Privacy Policy

This Privacy Policy explains how Vezoft EOOD ("Vezoft", "TimerOS", "we", "us"), a single-member limited liability company incorporated in Bulgaria that operates the TimerOS service (the "Service"), processes personal data when you visit our website, register an account, or use the Service. See the Imprint for our full company details. It is written to satisfy the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), and the comprehensive state privacy laws of Colorado, Connecticut, Utah, Virginia, Texas, and Oregon. It also describes how the on-device AI activity classification feature works, as required by Article 50 of the EU AI Act.

If something here conflicts with a separate written agreement between TimerOS and your employer (the "Customer DPA"), the Customer DPA prevails for processing of employee personal data.

---

1. Who we are, and the two roles we play

TimerOS plays one of two roles depending on whose data is involved.

Controller role. We are the controller of personal data we collect directly: visitors to our website, people who sign up for an account, and people who contact us by email.

Processor role. When a Customer (an employer or contractor) uses TimerOS to track its employees, contractors, or clients, the Customer is the controller of that personal data and TimerOS is the processor. We process that data only on the Customer's documented instructions, as set out in the Customer Data Processing Agreement. If you are an employee of a TimerOS Customer and want to exercise your data rights about your time-tracking data, contact your employer first — they hold the controller obligations. We will help them respond.

---

2. What we collect, why, and the legal basis

2.1 When you visit the website or download an application

We do not use Google Analytics, Meta Pixel, HubSpot, Mixpanel, Segment, or any other third-party analytics on our public website at the date above. If that changes we will update the Cookie Policy and this section, and add a consent mechanism where required.

2.2 When you register a TimerOS account

2.3 When you use TimerOS as an employee of a TimerOS Customer

When you are an employee, contractor, or worker of a TimerOS Customer, that Customer is the controller of your personal data. You may interact with the Service through any of its surfaces — the desktop application, the web application, the Android companion application (a review / management dashboard), or the per-tenant client portal — but automatic activity tracking and the activity classifier run only on the Windows desktop application; the other surfaces only display and manage data the desktop has already produced (and data you or your manager enter manually).

TimerOS processes the following on the Customer's instructions:

The locally-processed data is read in memory, fed into the classifier (a scored rule engine combined with a small on-device statistical classifier — no cloud AI service, no model download, no large language model, no network call), discarded, and never sent to TimerOS servers or to any third party. Only the resulting activity status (one of: productive, idle, break, overtime, off_work, offline) and the aggregate hours-per-bucket totals are sent to the Customer's workspace.

TimerOS does not take screenshots, record the screen, capture keystrokes, record audio or video, read your browsing history or your bookmarks, or transmit the names of the applications, windows, or website domains you use.

How the website domain is obtained, precisely. Where the condition in the table above is met, the desktop app asks the browser for the address of the tab in front of you — through the operating system's accessibility interface, not from the title bar — and immediately reduces it to the site name and, where it reads as a word rather than an identifier, the first section of the path. The deeper path, the query string and the fragment are dropped at that moment: they are never classified, never stored, and never transmitted. Browser-internal pages and local files are rejected before anything is extracted. What is kept is discarded after classifying the site.

2.4 When you are a client of a TimerOS Customer using the Client Portal

2.5 Manual and edited time entries

Time entries are not exclusively produced by the timer. Either the employee or an authorised manager may create a time entry manually (for example, to record work performed offline) or edit an existing time entry (for example, to correct a wrong project assignment, a missed clock-out, or an inaccurate duration).

• Audit log. Every create, edit, and deletion of a time entry is recorded in an append-only audit log capturing who made the change, when (UTC timestamp), and the full before/after state of the affected fields. The audit log is append-only — no TimerOS interface (UI or API) can edit or delete an entry; this is enforced at the application and database layer.
• Visible "Edited" badge. Time entries that have been manually created or subsequently edited are displayed in the desktop app, the Customer's dashboard, and the Client Portal with a visible "Edited" badge, so reviewers can distinguish them from timer-captured entries.
• GDPR basis. This mechanism supports the accuracy principle in GDPR Art. 5(1)(d) (personal data must be accurate and, where necessary, kept up to date) and the right to rectification under GDPR Art. 16 (you can request correction of inaccurate personal data). If you are an employee and you believe a time entry about you is inaccurate, ask your employer to correct it; the corrected entry will carry the "Edited" badge and the change will be visible in the audit log.
• Retention. The audit log for a time entry is retained for the same statutory period as the underlying payroll record (see Section 6), so that the evidentiary trail for any pay calculation remains intact for as long as the payroll record itself.

---

3. About the AI activity classifier (EU AI Act Art. 50 notice)

The TimerOS desktop app includes an on-device AI feature that gives your current foreground activity one of two labels — "productive" or "idle" — together with a confidence score. The desktop timer then uses that label, together with how long you have been idle and your shift schedule, to decide how the time shows up on your timesheet — as productive, idle, break, overtime, or off-work time. When the desktop timer is not running, your activity status is recorded as "offline". This notice tells you how it works.

