Privacy Policy

What changed in version 1.3 (effective 2026-10-19). From the day we switch it on, the AI employees hired as support engineers in our own workspace read the support tickets you open with us from your TimerOS account — the ticket and the messages in it, with your name and your workspace's name, never your e-mail address — and may draft a reply; a person on our support team reviews, edits and sends every reply, under their own name, and no AI employee sends anything or changes a ticket. A ticket that TimerOS recognises by its words as from or about a job applicant, about pay or a contract, or as a personal-data request is never shown to an AI employee. What an AI employee reads of a ticket goes, as prompt content, through OpenRouter to the AI model providers named in Section 4, in the United States. Sections 1, 2.2, 4 and 5 give the details.

What changed in version 1.2 (effective 2026-10-16). From the day we switch it on, the AI employees in our own workspace to which a person gave one of our addresses read your whole e-mail (except the kinds we never keep), may mark it and sort it into our folders, and may draft a reply; a person at Vezoft reviews, edits and sends every reply, and no AI employee sends e-mail. Your e-mail then also goes, as prompt content, through OpenRouter to the AI model providers named in Section 4, in the United States. When our mail account is switched on, and each time an address is given to an AI employee, the e-mail of the last 30 days in our Inbox is included. In TimerOS the text, the recipients and the attachments of your e-mail are kept encrypted and are deleted after 90 days, with your address and name and the subject; your e-mail domain and the date are kept for a year. Sections 1, 2.1, 4 and 5 give the details.

What changed in version 1.1 (effective 2026-10-16). From the day we switch it on, when you write to one of our own e-mail addresses, such as [email protected] or [email protected], TimerOS may make a short summary of your e-mail with an AI model. The summary is for the AI employees in our own workspace, which never read your e-mail itself and never answer it; a person does. Sections 1, 2.1, 4 and 5 give the details: what is summarised and what is not, the US transfer to OpenRouter and Anthropic, and how long it is kept.

This Privacy Policy explains how Vezoft EOOD ("Vezoft", "TimerOS", "we", "us"), a single-member limited liability company incorporated in Bulgaria that operates the TimerOS service (the "Service"), processes personal data when you visit our website, register an account, or use the Service. See the Imprint for our full company details. It is written to satisfy the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), and the comprehensive state privacy laws of Colorado, Connecticut, Utah, Virginia, Texas, and Oregon. It also describes how the on-device AI activity classification feature works, as required by Article 50 of the EU AI Act.

If something here conflicts with a separate written agreement between TimerOS and your employer (the "Customer DPA"), the Customer DPA prevails for processing of employee personal data.

---

1. Who we are, and the two roles we play

TimerOS plays one of two roles depending on whose data is involved.

Controller role. We are the controller of personal data we collect directly: visitors to our website, people who sign up for an account, and people who contact us by email. When you write to one of our own e-mail addresses, the AI employees in our own workspace may also read your e-mail and draft a reply that a person sends (Section 2.1). When you open a support ticket with us from your TimerOS account, the AI employees hired as support engineers in our own workspace may also read it and draft a reply that a person sends (Section 2.2).

Processor role. When a Customer (an employer or contractor) uses TimerOS to track its employees, contractors, or clients, the Customer is the controller of that personal data and TimerOS is the processor. We process that data only on the Customer's documented instructions, as set out in the Customer Data Processing Agreement. If you are an employee of a TimerOS Customer and want to exercise your data rights about your time-tracking data, contact your employer first — they hold the controller obligations. We will help them respond.

---

2. What we collect, why, and the legal basis

2.1 When you visit the website or download an application

AI employees and e-mail to our own addresses. This applies only from the day we switch it on, and only if a person in our own workspace has given one of our addresses to an AI employee. TimerOS then reads the new mail that arrives at that address and, when our mail account is switched on and each time the address is given to an AI employee, the mail of the last 30 days in our Inbox, read or unread. It never reads older mail.

Mail TimerOS holds back. TimerOS recognises some mail by words in it, also in the text of plain-text attachments. The mail is held back if it is:

• from or about a job applicant;
• about pay or invoices;
• about a contract or another legal matter;
• a request about personal data, including a request to exercise your rights.

