Legal & Compliance

Client Portal — Privacy Notice

Effective date: 2026-05-28Last updated: 2026-06-30Last reviewed: 2026-06-30

This notice applies to people who access the TimerOS Client Portal as a client of a TimerOS Customer (the "Supplier"). The Client Portal is the web app where you, as a client of the Supplier, can see project status, invoices, support tickets, and shared documents.

It is shorter than the main Privacy Policy because your relationship is primarily with the Supplier, not with us.

Who is responsible for your data

Two roles apply. The Supplier (your business contact who invited you) is the controller of the business data shown to you in the portal — projects, invoices, support tickets, documents — for which TimerOS acts as processor under contract with the Supplier. Separately, TimerOS (Vezoft) is the controller of the thin authentication layer that lets you log in — your email, name, hashed password, session tokens, and session IP — which we process to authenticate you and keep the portal secure. Our legal basis for this authentication and security processing is our legitimate interests (GDPR Art. 6(1)(f)) in operating a secure portal.

If you want to:

  • Access, correct, or delete your portal account and login details (email, name, password, session data): contact TimerOS at [email protected] — we are the controller of that data.
  • Stop using the portal: ask the Supplier to deactivate your account (the Supplier decides who has access).
  • Make a GDPR or CCPA request about the project or business data shown to you: contact the Supplier; they are the controller of that data.

For account-security incidents (e.g. you think your portal account was compromised) you may also email TimerOS at [email protected].

What we collect about you

Only what's needed to authenticate you and operate the portal:

  • Email, name, hashed password (stored using bcrypt, an industry-standard salted one-way hash), refresh tokens.
  • Records of pages you visit in the portal and timestamps, for security and to show you "what's new."
  • IP address of each session (12-month retention).

We do not track your activity outside the portal. We set no third-party cookies.

How long we keep it

  • Portal account and authentication data (your email, name, hashed password, and refresh tokens): kept for as long as your portal account is active. When the Supplier deactivates your account, we delete or anonymise this data within 90 days, except where a longer period is required to comply with a legal obligation or to establish, exercise, or defend legal claims.
  • Session IP addresses: retained for 12 months (as noted above), then deleted.
  • Project and business data shown to you is controlled and retained by the Supplier, not by TimerOS; ask the Supplier about its retention practices.

What the Supplier may share with you in the portal

The Supplier controls what you see. Typically:

  • Project status, milestones, deliverables.
  • Invoices and payment status.
  • Support tickets you have raised.
  • Documents the Supplier has marked customer-visible.
  • The first name and role of the team members assigned to your projects.

The Supplier does not share with you, through the portal, its employees' productivity scores, internal cost data, salaries, internal notes that are not marked customer-visible, or activity classification labels. If you believe the portal is exposing data it should not, email [email protected].

Your rights

The full set of GDPR and CCPA rights described in the main Privacy Policy applies to you for your portal account information (TimerOS as controller of that thin layer of data). For the business data shown to you in the portal, address those rights to the Supplier.

Contact