees. A connection you approved before the day we switch on access to product ideas (version 1.8) has no access to them; you add it by connecting the assistant again and approving a consent page that names your workspace's product ideas. A connection you approved before the day we switch on pictures on posts (version 1.11) does not receive them, and a post with a picture can only be rejected through it; you add them by connecting the assistant again and approving a consent page that names the pictures. Nothing is connected unless you complete these steps yourself.

When data leaves TimerOS, and how much. Data is disclosed to the assistant provider only in response to a request from the assistant you connected, under your authorisation, and limited to the scope you approved and to what you can already see in TimerOS. Every request runs through the same routes, guards, and permissions that apply to you in the desktop and web applications, so the assistant can never see more than you can, and it cannot reach another workspace. Pay, salaries, tax identifiers, dates of birth, home addresses, and emergency contacts are stripped from every response. The connector has no tools of its own for deleting anything; for logging or editing time (beyond attributing your own already-tracked, unassigned minutes to your tasks); for setting budgets or rates; for creating or sending invoices; or for editing clients or employees — and it never assigns people to projects or tasks, except as part of carrying out an AI employee's request that it approves in your name (see below). Incidents and change requests are covered by a further scope that you consent to separately: on the consent page it appears as a checkbox, which you may untick to connect without it. If you leave it ticked, the assistant can read your workspace's incidents and change requests — including the titles, descriptions, and comments your clients wrote in the Client Portal — add notes to them that are internal to your staff and are never shown to the client, assign them to employees, and, only after it has put a plan in front of you and you have approved it, resolve an incident or complete a change request. Those changes also require the read-and-write scope, so a read-only connection with the checkbox left ticked can read incidents and change requests but alter nothing. Of the workspace's chat, the connector reaches only your one-to-one chats with AI employees, the team threads you are in that include AI employees and, from the day we switch on access to meetings (version 1.7), the rooms of the meetings and trainings you organise, attend or observe and in which AI employees take part, and only when you ask it to: never a client's conversation (except as part of an AI employee's request, as described below), a group with a client's contacts, an incident war room, or a chat between people only, including a meeting with no AI employee in it. What it reads there includes the messages your colleagues and the AI employees wrote in those threads and rooms and, of a meeting, its title, start and end time and status, who takes part in it and its minutes once they are saved; it is never more than you can read yourself in TimerOS, and is passed to the assistant marked as data rather than as instructions. The assistant posts in your name, and each message it posts is marked as sent through the connector: TimerOS shows the mark, with the assistant's name, beside the message and tells the AI employee that reads the message. Such a message reaches and wakes the AI employees exactly as a message you typed would (see the AI Employees Notice, Section 5), and the connector posts at most 30 messages an hour for you, in chats and meeting rooms together. In a meeting room it posts only while the meeting is running; everyone in the room, people included, sees the mark, and a message that mentions an AI employee wakes it exactly as a message you typed would, using one of the turns the meeting allows its AI employees. From the day we switch on access to product ideas (version 1.8), the connector also reaches, when you ask it to, the product ideas in your workspace's Ideas section. Every person in the workspace can read every idea in TimerOS; the Customer's clients never can. What people and AI employees wrote in an idea is passed to the assistant marked as data rather than as instructions. The assistant can list the ideas — for each, its title, summary, stage and owner, when it was last updated and the project it became — and read an idea: its summary, the notes people wrote, the notes AI employees wrote (with the AI employee's name), the text of the notes and text boxes on its canvas (never the drawings, shapes or images), its stage, the title of the meeting it was filed from and the project it became; what it reads is never more than you can see in TimerOS. With the read-and-write scope it can file a new idea in your name, with a title, a summary and a colour, and, for an idea you may edit in TimerOS, change its title, summary, colour and stage (New, Exploring, Ready, Parked or, since version 1.9, Shipped — the idea was built or delivered; for an idea that became a project, only from "In project" to "Shipped": it never marks an idea "In project" itself) and add text at the end of its notes; it never replaces or deletes notes, never deletes an