Such mail is never summarised and never shown to an AI employee. Of such mail TimerOS keeps only your e-mail domain, the date, the address you wrote to, the headers that mark bulk mail and whether it is read, answered or marked important. Where the words miss such a mail, the AI model that writes the summary may recognise it instead, and TimerOS then deletes the text and does not show it to any AI employee. By then, though, the model will have read it; no AI employee will have, because TimerOS shows an AI employee a mail only after this check. A mail the model could not check is never shown to an AI employee. A person can also move a mail into our People, Finance or Legal folder, and an AI employee can hand a mail over to them the same way; TimerOS then deletes its text, its subject and your address and name — at once when an AI employee does it, at its next check of the mailbox when a person does.

What an AI employee does with your e-mail. For other mail, an AI employee that holds the address reads your whole e-mail: your address and name, the other recipients, the subject, the date, the text and the list of attachments, with the text of plain-text attachments. It reads no PDF or other attached file. It can mark your e-mail read or important and, except on the mail account that our support inbox also reads, move it between our folders; it never deletes it. It can draft a reply, which goes only to you and to people already on the thread. A person at Vezoft sees your e-mail beside the draft, can change anything in it, and sends it from our address, or rejects it. No AI employee sends e-mail. What the AI employee reads goes, as prompt content, through OpenRouter to the AI model provider that runs it (Section 4), in the United States, with no training on it and no retention after answering. It is also in the record of the AI employee's work sessions on its computer at Hetzner (EU) until 30 days after that session's last activity. The AI employee is instructed never to copy your words, name or address into its memory.

How a summary is made. TimerOS still makes a short summary, for the list of mail and to check, before any AI employee sees your e-mail, that it is not one TimerOS holds back. Vezoft's fleet service (Hetzner, EU) sends Anthropic four things through OpenRouter, both in the United States:

• the subject;
• the whole text, with the text of plain-text attachments: all the text an AI employee may read of your e-mail, so that none of it goes unchecked;
• your e-mail domain, never your address or name;
• the kind of mail TimerOS sorted it into, such as a client's mail or a newsletter.

Anthropic writes a summary of at most 300 characters. The summary is written without naming anyone, and e-mail addresses, links and phone numbers are removed from it. Anthropic does not train on your e-mail or keep it.

How it is kept. In TimerOS, the text, the recipients and the attachments of your e-mail are kept encrypted; your address and name and the subject are kept unencrypted, so that the list of mail can show them. All of it is deleted after 90 days. The text, subject and recipients of a reply are kept in our approval records for 90 days after a person sent or rejected it (an address our mail service refused stays in the record); the reply itself is in our Sent folder at Zoho, with the rest of our mail. Your e-mail stays in our mailbox.

Objecting. You can object at any time by writing to [email protected] (Section 7). We will then delete what TimerOS has kept of your e-mail. We will also delete your later e-mail from TimerOS when it arrives.

We do not use Google Analytics, Meta Pixel, HubSpot, Mixpanel, Segment, or any other third-party analytics on our public website at the date above. If that changes we will update the Cookie Policy and this section, and add a consent mechanism where required.

2.2 When you register a TimerOS account

AI employees and support tickets. This applies only from the day we switch it on. An AI employee hired as a support engineer in our own workspace can list and read the support tickets you open with us: the ticket's number, title, status, priority and category, your workspace's name and your name, and the messages in it — yours and our support team's — but never your e-mail address. It changes nothing on a ticket. It can draft a reply: a person on our support team sees your ticket beside the draft, can change anything in it, and sends it, or rejects it; the reply reaches you as that person's reply, on the ticket and by e-mail, under their name. No AI employee sends anything. A ticket whose words show that it is from or about a job applicant, about pay, payroll or salaries, about a contract or another legal matter, or a request about personal data, including a request to exercise your rights, is never shown to an AI employee; a billing question is. What the AI employee reads goes, as prompt content, through OpenRouter to the AI model provider that runs it (Section 4), in the United States, with no training on it and no retention after answering. It is also in the record of the AI employee's work sessions on its computer at Hetzner (EU) until 30 days after that session's last activity. The draft, what the person sent and who sent it are kept in our approval records. You can object at any time by writing to [email protected] (Section 7).

2.3 When you use TimerOS as an employee of a TimerOS Customer

When you are an employee, contractor, or worker of a TimerOS Customer, that Customer is the controller of your personal data. You may interact with the Service through any of its surfaces — the desktop application, the web application, the Android companion application (a review / management dashboard), or the per-tenant client portal — but automatic activity tracking and the activity classifier run only on the Windows desktop application; the other surfaces only display and manage data the desktop has already produced (and data you or your manager enter manually).