• Where it runs. Entirely on your device. We do not send your window titles, application names, or website domains to any cloud AI service. The classifier consists of (a) a scored rule engine that matches application names, window-title substrings, and — for supported browsers, subject to the condition in Section 2.3 — the active tab's website domain against built-in lists of well-known work and non-work apps and websites and against any rules your employer has defined, combining signals such as application match, title match, website-domain match, and overlap with your assigned project, task, and job-title keywords; and (b) optionally, a small on-device statistical classifier whose weights are included with the desktop installer (a few tens of kilobytes, not a multi-gigabyte language model). No cloud AI service, no model download, no large language model. This is a deliberate privacy upgrade over earlier designs that contemplated a locally-running large language model: the current architecture removes the entire class of risks associated with shipping or downloading a multi-gigabyte generative model, removes any local inference server, and removes any background process that touches your activity data. We maintain a model card and an EU AI Act applicability assessment for the classifier, available to competent authorities on request.
• What it sees. The title of the currently-foreground window, the name of the running application, and — for supported browsers, subject to the condition in Section 2.3 — the domain of your active browser tab and the first section of its path (e.g. nova.bg, console), at the moment of classification. It does not see the contents of files, the body of emails, your stored browsing history or bookmarks, or anything you type. It obtains the tab's address from the browser in order to reduce it to that domain and path section; the rest of the address is dropped at the moment of reading and is never classified, stored, or transmitted.
• What it outputs. The classifier itself produces a binary label ("productive" or "idle") and a confidence score (0–1). The desktop timer then maps that binary label, together with idle-time and your shift, into one of six activity-status values stored on the TimerOS servers as the activity_status field of your employee record: productive, idle, break, overtime, off_work, or offline. The field is overwritten each time the status changes. Past labels are not stored as a log; only the current status plus aggregated hour totals are persisted.
• What it is not. The classifier is not an automated decision-making system in the sense of GDPR Art. 22. The classifier does not, by itself, produce any decision affecting your employment, pay, discipline, or promotion. The Terms of Service require Customers to make those decisions through human review of broader evidence. Under EU AI Act Art. 6(3), TimerOS positions this classifier as a system that performs a "narrow procedural task" (mapping a window title to one of a finite set of labels) and is not "high-risk" within the meaning of Annex III.
• Human oversight. You and your employer can override any classification through the timer bar. Classifications can be reviewed and corrected at any time, and your corrections are stored only on your device. In the desktop app's Settings → Activity Detection → Tracking mode you can switch to Rule-based (AI/ML layer off, rule engine alone) or Manual (no automatic classification — you set your own state). The rule engine is deterministic for a given installed version, so the same activity always receives the same classification.
• Accuracy and limitations. The classifier is approximate. For example, a Stack Overflow tab you are reading may be labelled "idle" because you are not typing or clicking, even though you are doing real work. Both you and your employer should treat the labels as indicative, not exact.

If you have questions about how the classifier handled a specific period of time, email privacy@timeros.ai.

---

4. Who we share data with

We share personal data only with the following categories of recipients, and only as needed:

iOS / Apple distribution is planned but not yet active; Apple is not currently an active sub-processor.

A complete and current list is at /legal/subprocessors. The Customer DPA grants Customers the right to object to new sub-processors with 30 days' notice. AI assistant providers that a user connects to their own account through the TimerOS connector (Section 4A) are not listed here because they are not our sub-processors: the user, not Vezoft, engages them.

We do not sell personal data (CCPA/CPRA definition) and we do not share personal data for cross-context behavioural advertising.

---

4A. Connected AI assistants

What the feature is. If you have a TimerOS account, you may connect an AI assistant of your choice (for example Claude, made by Anthropic) to that account through the TimerOS connector — a Model Context Protocol (MCP) server that we host at https://api.timeros.ai/mcp. To connect, you sign in to TimerOS from the assistant (with your password and, where enabled, your two-factor code) and approve, on a consent page that names the assistant and the workspace, the access it asked for — read only, or read and write — and, as a separate ticked checkbox you may untick, work on your incidents and change requests. From then on, when you ask it to, the assistant can read your work — projects, tasks, teams, people, goals, clients, invoices, expenses, and the profit report — and, with the wider scope, create and update projects, tasks, subtasks, task notes, and operating expenses, and attribute your own unassigned tracked time to your tasks. Nothing is connected unless you complete these steps yourself.