idea, never draws on the canvas and never changes an idea's owner. It can create a project from an idea through the same step by which it creates any project: it puts a plan in front of you and creates the project only once you have approved it; the idea is then marked "In project". Of approval requests, the connector reaches only those an AI employee filed with you, waiting for your decision or already decided, and of them only what the AI employee asks, the reason it gave, the items of the request, why the request came to you and, for a push or merge of code, the code changes, with every line in which TimerOS detects a secret removed; never a request a person filed (such as leave, a transfer, an expense or pay), another person's request, or a request addressed to another person. Everything in such a request was written by the AI employee and is passed to the assistant marked as data rather than as instructions. From the day we switch on the wider decisions (version 1.6), a connection that may take them also reaches what the request's card in TimerOS shows you with a reply an AI employee drafted to an e-mail or a support ticket, or with a message it drafted to a client: the e-mail it replies to (its sender, recipients, subject, date and text, and the addresses on its thread), the ticket with its messages, or the latest messages of the conversation with the client; these, too, are passed to the assistant marked as data rather than as instructions. With a workforce plan it also reaches the names of the workspace's shifts and of the access roles an AI employee can be given, as the card offers them. From the day we switch on pictures on posts (version 1.11), a connection whose consent page named them also reaches, with a post an AI employee asks you to approve, the picture attached to it — the picture the post would go out with, as the post's card in TimerOS shows it to you — scaled down to at most 1,568 pixels on its longer side and without the information stored inside the file, with its file name and whether the file is marked as made by AI, so that the assistant can show it to you; it was made or chosen by an AI employee and is passed to the assistant as data rather than as instructions. With the read-and-write scope the assistant can approve or reject such a request in your name; it is instructed to decide only when you ask it to for that exact request, and each decision must quote the request's exact title. The decision is yours, taken by the same route and under the same rules as when you decide in TimerOS, and TimerOS shows on the request that it was decided through the connector, with the assistant's name; an approval given through it can be undone by you within 7 days where TimerOS can undo what it did — some things cannot be taken back, such as a sent e-mail, a message a client has received, a payment, a published post or a deletion, and the assistant tells you so before you confirm — and a rejection stands. Until the day we switch on the wider decisions (version 1.6), the assistant does not decide a request to publish content, to send e-mail or a message to a client, to approve a change request (its client is told of the decision), to hire or for a workforce plan, a payment or a spending-cap change, a push or merge that is in a public repository, or any other request TimerOS keeps for a person, such as a deletion or a question the AI employee asked you to decide; those it can only read and advise you on. From that day, with the read-and-write scope, it decides those too when you ask it to for that exact request: a post goes out with the exact text, and at the time, you approved and, from the day we switch on pictures on posts (version 1.11), with the picture the assistant showed you, or without it if you said so — the assistant quotes the picture's fingerprint, which TimerOS gives it only together with the picture, and TimerOS refuses an approval of a picture the post no longer holds; an e-mail or a message to a client with the exact text you approved; a payment or a spending-cap change with the amount shown; a workforce plan with the details you give for each hire; a question with the option you picked. For each of these the assistant is instructed to show you first the exact text, amount or target and what will happen, and to decide only after you confirm it in that conversation; the decision must quote a confirmation code tied to exactly what was shown, and TimerOS records with the decision a fingerprint of what you confirmed, never the text itself. A push or merge whose code changes cannot be read in full is never approved this way. Code whose merge it approved may be deployed by the workspace's own pipeline, as when you approve the merge in TimerOS, and tasks it approves on a client's project are shown to that client in the Client Portal, as tasks there always are. The connector decides at most 20 requests an hour for you. Apart from the messages shown with an AI employee's draft to a client (see above), it still cannot read Client Portal chat, and text your clients wrote is passed to the assistant marked as data rather than as instructions. Vezoft does not run the assistant and performs no AI processing as part of the connector: the connector only answers the assistant's requests. It is unrelated to the on-device activity classifier described in Section 3.