TimerOS processes the following on the Customer's instructions:

The locally-processed data is read in memory, fed into the classifier (a scored rule engine combined with a small on-device statistical classifier — no cloud AI service, no model download, no large language model, no network call), discarded, and never sent to TimerOS servers or to any third party. Only the resulting activity status (one of: productive, idle, break, overtime, off_work, offline) and the aggregate hours-per-bucket totals are sent to the Customer's workspace.

TimerOS does not take screenshots, record the screen, capture keystrokes, record audio or video, read your browsing history or your bookmarks, or transmit the names of the applications, windows, or website domains you use.

How the website domain is obtained, precisely. Where the condition in the table above is met, the desktop app asks the browser for the address of the tab in front of you — through the operating system's accessibility interface, not from the title bar — and immediately reduces it to the site name and, where it reads as a word rather than an identifier, the first section of the path. The deeper path, the query string and the fragment are dropped at that moment: they are never classified, never stored, and never transmitted. Browser-internal pages and local files are rejected before anything is extracted. What is kept is discarded after classifying the site.

2.4 When you are a client of a TimerOS Customer using the Client Portal

2.5 Manual and edited time entries

Time entries are not exclusively produced by the timer. Either the employee or an authorised manager may create a time entry manually (for example, to record work performed offline) or edit an existing time entry (for example, to correct a wrong project assignment, a missed clock-out, or an inaccurate duration).

• Audit log. Every create, edit, and deletion of a time entry is recorded in an append-only audit log capturing who made the change, when (UTC timestamp), and the full before/after state of the affected fields. The audit log is append-only — no TimerOS interface (UI or API) can edit or delete an entry; this is enforced at the application and database layer.
• Visible "Edited" badge. Time entries that have been manually created or subsequently edited are displayed in the desktop app, the Customer's dashboard, and the Client Portal with a visible "Edited" badge, so reviewers can distinguish them from timer-captured entries.
• GDPR basis. This mechanism supports the accuracy principle in GDPR Art. 5(1)(d) (personal data must be accurate and, where necessary, kept up to date) and the right to rectification under GDPR Art. 16 (you can request correction of inaccurate personal data). If you are an employee and you believe a time entry about you is inaccurate, ask your employer to correct it; the corrected entry will carry the "Edited" badge and the change will be visible in the audit log.
• Retention. The audit log for a time entry is retained for the same statutory period as the underlying payroll record (see Section 6), so that the evidentiary trail for any pay calculation remains intact for as long as the payroll record itself.

---

3. About the AI activity classifier (EU AI Act Art. 50 notice)

The TimerOS desktop app includes an on-device AI feature that gives your current foreground activity one of two labels — "productive" or "idle" — together with a confidence score. The desktop timer then uses that label, together with how long you have been idle and your shift schedule, to decide how the time shows up on your timesheet — as productive, idle, break, overtime, or off-work time. When the desktop timer is not running, your activity status is recorded as "offline". This notice tells you how it works.

• Where it runs. Entirely on your device. We do not send your window titles, application names, or website domains to any cloud AI service. The classifier consists of (a) a scored rule engine that matches application names, window-title substrings, and — for supported browsers, subject to the condition in Section 2.3 — the active tab's website domain against built-in lists of well-known work and non-work apps and websites and against any rules your employer has defined, combining signals such as application match, title match, website-domain match, and overlap with your assigned project, task, and job-title keywords; and (b) optionally, a small on-device statistical classifier whose weights are included with the desktop installer (a few tens of kilobytes, not a multi-gigabyte language model). No cloud AI service, no model download, no large language model. This is a deliberate privacy upgrade over earlier designs that contemplated a locally-running large language model: the current architecture removes the entire class of risks associated with shipping or downloading a multi-gigabyte generative model, removes any local inference server, and removes any background process that touches your activity data. We maintain a model card and an EU AI Act applicability assessment for the classifier, available to competent authorities on request.
• What it sees. The title of the currently-foreground window, the name of the running application, and — for supported browsers, subject to the condition in Section 2.3 — the domain of your active browser tab and the first section of its path (e.g. nova.bg, console), at the moment of classification. It does not see the contents of files, the body of emails, your stored browsing history or bookmarks, or anything you type. It obtains the tab's address from the browser in order to reduce it to that domain and path section; the rest of the address is dropped at the moment of reading and is never classified, stored, or transmitted.
• What it outputs. The classifier itself produces a binary label ("productive" or "idle") and a confidence score (0–1). The desktop timer then maps that binary label, together with idle-time and your shift, into one of six activity-status values stored on the TimerOS servers as the activity_status field of your employee record: productive, idle, break, overtime, off_work, or offline. The field is overwritten each time the status changes. Past labels are not stored as a log; only the current status plus aggregated hour totals are persisted.
• What it is not. The classifier is not an automated decision-making system in the sense of GDPR Art. 22. The classifier does not, by itself, produce any decision affecting your employment, pay, discipline, or promotion. The Terms of Service require Customers to make those decisions through human review of broader evidence. Under EU AI Act Art. 6(3), TimerOS positions this classifier as a system that performs a "narrow procedural task" (mapping a window title to one of a finite set of labels) and is not "high-risk" within the meaning of Annex III.
• Human oversight. You and your employer can override any classification through the timer bar. Classifications can be reviewed and corrected at any time, and your corrections are stored only on your device. In the desktop app's Settings → Activity Detection → Tracking mode you can switch to Rule-based (AI/ML layer off, rule engine alone) or Manual (no automatic classification — you set your own state). The rule engine is deterministic for a given installed version, so the same activity always receives the same classification.
• Accuracy and limitations. The classifier is approximate. For example, a Stack Overflow tab you are reading may be labelled "idle" because you are not typing or clicking, even though you are doing real work. Both you and your employer should treat the labels as indicative, not exact.