When data leaves TimerOS, and how much. Data is disclosed to the assistant provider only in response to a request from the assistant you connected, under your authorisation, and limited to the scope you approved and to what you can already see in TimerOS. Every request runs through the same routes, guards, and permissions that apply to you in the desktop and web applications, so the assistant can never see more than you can, and it cannot reach another workspace. Pay, salaries, tax identifiers, dates of birth, home addresses, and emergency contacts are stripped from every response. The connector has no tools for deleting anything; for logging or editing time (beyond attributing your own already-tracked, unassigned minutes to your tasks); for setting budgets or rates; for creating or sending invoices; or for editing clients or employees — and it never assigns people to projects or tasks. Incidents and change requests are covered by a further scope that you consent to separately: on the consent page it appears as a checkbox, which you may untick to connect without it. If you leave it ticked, the assistant can read your workspace's incidents and change requests — including the titles, descriptions, and comments your clients wrote in the Client Portal — add notes to them that are internal to your staff and are never shown to the client, assign them to employees, and, only after it has put a plan in front of you and you have approved it, resolve an incident or complete a change request. Those changes also require the read-and-write scope, so a read-only connection with the checkbox left ticked can read incidents and change requests but alter nothing. It still cannot read Client Portal chat, and text your clients wrote is passed to the assistant marked as data rather than as instructions. Vezoft does not run the assistant and performs no AI processing as part of the connector: the connector only answers the assistant's requests. It is unrelated to the on-device activity classifier described in Section 3.

The provider is your choice, not our sub-processor. You choose the assistant provider. It receives the data under its own terms and privacy policy; Vezoft has no contract with it and does not control what it does with the data. The provider is therefore not a Vezoft sub-processor and is not listed in Section 4 or on our sub-processor page, which lists the parties we engage — you, not we, engage the provider. Read the provider's terms before connecting. Any international transfer that results is made by you (or, where the Customer is the controller, on the Customer's responsibility) to the provider, not by Vezoft, so the safeguards described in Section 5 do not extend to it.

Where the Customer is the controller. If you use TimerOS as an employee or worker of a Customer (Section 2.3), the data the assistant can reach is Customer Personal Data, for which the Customer is the controller and we are the processor. The Customer decides whether its people may use this feature at all: a workspace owner or administrator can turn "Allow AI assistant connections" off for the whole workspace in Settings → Connections. Turning it off disconnects every live connection in that workspace immediately, blocks new ones, and the affected people are notified by email; the setting is on by default and applies to the whole workspace, not to individual people. The Customer is responsible for that decision, for the internal rules under which its people use the feature, and for its own assessment of the providers they connect. If you are unsure whether you may connect an assistant, ask your employer first.

What we store about each connection, and for how long. For each connection we store: the assistant's client identifier and name; the scope granted; timestamps (connected, last used, token expiry, revoked) and the reason it was revoked; a hash of the current refresh token and of the one it replaced (never the tokens themselves); and a journal of every change the assistant made — the tool used, the record it targeted, the values before and after the change, and the call that reverses it. Where the change was made to an incident or a change request, the entry identifies it by its ticket number rather than by the title your client wrote. A plan the assistant prepares for your approval (together with the values it would write) is stored until you apply it or it expires — 10 minutes after it is prepared — and is deleted automatically within about an hour after that. We keep these records to operate the connection, to show you what the assistant has done and let you undo it, and to secure your account. For your own account we are the controller of these records (legal basis: performance of the contract, Art. 6(1)(b), and our legitimate interests in account security, Art. 6(1)(f)); where the journal describes changes to a Customer's workspace data, we hold it for the Customer as processor. Access tokens issued to the assistant expire after 15 minutes; refresh tokens after 30 days, and each is replaced when used — a refresh token presented a second time disconnects that connection. Connection records are kept until you or an administrator disconnect the assistant; the connection is then marked revoked and retained as a revoked record under the general retention rules in Section 6.

Emails we send. We send you a transactional email each time a new assistant is connected to your account — it names the assistant and the scope and tells you where to disconnect it — and when an administrator turns the feature off for your workspace. These are security notices, not marketing.

Reviewing and disconnecting. In Settings → Connections in the desktop or web application you can see each connection (assistant name, scope, when it was connected and last used, and how many changes it has written), open its Activity list with the reversing call for each change, and Disconnect it with one click. Access stops on the assistant's very next request. You can disconnect even if your workspace's subscription has lapsed.

---

5. International transfers

If you are in the EU/EEA/UK and we transfer your personal data to a country that does not have an adequacy decision (typically the United States), we rely on the European Commission's Standard Contractual Clauses (Module 1 controller-to-controller, or Module 2 controller-to-processor as appropriate), supplemented by the EU-US Data Privacy Framework where the recipient is certified, technical measures (encryption in transit and at rest), and the contractual measures in our sub-processor DPAs.