The provider is your choice, not our sub-processor. You choose the assistant provider. It receives the data under its own terms and privacy policy; Vezoft has no contract with it and does not control what it does with the data. The provider is therefore not a Vezoft sub-processor and is not listed in Section 4 or on our sub-processor page, which lists the parties we engage — you, not we, engage the provider. Read the provider's terms before connecting. Any international transfer that results is made by you (or, where the Customer is the controller, on the Customer's responsibility) to the provider, not by Vezoft, so the safeguards described in Section 5 do not extend to it.

Where the Customer is the controller. If you use TimerOS as an employee or worker of a Customer (Section 2.3), the data the assistant can reach is Customer Personal Data, for which the Customer is the controller and we are the processor. The Customer decides whether its people may use this feature at all: a workspace owner or administrator can turn "Allow AI assistant connections" off for the whole workspace in Settings → Connections. Turning it off disconnects every live connection in that workspace immediately, blocks new ones, and the affected people are notified by email; the setting is on by default and applies to the whole workspace, not to individual people. The Customer is responsible for that decision, for the internal rules under which its people use the feature, and for its own assessment of the providers they connect. If you are unsure whether you may connect an assistant, ask your employer first.

What we store about each connection, and for how long. For each connection we store: the assistant's client identifier and name; the scope granted; timestamps (connected, last used, token expiry, revoked) and the reason it was revoked; a hash of the current refresh token and of the one it replaced (never the tokens themselves); and a journal of every change the assistant made — the tool used, the record it targeted, the values before and after the change, and the call that reverses it. An entry for a message the assistant posted identifies the thread or meeting room and the message, the @mentions in it, and the AI employees it woke, but not the text of the message; it has no reversing call, since the message has already reached the thread, but you can delete the message in TimerOS chat like any message of your own (a message in a meeting room stays there, like every other message in it). An entry for a decision the assistant took identifies the request, its kind, the decision and, for a decision you confirmed, a fingerprint (a hash) of what you confirmed, never your comment or the text itself; it has no reversing call: an approval is undone on the request itself in TimerOS, where the decision is also marked. A change the assistant makes to a product idea (version 1.8) is recorded in this journal like its other changes; when it adds text to an idea's notes, the entry keeps the notes as they were before that change, so that the change can be reversed. Making a project from an idea cannot be reversed for the idea, which stays tied to the project — "In project" or, since version 1.9, "Shipped"; its entry says so instead of giving a reversing call. Where the change was made to an incident or a change request, the entry identifies it by its ticket number rather than by the title your client wrote. A plan the assistant prepares for your approval (together with the values it would write) is stored until you apply it or it expires — 10 minutes after it is prepared — and is deleted automatically within about an hour after that. We keep these records to operate the connection, to show you what the assistant has done and let you undo it, and to secure your account. For your own account we are the controller of these records (legal basis: performance of the contract, Art. 6(1)(b), and our legitimate interests in account security, Art. 6(1)(f)); where the journal describes changes to a Customer's workspace data, we hold it for the Customer as processor. Access tokens issued to the assistant expire after 15 minutes; refresh tokens after 30 days, and each is replaced when used — a refresh token presented a second time disconnects that connection. Connection records are kept until you or an administrator disconnect the assistant; the connection is then marked revoked and retained as a revoked record under the general retention rules in Section 6.

Emails we send. We send you a transactional email each time a new assistant is connected to your account — it names the assistant and the scope and tells you where to disconnect it — and when an administrator turns the feature off for your workspace. These are security notices, not marketing.

Reviewing and disconnecting. In Settings → Connections in the desktop or web application you can see each connection (assistant name, scope, when it was connected and last used, and how many changes it has written), open its Activity list with the reversing call for each change, and Disconnect it with one click. Access stops on the assistant's very next request. You can disconnect even if your workspace's subscription has lapsed.

---

4B. Connecting marketing channels with Google sign-in or Mailchimp

What the feature is. In the Marketing section of TimerOS a workspace keeps its marketing channels — among them its website, its search channel (SEO), its ad accounts and its e-mail newsletters — with monthly numbers for each. From the day we switch each connection on, a person whose role lets them connect the workspace's marketing channels can connect a channel to one of four services, by allowing TimerOS access on that service's own consent page:

• Search Console, for a search (SEO) channel, with Sign in with Google: the person allows TimerOS to view Search Console data for the Google account they sign in with (Google's scope https://www.googleapis.com/auth/webmasters.readonly, read only).
• Google Analytics, for a Website or an Email channel, with Sign in with Google: the person allows TimerOS to see and download Google Analytics data (Google's scope https://www.googleapis.com/auth/analytics.readonly, read only).
• Google Ads, for an Ads channel, with Sign in with Google: Google offers no read-only permission for Google Ads, so its consent page asks the person to allow TimerOS to see, edit, create and delete Google Ads accounts and data (Google's scope https://www.googleapis.com/auth/adwords). TimerOS only reads: it never creates, changes, pauses or deletes a campaign, an ad, a budget or anything else in Google Ads.
• Mailchimp, for an Email channel, with Connect Mailchimp: Mailchimp has no narrower permission to ask for, so its page gives TimerOS the same access to the Mailchimp account as the person connecting has there. TimerOS only reads, and only what is listed below: which of Mailchimp's servers holds the account, the audiences' names and member counts, and the totals of the campaigns sent. It never reads a member's name or e-mail address or what a campaign says, and never sends, changes or deletes anything in Mailchimp.