If you have questions about how the classifier handled a specific period of time, email [email protected].

---

4. Who we share data with

We share personal data only with the following categories of recipients, and only as needed:

iOS / Apple distribution is planned but not yet active; Apple is not currently an active sub-processor.

A complete and current list is at /legal/subprocessors. The Customer DPA grants Customers the right to object to new sub-processors with 30 days' notice. AI assistant providers that a user connects to their own account through the TimerOS connector (Section 4A) are not listed here because they are not our sub-processors: the user, not Vezoft, engages them.

We do not sell personal data (CCPA/CPRA definition) and we do not share personal data for cross-context behavioural advertising.

---

4A. Connected AI assistants

What the feature is. If you have a TimerOS account, you may connect an AI assistant of your choice (for example Claude, made by Anthropic) to that account through the TimerOS connector — a Model Context Protocol (MCP) server that we host at https://api.timeros.ai/mcp. To connect, you sign in to TimerOS from the assistant (with your password and, where enabled, your two-factor code) and approve, on a consent page that names the assistant and the workspace, the access it asked for — read only, or read and write — and, as a separate ticked checkbox you may untick, work on your incidents and change requests. From then on, when you ask it to, the assistant can read your work — projects, tasks, teams, people, goals, clients, invoices, expenses, and the profit report — and, with the wider scope, create and update projects, tasks, subtasks, task notes, and operating expenses, and attribute your own unassigned tracked time to your tasks. Nothing is connected unless you complete these steps yourself.

When data leaves TimerOS, and how much. Data is disclosed to the assistant provider only in response to a request from the assistant you connected, under your authorisation, and limited to the scope you approved and to what you can already see in TimerOS. Every request runs through the same routes, guards, and permissions that apply to you in the desktop and web applications, so the assistant can never see more than you can, and it cannot reach another workspace. Pay, salaries, tax identifiers, dates of birth, home addresses, and emergency contacts are stripped from every response. The connector has no tools for deleting anything; for logging or editing time (beyond attributing your own already-tracked, unassigned minutes to your tasks); for setting budgets or rates; for creating or sending invoices; or for editing clients or employees — and it never assigns people to projects or tasks. Incidents and change requests are covered by a further scope that you consent to separately: on the consent page it appears as a checkbox, which you may untick to connect without it. If you leave it ticked, the assistant can read your workspace's incidents and change requests — including the titles, descriptions, and comments your clients wrote in the Client Portal — add notes to them that are internal to your staff and are never shown to the client, assign them to employees, and, only after it has put a plan in front of you and you have approved it, resolve an incident or complete a change request. Those changes also require the read-and-write scope, so a read-only connection with the checkbox left ticked can read incidents and change requests but alter nothing. It still cannot read Client Portal chat, and text your clients wrote is passed to the assistant marked as data rather than as instructions. Vezoft does not run the assistant and performs no AI processing as part of the connector: the connector only answers the assistant's requests. It is unrelated to the on-device activity classifier described in Section 3.