For EU Customers, the database (MongoDB Atlas) and the application servers (Render) are deployed in EU regions, and uploaded files (Cloudflare R2) and EU business mailboxes (Zoho) are pinned to the EU. Transactional / system email (Lettermint B.V., a Netherlands entity) is processed entirely within the EU/EEA on Lettermint's own EU infrastructure, so no international transfer arises for the email payload — no EU-US Data Privacy Framework and no Standard Contractual Clauses are required for it. The only flow genuinely processed in the United States is Android companion-app push notifications, delivered through Google's Firebase Cloud Messaging; this is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. Several of the other EU-resident providers are nonetheless US-incorporated entities (MongoDB, Render, and Cloudflare); for those, the SCCs + EU-US Data Privacy Framework still apply as a safeguard against potential US government access even though the data is processed in the EU. The applicable regions are stated in the Customer DPA, Annex 3.

---

6. How long we keep data

Retention varies by data type. The full retention schedule is in our Data Retention Policy and the key periods are reproduced in the table in Section 2 above. As a general rule:

• Operational data is kept for the duration of the relationship plus a 30-day grace period for recovery.
• Records required by tax, accounting, or other law are kept for the statutory period (typically 5–10 years).
• Security logs are kept for 12 months.
• Backups are kept for 30 days and then overwritten.

After expiry, data is hard-deleted (database documents are removed, files are removed from object storage, and the next-cycle backup no longer contains them).

---

7. Your rights

If we are a controller of your data, you have the following rights and you can exercise any of them by emailing privacy@timeros.ai.

Under GDPR / UK GDPR:

• Access (Art. 15): a copy of your personal data and information about how we use it.
• Rectification (Art. 16): correction of inaccurate data.
• Erasure (Art. 17): deletion, subject to limited exceptions (legal obligations, claims).
• Restriction (Art. 18): pause processing while a complaint is resolved.
• Portability (Art. 20): machine-readable export of data you provided. Email privacy@timeros.ai and we will provide the export; a self-service export in Settings is planned.
• Objection (Art. 21): object to processing based on our legitimate interests.
• Withdraw consent (Art. 7(3)) where processing is based on consent — without affecting past lawful processing.
• Lodge a complaint with your local data protection authority. A list is at edpb.europa.eu/about-edpb/about-edpb/members_en. You do not need to contact us first.

Under CCPA/CPRA (California residents) and equivalent rights in CO, CT, UT, VA, TX, OR:

• Right to know what categories of personal information we collect, the purposes, the sources, and the categories of third parties with whom we share it.
• Right to access a copy of your personal information collected over the past 12 months.
• Right to delete your personal information, subject to limited exceptions.
• Right to correct inaccurate personal information.
• Right to opt-out of sale or sharing for cross-context behavioural advertising — we do not engage in either, but the right exists.
• Right to limit use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide the Service.
• Right to non-discrimination for exercising any of the above.

We respond to verifiable requests within 30 days under GDPR and within 45 days under CCPA (extendable once for 45 more days where reasonably necessary). To verify your identity we will match your request against the email on file; for sensitive requests we may ask for an additional factor.

If you are an employee of a Customer and your request concerns time-tracking data, please contact your employer first; we will support them in fulfilling your request.

---

8. Cookies and similar technologies

Our public website does not set non-essential cookies at the date above. We use localStorage to keep you logged in (an essential function). Full details are in the Cookie Policy.

---

9. Security

We take appropriate technical and organisational measures to protect personal data, including: TLS 1.2+ in transit; encryption at rest where the underlying provider offers it; per-tenant database isolation; bcrypt password hashing; AES-256-GCM encryption of 2FA secrets; access control via short-lived authentication tokens; principle of least privilege for staff access. The full set of measures is described in Annex 2 of the DPA.

No system is perfectly secure. If you suspect an incident, email security@timeros.ai. Where we act as processor for a Customer, we notify that Customer without undue delay after becoming aware of a personal-data breach — and, under our DPA, within 48 hours (GDPR Art. 33(2)); the Customer, as controller, is then responsible for notifying the competent supervisory authority (Art. 33(1)) and, where required, the affected individuals (Art. 34). Where we are the controller (for our own account and website data), we notify the competent supervisory authority under Art. 33(1) and, where required, affected individuals under Art. 34.

---

10. Children

The Service is for businesses, sole-traders, and individual professionals (Freelancer tier) acting in a professional or business capacity, and their workers. It is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has registered, email privacy@timeros.ai and we will delete the account.

---

11. Changes to this Policy

We will post the updated Policy at this URL and update the "Last updated" date. For material changes that affect a Customer's processing, we will notify the account owner by email at least 30 days before the change takes effect, as required by the DPA.

---

12. Quick contact summary

• Privacy / data subject requests: privacy@timeros.ai
• Security incidents: security@timeros.ai
• General questions: support@timeros.ai
• Postal: Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address)
• EU Representative: Not required — Vezoft is established in Bulgaria (EU Member State).