For each Google service, the button asks Google for that service's permission only, and TimerOS never asks a Google account for its name, e-mail address or contacts. If the person does not grant the permission on Google's page, nothing is connected.

What TimerOS receives, and what it does with it.

• The list to choose from. Once the person has connected, TimerOS reads what their account can open there: its Search Console properties, with its permission level on each; its Google Analytics properties, with the name of the Google Analytics account each belongs to; the Google Ads accounts it can open directly, with each one's name, number and currency and whether it is a manager account (manager accounts are not offered); or its Mailchimp audiences, with each one's name and member count. TimerOS shows the list only to the person who connected, who chooses from it for the channel; when the list holds only one, TimerOS chooses it, and when someone connects the channel again and their account can still open the one chosen before, it stays chosen. Until something is chosen, TimerOS reads no numbers. TimerOS keeps only the one chosen — its identifier and name and, for a Google Analytics property, the name of its account — never the list, and the people who may open the Marketing section see the one chosen on the channel.
• A token. From Google, a refresh token; from Mailchimp, an access token. TimerOS stores it encrypted (AES-256-GCM) and uses it only to read that list and the numbers below. For Mailchimp, TimerOS also asks which of Mailchimp's servers holds the account and keeps that server's short name (such as us21), so that its reads go to that server only; Mailchimp's answer also describes the account and the Mailchimp user who connected it, and TimerOS keeps nothing else from it.
• Monthly totals for the one chosen, read every day, again shortly after each restart of TimerOS's servers, and when someone clicks "Refresh numbers", for the current month to date and for the month before:
  • from Search Console, how many times the site appeared in Google search results (impressions) and how many times it was clicked there (clicks);
  • from Google Analytics, for a Website channel, the visits the property counted (sessions, which count visits, not people), its page views and its key events; for an Email channel, only the visits that Google Analytics assigns to its e-mail channel — those it recognises as coming from links in e-mails — and their key events;
  • from Google Ads, how many times the account's ads were shown (impressions) and clicked (clicks), the conversions Google Ads counted, and what the ads cost, in the account's currency;
  • from Mailchimp, the audience's member count as it is now (for the current month only) and, for each of the two months, the number of campaigns sent to the audience and the sum of their unique opens and of their unique subscriber clicks. For each such campaign TimerOS receives Mailchimp's summary report — its opens, clicks and rates and, where the account tracks them, its orders and revenue — and keeps only the number of campaigns and those two sums.

TimerOS asks for these totals only: never for the search queries, pages, visitors, traffic sources, countries, devices or days behind them, never for the campaigns, ad groups, ads, keywords or search terms of a Google Ads account, and never for the members of a Mailchimp audience.

The totals become the channel's monthly numbers, each marked "via" the service that filled it, such as "via Google Ads": from Search Console, "reach" (impressions) and "clicks"; from Google Analytics, for a Website channel, "audience" (visits), "reach" (page views) and "leads" (key events) and, for an Email channel, "clicks" (visits) and "leads" (key events); from Google Ads, "reach" (impressions), "clicks", "leads" (conversions, rounded to a whole number) and "spend" (the cost, rounded to two decimal places, in the account's currency); and from Mailchimp, "audience" (members), "posts" (campaigns sent), "reach" (unique opens) and "clicks" (unique subscriber clicks). A number that a person or an AI employee entered for that month, or a spend that a person entered, is never overwritten.

Who sees the numbers. The numbers belong to the workspace, like any number entered in Marketing. The people who may open the Marketing section see them; the spend, only those of them who may also see the workspace's operating expenses. Where the workspace has an AI CMO and we have switched on the AI employees' work on marketing, that AI CMO and the AI employees in its line read the other numbers as part of that work, as described in the AI Employees Notice; no AI employee reads the spend. The numbers an AI employee reads go, as prompt content, to the AI model provider that runs it, a provider we admit only while its terms say it will not train on them or keep them after answering. The AI assistant a person connects through the TimerOS connector (Section 4A) cannot read the Marketing section.

