Privacy Policy

B217 LLC ("Timsio", "we", "us", or "our") provides the Timsio time-tracking, invoicing, and payments platform (the "Service"). This Privacy Policy explains how we handle personal information when you use the Service and visit our websites.

For personal information about you as a Timsio account holder, we act as a controller. For personal information you put into the Service about your own team members and Clients, you are the controller and we act as your processor, handling that data on your behalf and on your instructions.

We collect the following categories of information:

• Account and identity data — your name and email address, a securely hashed password, and, if you sign in with Google or Microsoft, the identifiers those providers share with us. We never see your password in plain text.
• Organisation and team data — your organisation, team memberships, and roles (such as owner, admin, manager, member, or contractor).
• Product data you enter — the content you create in the Service, such as clients, projects, tasks, time entries, invoices, expenses, and uploaded receipts.
• Integration data — when you connect a calendar, meeting, or chat service (Google Calendar or Chat, Microsoft Outlook or Teams, or Zoom), we access the data needed to provide that integration, such as event titles, times, and participants. You control which integrations are connected.
• Payment and billing metadata — when you subscribe, our Merchant of Record, Paddle, processes your payment. We receive billing metadata such as your plan, subscription status, billing country, and transaction identifiers. We do not collect or store your full payment-card number.
• Usage, device, and log data — information about how you use the Service, such as pages and features used, IP address, browser and device type, and diagnostic and log data.
• Support communications — the messages, and any screenshots or attachments, you send us when you contact support.

We use personal information to:

• provide, operate, secure, and improve the Service;
• create and manage your account and organisation, and authenticate you;
• process your subscription and support billing through our Merchant of Record;
• provide features you use, including integrations and AI-assisted timesheet suggestions;
• respond to your requests and provide customer support;
• send you service, security, and transactional messages, and — where permitted — product updates you can opt out of;
• monitor, detect, and prevent fraud, abuse, and security incidents; and
• comply with legal obligations and enforce our terms.

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for.
• Legitimate interests — to secure, maintain, and improve the Service and to prevent fraud and abuse, in a way that is balanced against your rights.
• Consent — for optional features such as connecting an integration, non-essential cookies, and certain marketing. You can withdraw consent at any time.
• Legal obligation — to comply with laws that apply to us, such as tax and accounting rules.

If you use our AI-assisted features, data from your connected calendar, meeting, and chat activity may be processed to suggest timesheet entries. These features produce suggestions only and never log time automatically.

Before any content is sent to a third-party AI provider (Google's Gemini models), it passes through a sanitisation step that removes sensitive content — such as meeting bodies and full external-attendee details — so that only the minimum needed for a suggestion is shared. We do not use one organisation's data to generate suggestions for another organisation.

You control these features through your privacy settings, including the ability to reduce what data is used or to opt out. An organisation can set a privacy level that applies to its members.

We do not sell your personal information. We share it only as needed to run the Service, with service providers ("sub-processors") who act on our behalf under contract, and as required by law. Our key sub-processors are:

• Paddle — payments and Merchant of Record (subscription billing, invoicing, and tax).
• Railway — cloud hosting and managed databases (United States region).
• Amazon Web Services (Amazon S3) — file storage for receipts, invoice PDFs, and logos.
• Zoho — transactional email delivery.
• New Relic — application monitoring, performance, and error telemetry.
• Google — sign-in (OAuth), the Calendar and Chat integrations, and the Gemini AI models used for calendar suggestions, the in-product support assistant, and receipt scanning.
• Microsoft — sign-in (OAuth) and the Outlook and Teams integrations.

We may also share information to comply with the law or a valid legal request, to protect the rights, safety, and security of Timsio, our users, and the public, and in connection with a merger, acquisition, or sale of assets (in which case we will continue to protect your information under this Policy or notify you of any material change).

We operate globally, and our providers — including our hosting in the United States — may process your information in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards recognised under applicable law, such as the European Commission's Standard Contractual Clauses, and take steps to ensure your information remains protected.

We use strictly necessary cookies to keep you signed in and to protect the Service — for example authentication and security (CSRF) cookies. These are essential and are always on.

For any non-essential cookies, such as analytics, we ask for your consent through a cookie banner, and they stay off unless you accept. You can change your choice at any time by clearing the stored preference in your browser.

We keep personal information for as long as your account is active and as needed to provide the Service. When you delete data or close your account, we use a soft-delete followed by a grace period of about 30 days, after which the data is permanently purged, except where we must keep it longer.

Some data is kept longer where the law requires it or for legitimate business needs — for example, financial and tax records such as invoices and receipts may be retained for up to 7 years. Encrypted backups are retained on a rolling schedule (generally up to 90 days) and then rotated out.

Depending on where you live, you may have some or all of the following rights over your personal information:

• access — obtain a copy of the personal information we hold about you;
• portability and export — the Service includes a data-export feature so you can download your data;
• correction — ask us to correct inaccurate or incomplete information;
• deletion — ask us to delete your personal information;
• objection and restriction — object to or ask us to restrict certain processing;
• withdraw consent — where we rely on consent, withdraw it at any time; and
• non-discrimination — we will not treat you unfairly for exercising these rights.

You can exercise many of these rights directly in the Service, or by contacting us at support@timsio.com. We will respond within the time required by applicable law. If we act as a processor for data your organisation controls, we will refer your request to that organisation. You also have the right to complain to your local data-protection authority.

We use technical and organisational measures designed to protect your information, including encryption in transit (TLS), encryption at rest for sensitive tokens and secrets, HttpOnly authentication cookies, strict per-organisation data isolation, access controls, and audit logging of security-sensitive actions.

No system is completely secure, so we cannot guarantee absolute security. Please help protect your account by using a strong, unique password and keeping your credentials confidential.

The Service is intended for business use by professionals and is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, for example by email or an in-app notice. The "Effective date" at the top of this page shows when the current version took effect.

If you have questions about this Policy or how we handle your information, or you wish to exercise your rights, contact B217 LLC at support@timsio.com, or by post at New Jersey, USA. This address also reaches the person responsible for data protection at Timsio.