Sub-processors

This page lists the third parties that Vezoft EOOD — a single-member limited liability company incorporated in Bulgaria, trading as "Vezoft" / "TimerOS" ("we", "us") — engages to process personal data on behalf of its Customers ("sub-processors"). See the Imprint for our full company details. It is incorporated by reference into the Data Processing Agreement.

We will give Customers at least 30 days' prior notice by email to the account owner address on file before adding or replacing a sub-processor, and Customers may object in writing on reasonable grounds within that 30-day window. To receive notifications, ensure your account owner email is current, or email privacy@timeros.ai to be added to the sub-processor change notification list.

Current sub-processors

Notes on data location and international transfers

• Processing stays in the EU across the stack. All Customer Personal Data is processed in the EU: the databases (MongoDB Atlas, Frankfurt/Ireland), uploaded files (Cloudflare R2, EU jurisdiction), application compute (Render, Frankfurt), inbound support email (Zoho EU), and outbound system email (Lettermint, EU — Netherlands/France).
• US-incorporated vendors, EU processing. Several sub-processors (MongoDB, Render, Cloudflare) are US-incorporated companies that nonetheless process the relevant data in the EU. Because a US parent could in principle be compelled to access data (for example, under the US CLOUD Act), the EU-US Data Privacy Framework and Standard Contractual Clauses in each provider's DPA apply as a safeguard.
• One channel involves US processing: Google (Play Store distribution and Firebase Cloud Messaging push for the Android companion app), covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. No time-tracking, payroll, or activity-classification data is routed through it beyond what a push notification itself contains.

Notes on MongoDB Atlas

• Atlas AI features disabled for tenant clusters. Atlas Vector Search and any generative-AI / embedding services that would route through US-based downstream providers are disabled on tenant clusters. TimerOS does not use these features for Customer Personal Data.
• Activity classification is on-device. The desktop app assigns an activity category entirely on the user's own machine using a two-layer engine: a deterministic, scored rule engine, with a small on-device statistical classifier as a fallback. There is no model download, no inference server, no GPU dependency, and no network call from the classifier. Raw window titles and application names are never sent off the device for classification — only the resulting label and confidence are transmitted to the TimerOS API as time-entry telemetry and stored in MongoDB Atlas. Full documentation of the classifier (architecture, training data, evaluation) is maintained in the TimerOS model card and made available to competent authorities on request.
• DPA archive. Vezoft archives a dated snapshot of the MongoDB DPA in its Article 30 records each time MongoDB publishes a material change.

Notes on Render

• Why a hosting provider is needed. Render runs the API, the website, and the client portal. The EU service is deployed in Frankfurt (AWS eu-central-1) so that application compute and any data in transit through it remain in the EU.
• No persistence at the hosting layer. Customer Personal Data is persisted in MongoDB Atlas (and uploaded files in Cloudflare R2), not on Render instances; data on a Render instance is transient request/response state and logs.

Notes on Cloudflare

• R2 object storage is EU-pinned. The bucket used for uploaded project files is created with Cloudflare's EU jurisdictional restriction, so uploaded files are stored in EU data centres.
• CDN / reverse-proxy / WAF. Cloudflare also fronts the Service for DNS, content delivery, and security (DDoS / web application firewall). In that role its edge processes end-user IP addresses, request metadata, and terminates TLS at the nearest global point of presence. The CDN edge is global by design; the stored R2 data is EU-pinned.

Notes on Lettermint

• Why a transactional email provider is needed. TimerOS sends system-generated emails (password resets, email verification, sub-processor-change notices, material legal-change notices, invoice copies, team invitations). Sending these from a self-operated SMTP server is impractical because of deliverability filtering by Gmail / Outlook / Yahoo. Lettermint handles deliverability, bounce processing, and delivery receipts — the latter is important for proving that, for example, a 30-day sub-processor change notice was actually delivered.
• EU/EEA-only processing. Lettermint B.V. is a Netherlands entity and runs its own EU infrastructure (Autonomous System AS213427): primary hosting on UpCloud (Netherlands) with backup on OVHcloud (France). The sending domain (mail.timeros.ai) is served from this EU infrastructure and email data is encrypted at rest in EU data centres; there is no AWS/Google/Microsoft in the email path. All processing takes place within the EU/EEA (EU-to-EU), so no EU-US Data Privacy Framework and no Standard Contractual Clauses are required for the email payload (Lettermint's own DPA references SCCs only as a contingency). Only the recipient details and the content of the system email itself are processed — no database records are shared with Lettermint. Email is transmitted over TLS-encrypted connections, and message content and delivery/engagement metadata are retained only as long as needed to deliver the message and provide deliverability reporting. Post-termination, Lettermint deletes data within 30 days; Lettermint's DPA is at https://lettermint.co/dpa and its sub-processor list at https://lettermint.co/subprocessors.
• Transactional only. Vezoft uses Lettermint strictly for transactional email — not for newsletters, drip campaigns, or marketing automation. Any future marketing email would be disclosed by a sub-processor-list update and a Privacy Policy update.
• Notice-period commitment. Vezoft commits to 30 days' prior notice to Customers before adding or changing any sub-processor in this list.

Notes on Zoho

• EU-resident business mailboxes. Vezoft's business inboxes (support@, hello@, privacy@, security@) run on Zoho's EU service (zoho.eu, Zoho Corporation B.V.), with data in Zoho's EU data centres (Amsterdam and Dublin). Inbound mail to privacy@ and security@ routinely contains personal data (data-subject requests, security reports), which is why Zoho is listed as a sub-processor.
• EU posture. For the EU service, Zoho does not process this email data outside the EEA.

Notes on Google LLC

• Scope — Android companion app only. Google LLC is engaged only for the TimerOS Android companion app, which is a review-and-management dashboard: like the web dashboard, it does not track time and does not run the activity classifier — those remain on the Windows desktop. The desktop application, the web application, the marketing/admin website, and the client portal do not route through Google.
• iOS planned. When TimerOS launches its iOS app, Apple, Inc. will be added here as a separate sub-processor for App Store distribution and APNs push, with 30 days' prior notice to Customers per the procedure above.
• What FCM sees. If your tenant has enabled in-app push notifications, FCM receives the notification payload (subject line and body) for delivery to your device. The payload contains only data the Customer chose to push to its workforce; we do not route activity-classification telemetry through FCM.

AI assistants connected by users are not sub-processors. A user may connect an AI assistant of their own choosing (for example Claude, made by Anthropic) to their own TimerOS account through the TimerOS connector; that assistant then receives workspace data on the user's instruction, within the scope the user approved and limited to what the user can already see. The assistant provider is engaged by the user — not by Vezoft — under the provider's own terms; Vezoft has no contract with it, does not control what it does with the data, and does not process data on its behalf. Such providers are therefore not sub-processors within the meaning of this page or the DPA, are not listed above, and are not subject to the 30-day notice and objection procedure. A workspace owner or administrator can turn assistant connections off for the whole workspace in Settings → Connections; see Section 4A of the Privacy Policy.

Affiliates

Vezoft currently operates without affiliated entities. If we form affiliates in the future and they process Customer Personal Data on our behalf, they will be added to this list as sub-processors with notice as above.

How to object to a new sub-processor

Email privacy@timeros.ai within 30 days of notification, stating your concern. We will work with you to find an acceptable alternative. If we cannot, and you cannot in good faith use the Service with the new sub-processor, you may terminate the relevant Order Form on written notice and we will refund any prepaid fees covering the period after termination.

Inquiries

privacy@timeros.ai / Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address).