Limited Use. TimerOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use that information only to let the person who signed in with Google choose the property or account, to keep the one chosen and the channel's numbers and show them in your workspace and, as described under "Who sees the numbers", for the work of the workspace's AI employees on marketing, which sends the numbers other than the spend to the AI model provider that runs the AI employee — a provider we admit only while its terms say it will not train on them or keep them after answering; we do not use or transfer it to serve ads, including personalised, interest-based or retargeted ads, do not sell it, and do not use it to develop, improve or train AI or machine-learning models; and no one at Vezoft reads it except with your permission, for security purposes such as investigating abuse, or to comply with the law. We use what TimerOS receives from Mailchimp in the same way and only for the same purposes.

Who is responsible. Connecting is the Customer's decision, made by a person it authorised. The one chosen, the token and the numbers are Customer data, which we process as the Customer's processor under the Customer DPA (Section 2.3). Google and Mailchimp receive the sign-in and our read requests under the terms between the person (or the Customer) and them; neither is our sub-processor. When the numbers come instead through a service the workspace connects itself under "Advanced" — Google Analytics through the workspace's own Zernio account, or a Search Console service-account key or a Cloudflare token pasted there — that service works under the workspace's own agreement with it, and TimerOS stores only what it needs to read the numbers (through Zernio: Zernio's identifier for the property and its name; through a key or token: the key or token, encrypted, the property or domain it reads and, for Cloudflare, Cloudflare's identifier for that domain) and the monthly totals.

How long we keep it, and how to stop it. The token is kept until the channel is disconnected or deleted, changed to a type its service does not fill or connected another way, until someone connects the channel again (the new token then replaces it), or until the workspace's data is erased at the end of the 30-day grace period after the workspace is deleted. Google Analytics fills both a Website and an Email channel, so it stays connected when one type is changed to the other, and TimerOS then reads the totals for the new type. Disconnect on the channel deletes the token and, for a Google sign-in, asks Google to withdraw TimerOS's access, unless another channel in the workspace still uses a Google sign-in, whether for Search Console, Google Analytics or Google Ads; deleting the channel, changing it to a type its service does not fill, or connecting it another way does the same. Google withdraws access for the whole sign-in, not for one channel or one service: a withdrawal ends that Google account's sign-in for Search Console, Google Analytics and Google Ads alike, in every TimerOS workspace where it was used, and a person there can sign in with Google again. TimerOS cannot withdraw its own access at Mailchimp: disconnecting, like erasing the workspace's data, deletes the Mailchimp token, and to end the access in Mailchimp too, remove TimerOS there under Integrations → Manage, in "Other connections". Deleting the workspace stops the reads; at the end of the 30-day grace period, when its data is erased with every token in it, TimerOS asks Google to withdraw the access of every Google sign-in in it. You can also withdraw TimerOS's access at any time, in your Google Account under Third-party apps & services or in Mailchimp as above; TimerOS then reads nothing more, and the channel shows that the sign-in expired or the access was withdrawn (while nothing has been chosen yet, it shows this to the person who connected). The monthly totals already stored remain the channel's numbers and are kept like any other number in Marketing.

---

5. International transfers

If you are in the EU/EEA/UK and we transfer your personal data to a country that does not have an adequacy decision (typically the United States), we rely on the European Commission's Standard Contractual Clauses (Module 1 controller-to-controller, or Module 2 controller-to-processor as appropriate), supplemented by the EU-US Data Privacy Framework where the recipient is certified, technical measures (encryption in transit and at rest), and the contractual measures in our sub-processor DPAs.

For EU Customers, the database (MongoDB Atlas) and the application servers (Render) are deployed in EU regions, and uploaded files (Cloudflare R2) and EU business mailboxes (Zoho) are pinned to the EU. Transactional / system email (Lettermint B.V., a Netherlands entity) is processed entirely within the EU/EEA on Lettermint's own EU infrastructure, so no international transfer arises for the email payload — no EU-US Data Privacy Framework and no Standard Contractual Clauses are required for it. Two flows are genuinely processed in the United States, and both are covered by Standard Contractual Clauses: Android companion-app push notifications, delivered through Google's Firebase Cloud Messaging, which are also covered by the EU-US Data Privacy Framework; and e-mail sent to our own addresses (Section 2.1): its subject and text (until version 1.2 of this Policy, up to 8,000 characters of it) go through OpenRouter to Anthropic for a summary, and, from version 1.2 of this Policy, the whole e-mail an AI employee in our own workspace reads goes through OpenRouter to the model provider that runs that AI employee, as, from version 1.3 of this Policy, does a support ticket that an AI employee hired there as a support engineer reads (Section 2.2), all with zero-retention routing and no training. The AI employees that we operate for Customers also use model providers in the United States; that processing is described in the AI Employees Notice and on the Sub-processors page. Several of the other EU-resident providers are nonetheless US-incorporated entities (MongoDB, Render, and Cloudflare); for those, the SCCs + EU-US Data Privacy Framework still apply as a safeguard against potential US government access even though the data is processed in the EU. The applicable regions are stated in the Customer DPA, Annex 3.