The provider is your choice, not our sub-processor. You choose the assistant provider. It receives the data under its own terms and privacy policy; Vezoft has no contract with it and does not control what it does with the data. The provider is therefore not a Vezoft sub-processor and is not listed in Section 4 or on our sub-processor page, which lists the parties we engage — you, not we, engage the provider. Read the provider's terms before connecting. Any international transfer that results is made by you (or, where the Customer is the controller, on the Customer's responsibility) to the provider, not by Vezoft, so the safeguards described in Section 5 do not extend to it.

Where the Customer is the controller. If you use TimerOS as an employee or worker of a Customer (Section 2.3), the data the assistant can reach is Customer Personal Data, for which the Customer is the controller and we are the processor. The Customer decides whether its people may use this feature at all: a workspace owner or administrator can turn "Allow AI assistant connections" off for the whole workspace in Settings → Connections. Turning it off disconnects every live connection in that workspace immediately, blocks new ones, and the affected people are notified by email; the setting is on by default and applies to the whole workspace, not to individual people. The Customer is responsible for that decision, for the internal rules under which its people use the feature, and for its own assessment of the providers they connect. If you are unsure whether you may connect an assistant, ask your employer first.

What we store about each connection, and for how long. For each connection we store: the assistant's client identifier and name; the scope granted; timestamps (connected, last used, token expiry, revoked) and the reason it was revoked; a hash of the current refresh token and of the one it replaced (never the tokens themselves); and a journal of every change the assistant made — the tool used, the record it targeted, the values before and after the change, and the call that reverses it. Where the change was made to an incident or a change request, the entry identifies it by its ticket number rather than by the title your client wrote. A plan the assistant prepares for your approval (together with the values it would write) is stored until you apply it or it expires — 10 minutes after it is prepared — and is deleted automatically within about an hour after that. We keep these records to operate the connection, to show you what the assistant has done and let you undo it, and to secure your account. For your own account we are the controller of these records (legal basis: performance of the contract, Art. 6(1)(b), and our legitimate interests in account security, Art. 6(1)(f)); where the journal describes changes to a Customer's workspace data, we hold it for the Customer as processor. Access tokens issued to the assistant expire after 15 minutes; refresh tokens after 30 days, and each is replaced when used — a refresh token presented a second time disconnects that connection. Connection records are kept until you or an administrator disconnect the assistant; the connection is then marked revoked and retained as a revoked record under the general retention rules in Section 6.

Emails we send. We send you a transactional email each time a new assistant is connected to your account — it names the assistant and the scope and tells you where to disconnect it — and when an administrator turns the feature off for your workspace. These are security notices, not marketing.

Reviewing and disconnecting. In Settings → Connections in the desktop or web application you can see each connection (assistant name, scope, when it was connected and last used, and how many changes it has written), open its Activity list with the reversing call for each change, and Disconnect it with one click. Access stops on the assistant's very next request. You can disconnect even if your workspace's subscription has lapsed.

---

5. International transfers

If you are in the EU/EEA/UK and we transfer your personal data to a country that does not have an adequacy decision (typically the United States), we rely on the European Commission's Standard Contractual Clauses (Module 1 controller-to-controller, or Module 2 controller-to-processor as appropriate), supplemented by the EU-US Data Privacy Framework where the recipient is certified, technical measures (encryption in transit and at rest), and the contractual measures in our sub-processor DPAs.

For EU Customers, the database (MongoDB Atlas) and the application servers (Render) are deployed in EU regions, and uploaded files (Cloudflare R2) and EU business mailboxes (Zoho) are pinned to the EU. Transactional / system email (Lettermint B.V., a Netherlands entity) is processed entirely within the EU/EEA on Lettermint's own EU infrastructure, so no international transfer arises for the email payload — no EU-US Data Privacy Framework and no Standard Contractual Clauses are required for it. Two flows are genuinely processed in the United States, and both are covered by Standard Contractual Clauses: Android companion-app push notifications, delivered through Google's Firebase Cloud Messaging, which are also covered by the EU-US Data Privacy Framework; and e-mail sent to our own addresses (Section 2.1): its subject and text (until version 1.2 of this Policy, up to 8,000 characters of it) go through OpenRouter to Anthropic for a summary, and, from version 1.2 of this Policy, the whole e-mail an AI employee in our own workspace reads goes through OpenRouter to the model provider that runs that AI employee, as, from version 1.3 of this Policy, does a support ticket that an AI employee hired there as a support engineer reads (Section 2.2), all with zero-retention routing and no training. The AI employees that we operate for Customers also use model providers in the United States; that processing is described in the AI Employees Notice and on the Sub-processors page. Several of the other EU-resident providers are nonetheless US-incorporated entities (MongoDB, Render, and Cloudflare); for those, the SCCs + EU-US Data Privacy Framework still apply as a safeguard against potential US government access even though the data is processed in the EU. The applicable regions are stated in the Customer DPA, Annex 3.

