Legal & Compliance

Client Portal — Privacy Notice

Effective date: 2026-10-19Last updated: 2026-10-19Last reviewed: 2026-10-19

What changed in version 1.3 (2026-10-19). A correction, not material: a message that a person on the Supplier's team posts to you in Messages from an AI employee's draft is that person's message and is not marked as drafted by an AI employee; the sentence of version 1.2 that said otherwise is removed. Nothing else changes.

What changed in version 1.2 (2026-10-19). The paragraph on AI employees in "Who is responsible for your data" now also covers Messages: from the day Vezoft switches it on, an AI employee on your project, once the Supplier has opened that project to AI work, may read your conversation with the Supplier's team in Messages — the last 50 messages you can see, with the name of whoever wrote each — and draft a message to you, which a person on the Supplier's team reviews and posts under their own name; a message posted from such a draft is marked "drafted by (AI employee)". No AI employee posts anything to you. Those messages are processed by AI model providers in the United States. Nothing else changes.

What changed in version 1.1 (2026-10-07). A paragraph on AI employees is added to "Who is responsible for your data": the Supplier's AI employees may read your project's whiteboard (including what you added and your comment on a version), the files you upload to a project (with the uploader's name), a proposal's name and description and, if the Supplier allows it, your company details; that content is processed by AI model providers in the United States. Nothing else changes.

This notice applies to people who access the TimerOS Client Portal as a client of a TimerOS Customer (the "Supplier"). The Client Portal is the web app where you, as a client of the Supplier, can see project status, invoices, support tickets, and shared documents.

It is shorter than the main Privacy Policy because your relationship is primarily with the Supplier, not with us.

Who is responsible for your data

Two roles apply. The Supplier (your business contact who invited you) is the controller of the business data shown to you in the portal — projects, invoices, support tickets, documents — for which TimerOS acts as processor under contract with the Supplier. Separately, TimerOS (Vezoft) is the controller of the thin authentication layer that lets you log in — your email, name, hashed password, session tokens, and session IP — which we process to authenticate you and keep the portal secure. Our legal basis for this authentication and security processing is our legitimate interests (GDPR Art. 6(1)(f)) in operating a secure portal.

If you want to:

  • Access, correct, or delete your portal account and login details (email, name, password, session data): contact TimerOS at [email protected] — we are the controller of that data.
  • Stop using the portal: ask the Supplier to deactivate your account (the Supplier decides who has access).
  • Make a GDPR or CCPA request about the project or business data shown to you: contact the Supplier; they are the controller of that data.

For account-security incidents (e.g. you think your portal account was compromised) you may also email TimerOS at [email protected].

AI employees. The Supplier may use AI employees — software agents that Vezoft operates on the Supplier's behalf (see the AI Employees Notice). An AI employee on your project may read the project's whiteboard, including what you added to it and the comment you wrote when approving or rejecting a version, without being told who added or decided anything; the files you upload to the project through the portal, with the name of the person who uploaded each one; and the project's name and description as you entered them in a proposal, until the Supplier changes them. If the Supplier gives it read access to its client records, it also sees the company details you can edit in the portal, such as your company's name, website, e-mail address, industry and time zone. Since version 1.2 of this notice, and from the day Vezoft switches it on, an AI employee assigned to your project, once the Supplier has opened that project to AI work, may also read your conversation with the Supplier's team in Messages: the last 50 messages you can see — yours and the team's — with the name of whoever wrote each, never the team's internal notes. It can draft a message to you there, but it never posts one: a person on the Supplier's team reads the draft, may change it, and posts it under their own name, as their own message. That content is sent to, and processed by, the AI model providers in the United States listed on our Sub-processors page, under the transfer safeguards described there. The Supplier is the controller of that content, and TimerOS processes it on the Supplier's behalf.

What we collect about you

Only what's needed to authenticate you and operate the portal:

  • Email, name, hashed password (stored using bcrypt, an industry-standard salted one-way hash), refresh tokens.
  • Records of pages you visit in the portal and timestamps, for security and to show you "what's new."
  • IP address of each session (12-month retention).

We do not track your activity outside the portal. We set no third-party cookies.

How long we keep it

  • Portal account and authentication data (your email, name, hashed password, and refresh tokens): kept for as long as your portal account is active. When the Supplier deactivates your account, we delete or anonymise this data within 90 days, except where a longer period is required to comply with a legal obligation or to establish, exercise, or defend legal claims.
  • Session IP addresses: retained for 12 months (as noted above), then deleted.
  • Project and business data shown to you is controlled and retained by the Supplier, not by TimerOS; ask the Supplier about its retention practices.

What the Supplier may share with you in the portal

The Supplier controls what you see. Typically:

  • Project status, milestones, deliverables.
  • Invoices and payment status.
  • Support tickets you have raised.
  • Documents the Supplier has marked customer-visible.
  • The first name and role of the team members assigned to your projects.

The Supplier does not share with you, through the portal, its employees' productivity scores, internal cost data, salaries, internal notes that are not marked customer-visible, or activity classification labels. If you believe the portal is exposing data it should not, email [email protected].

Your rights

The full set of GDPR and CCPA rights described in the main Privacy Policy applies to you for your portal account information (TimerOS as controller of that thin layer of data). For the business data shown to you in the portal, address those rights to the Supplier.

Contact