---

6. How long we keep data

Retention varies by data type. The full retention schedule is in our Data Retention Policy and the key periods are reproduced in the table in Section 2 above. As a general rule:

• Operational data is kept for the duration of the relationship plus a 30-day grace period for recovery.
• Records required by tax, accounting, or other law are kept for the statutory period (typically 5–10 years).
• Security logs are kept for 12 months.
• Backups are kept for 30 days and then overwritten.

After expiry, data is hard-deleted (database documents are removed, files are removed from object storage, and the next-cycle backup no longer contains them).

---

7. Your rights

If we are a controller of your data, you have the following rights and you can exercise any of them by emailing privacy@timeros.ai.

Under GDPR / UK GDPR:

• Access (Art. 15): a copy of your personal data and information about how we use it.
• Rectification (Art. 16): correction of inaccurate data.
• Erasure (Art. 17): deletion, subject to limited exceptions (legal obligations, claims).
• Restriction (Art. 18): pause processing while a complaint is resolved.
• Portability (Art. 20): machine-readable export of data you provided. Email privacy@timeros.ai and we will provide the export; a self-service export in Settings is planned.
• Objection (Art. 21): object to processing based on our legitimate interests.
• Withdraw consent (Art. 7(3)) where processing is based on consent — without affecting past lawful processing.
• Lodge a complaint with your local data protection authority. A list is at edpb.europa.eu/about-edpb/about-edpb/members_en. You do not need to contact us first.

Under CCPA/CPRA (California residents) and equivalent rights in CO, CT, UT, VA, TX, OR:

• Right to know what categories of personal information we collect, the purposes, the sources, and the categories of third parties with whom we share it.
• Right to access a copy of your personal information collected over the past 12 months.
• Right to delete your personal information, subject to limited exceptions.
• Right to correct inaccurate personal information.
• Right to opt-out of sale or sharing for cross-context behavioural advertising — we do not engage in either, but the right exists.
• Right to limit use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide the Service.
• Right to non-discrimination for exercising any of the above.

We respond to verifiable requests within 30 days under GDPR and within 45 days under CCPA (extendable once for 45 more days where reasonably necessary). To verify your identity we will match your request against the email on file; for sensitive requests we may ask for an additional factor.

If you are an employee of a Customer and your request concerns time-tracking data, please contact your employer first; we will support them in fulfilling your request.

---

8. Cookies and similar technologies

Our public website does not set non-essential cookies at the date above. We use localStorage to keep you logged in (an essential function). Full details are in the Cookie Policy.

---

9. Security

We take appropriate technical and organisational measures to protect personal data, including: TLS 1.2+ in transit; encryption at rest where the underlying provider offers it; per-tenant database isolation; bcrypt password hashing; AES-256-GCM encryption of 2FA secrets; access control via short-lived authentication tokens; principle of least privilege for staff access. The full set of measures is described in Annex 2 of the DPA.

No system is perfectly secure. If you suspect an incident, email security@timeros.ai. Where we act as processor for a Customer, we notify that Customer without undue delay after becoming aware of a personal-data breach — and, under our DPA, within 48 hours (GDPR Art. 33(2)); the Customer, as controller, is then responsible for notifying the competent supervisory authority (Art. 33(1)) and, where required, the affected individuals (Art. 34). Where we are the controller (for our own account and website data), we notify the competent supervisory authority under Art. 33(1) and, where required, affected individuals under Art. 34.

---

10. Children

The Service is for businesses, sole-traders, and individual professionals (Freelancer tier) acting in a professional or business capacity, and their workers. It is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has registered, email privacy@timeros.ai and we will delete the account.

---

11. Changes to this Policy

We will post the updated Policy at this URL and update the "Last updated" date. For material changes that affect a Customer's processing, we will notify the account owner by email at least 30 days before the change takes effect, as required by the DPA.

---

12. Quick contact summary

• Privacy / data subject requests: privacy@timeros.ai
• Security incidents: security@timeros.ai
• General questions: support@timeros.ai
• Postal: Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address)
• EU Representative: Not required — Vezoft is established in Bulgaria (EU Member State).