---

6. How long we keep data

Retention varies by data type. The full retention schedule is in our Data Retention Policy and the key periods are reproduced in the table in Section 2 above. As a general rule:

• Operational data is kept for the duration of the relationship plus a 30-day grace period for recovery.
• Records required by tax, accounting, or other law are kept for the statutory period (typically 5–10 years).
• Security logs are kept for 12 months.
• Backups are kept for 30 days and then overwritten.

After expiry, data is hard-deleted (database documents are removed, files are removed from object storage, and the next-cycle backup no longer contains them).

---

7. Your rights

If we are a controller of your data, you have the following rights and you can exercise any of them by emailing [email protected].

Under GDPR / UK GDPR:

• Access (Art. 15): a copy of your personal data and information about how we use it.
• Rectification (Art. 16): correction of inaccurate data.
• Erasure (Art. 17): deletion, subject to limited exceptions (legal obligations, claims).
• Restriction (Art. 18): pause processing while a complaint is resolved.
• Portability (Art. 20): machine-readable export of data you provided. Email [email protected] and we will provide the export; a self-service export in Settings is planned.
• Objection (Art. 21): object to processing based on our legitimate interests.
• Withdraw consent (Art. 7(3)) where processing is based on consent — without affecting past lawful processing.
• Lodge a complaint with your local data protection authority. A list is at edpb.europa.eu/about-edpb/about-edpb/members_en. You do not need to contact us first.

Under CCPA/CPRA (California residents) and equivalent rights in CO, CT, UT, VA, TX, OR:

• Right to know what categories of personal information we collect, the purposes, the sources, and the categories of third parties with whom we share it.
• Right to access a copy of your personal information collected over the past 12 months.
• Right to delete your personal information, subject to limited exceptions.
• Right to correct inaccurate personal information.
• Right to opt-out of sale or sharing for cross-context behavioural advertising — we do not engage in either, but the right exists.
• Right to limit use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide the Service.
• Right to non-discrimination for exercising any of the above.

We respond to verifiable requests within 30 days under GDPR and within 45 days under CCPA (extendable once for 45 more days where reasonably necessary). To verify your identity we will match your request against the email on file; for sensitive requests we may ask for an additional factor.

If you are an employee of a Customer and your request concerns time-tracking data, please contact your employer first; we will support them in fulfilling your request.

---

8. Cookies and similar technologies

Our public website does not set non-essential cookies at the date above. We use localStorage to keep you logged in (an essential function). Full details are in the Cookie Policy.

---

9. Security

We take appropriate technical and organisational measures to protect personal data, including: TLS 1.2+ in transit; encryption at rest where the underlying provider offers it; per-tenant database isolation; bcrypt password hashing; AES-256-GCM encryption of 2FA secrets; access control via short-lived authentication tokens; principle of least privilege for staff access. The full set of measures is described in Annex 2 of the DPA.

No system is perfectly secure. If you suspect an incident, email [email protected]. Where we act as processor for a Customer, we notify that Customer without undue delay after becoming aware of a personal-data breach — and, under our DPA, within 48 hours (GDPR Art. 33(2)); the Customer, as controller, is then responsible for notifying the competent supervisory authority (Art. 33(1)) and, where required, the affected individuals (Art. 34). Where we are the controller (for our own account and website data), we notify the competent supervisory authority under Art. 33(1) and, where required, affected individuals under Art. 34.

---

10. Children

The Service is for businesses, sole-traders, and individual professionals (Freelancer tier) acting in a professional or business capacity, and their workers. It is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has registered, email [email protected] and we will delete the account.

---

11. Changes to this Policy

We will post the updated Policy at this URL and update the "Last updated" date. For material changes that affect a Customer's processing, we will notify the account owner by email at least 30 days before the change takes effect, as required by the DPA.

---

12. Quick contact summary

• Privacy / data subject requests: [email protected]
• Security incidents: [email protected]
• General questions: [email protected]
• Postal: Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address)
• EU Representative: Not required — Vezoft is established in Bulgaria (EU Member State).