Privacy Policy
This Policy explains what personal data Time Assistant (“we”, “the Service”) collects, why, and what your rights are. We comply with the EU General Data Protection Regulation (GDPR) and Serbian data protection law.
1. Data controller
The controller is Time Assistant (legal entity being registered — to be updated). For privacy questions and data requests, contact:
2. What we collect
| Category | Data |
|---|---|
| Account | Email address, password (stored hashed), chosen language. |
| Work time | Dates, hours, projects, overtime, leave and notes you enter. |
| Settings | Timezone, work days, reminder times, hourly rate (optional), format. |
| Telegram | Your Telegram user ID (when you link the bot). |
| Integrations (optional) | Google Drive OAuth token and Clockify API key — only if you connect them. |
| AI usage | Usage records (calls/tokens) for limits and billing. |
| Billing | Redeemed codes/licenses and plan status (payments are handled by Gumroad/Throne, not us). |
We do not collect data for advertising and do not track your behaviour off the Service.
3. Why and on what basis
- Contract performance — to provide the service (account, entries, reports). (Art. 6(1)(b) GDPR)
- Consent — for optional integrations (Google Drive, Clockify) and for sending your message text to the AI parser. You can withdraw consent at any time. (Art. 6(1)(a))
- Legitimate interest — security, abuse prevention and basic operational analytics. (Art. 6(1)(f))
4. Processing by third parties (processors)
We use trusted service providers that process data on our behalf:
| Service | Purpose | Location note |
|---|---|---|
| Contabo (hosting) | Server and database | Germany (EU) |
| Cloudflare | CDN / security / proxy | Global (US) |
| Telegram | Bot messaging | Outside EU |
| DeepSeek | AI text parsing (Pro) | China — see section 6 |
| Google (Drive) | Writing entries to your Drive (optional) | US |
| Clockify (CAKE.com) | Time sync (optional) | Outside EU |
| Gumroad / Throne | Subscription payments | US |
5. AI parser and your messages
On the Pro plan, the text you send (e.g. “8h Birn”) is sent to DeepSeek to understand and turn it into an entry. Only the message text and your project names are sent — not your email, password or other personal data. On the Free plan, parsing is local (nothing is sent to the AI). If you don't want your text sent to the AI, use the Free plan.
6. International transfers
Some processors are outside the EU (e.g. DeepSeek in China, Google/Cloudflare in the US). Where applicable, we rely on standard contractual clauses and data minimisation (we only send what's necessary). EU users who want to avoid transferring message content outside the EU can use the Free plan (no AI).
7. Data retention
We keep your data while you have an account. When you delete your account or request deletion, we erase your data within a reasonable period, except what we must keep by law (e.g. billing records). We delete Google/Clockify tokens as soon as you disconnect the integration.
8. Your rights (GDPR)
- Access to your data and a copy
- Rectification of inaccurate data
- Erasure (“right to be forgotten”)
- Restriction of, or objection to, processing
- Data portability (TXT/CSV/JSON export is available in the app)
- Withdraw consent at any time
Send requests to [email protected]. You also have the right to lodge a complaint with a supervisory authority — your national data protection authority in the EU.
9. Security
Passwords are stored hashed, traffic uses HTTPS, and access to data is restricted. No system is 100% secure, but we take reasonable protective measures.
10. Children
The Service is not intended for anyone under 16.
11. Changes
We may update this Policy; the date at the top shows the latest version. We will highlight material changes.
See also: Terms of Service · Cookie Policy