Zum Inhalt springen

Datenschutzerklärung (Webapp)

Für timelit.app

Last Updated: 26.10.2026
Version: 2.2
Effective Date: 26.10.2026

1. Introduction

1.1 About This Privacy Policy

This Privacy Policy ("Policy") explains how timelit ("we", "us", "our", "Service") collects, uses, processes, stores, and protects your personal data when you use our AI-powered business automation platform available at timelit.app.

This Policy is designed to comply with:

  • the General Data Protection Regulation (GDPR) (EU) 2016/679, and
  • applicable national data protection laws in the European Union, in particular Austrian law.

This Privacy Policy is information provided under Articles 13 and 14 GDPR. It is not a contractual term and not a consent. By using timelit, you acknowledge that you have read and understood it.

Where we process personal data on behalf of a customer, the contractual basis is the Data Processing Agreement, not this Policy. Section 1.2 explains which processing that covers.

1.2 Controller Information

Data Controller

Name: cronio FlexCo

Registered Address: Eileen-Gray-Gasse 2/24, 1220 Vienna, Austria
Commercial Reg. Nr: FN 669759s
Email (General): support@timelit.ai
Email (Data protection): support@timelit.ai

Our role differs depending on the data

Data Our role Basis
Customer Content: mailbox content and attachments, calendar entries, contacts, meeting audio and transcripts, prompts, uploaded files and AI outputs, automations and memories, data from connected apps and calendars of other providers, data that visitors enter on a booking page, and the summaries, categorisations and embeddings derived from them Processor on behalf of the customer Data Processing Agreement, incorporating the EU standard contractual clauses under Article 28(7) GDPR
Account Data: account and identity records, subscription and billing data, product telemetry, security and audit logs, abuse prevention Independent controller This Policy

Where we act as a processor, the customer, normally your employer or the organisation that issued your Microsoft Work or School account, is the controller. It determines the purposes and means of the processing and the legal basis for it. Requests to exercise your rights in relation to Customer Content should be addressed to that organisation; if you send them to us, we forward them without undue delay and do not answer them ourselves.

Where we act as an independent controller, the legal bases are set out in Section 4.

1.3 Data Protection Officer (DPO)

At the time of this Policy, cronio FlexCo is not required to appoint a Data Protection Officer under Article 37 GDPR.

If you have any questions regarding data protection, you can contact us at: support@timelit.ai

1.4 EU Representative (GDPR Article 27)

cronio FlexCo is established in the European Union (Austria). An EU representative under Article 27 GDPR is therefore not required.

2. Scope and Applicability

2.1 What This Policy Covers

This Policy applies to personal data processed when you:

  • register for and sign in to timelit using your Microsoft Work or School account
  • use our Service through timelit.app
  • connect your Microsoft 365 data via Microsoft Graph API
  • use AI-powered features (drafting, summarization, categorization, knowledge search, automations)
  • connect third-party apps or calendars of other providers (Sections 3.3.3 and 3.3.4)
  • book a meeting on the booking page of a timelit user (Section 3.6)
  • interact with our support (e.g., via email)

It specifically covers personal data:

  • collected during registration and authentication
  • retrieved and processed through Microsoft Graph API
  • stored and processed in Microsoft Azure (Sweden Central region; Italy North for Azure OpenAI)
    • including Azure Cosmos DB, Azure Blob Storage (where used), and Azure Application Insights
  • processed by third-party service providers acting on our behalf (see Sub-processors)

2.2 What This Policy Does Not Cover

This Policy does not cover:

  • processing performed independently by Microsoft (e.g., Microsoft 365, Outlook, Teams, Microsoft Graph API) – see Microsoft’s own privacy documentation
  • processing performed independently by Azure OpenAI under Microsoft’s data processing terms
  • third-party websites or services linked from timelit
  • data you choose to share outside our Service (e.g., in other applications, messaging tools, or public channels)

2.3 Compliance with EU Regulations

This Privacy Policy is intended to ensure compliance with:

  • GDPR: Regulation (EU) 2016/679
  • ePrivacy Directive: Directive 2002/58/EC (and its national implementations)
  • EU AI Act: Regulation (EU) 2024/1689 (transparency and governance for AI systems)
  • Digital Services Act (DSA): Regulation (EU) 2022/2065, where applicable
  • Austrian and other applicable EU member state laws

3. Personal Data We Collect

3.1 Data You Provide Directly

3.1.1 Registration Data

When you register for timelit using your Microsoft Work or School account, we collect:

  • Email Address: your Microsoft 365 work/school email address
  • Name: your display name from the Microsoft account
  • User ID: Microsoft Graph user identifier (object ID)
  • Tenant ID: your organization’s Microsoft tenant ID
  • Registration Timestamp: date and time of first registration

Only business accounts (work or school) are supported; personal Microsoft accounts are not intended to be used with timelit.

3.1.2 Authentication Data

During Microsoft OAuth authentication, we receive and securely store:

  • Access Tokens: Microsoft OAuth access tokens
  • Refresh Tokens: Microsoft OAuth refresh tokens

Tokens are stored in our Azure database, which is encrypted at rest by the Azure platform with AES-256 using Microsoft-managed keys, and are transmitted only over TLS. You can revoke our access at any time in your Microsoft account or in your organisation's tenant.

  • Token Expiry: expiration timestamps for token management and automatic refresh
  • Granted Scopes: the Microsoft Graph API permissions you (or your tenant admin) consent to

When you connect a third-party app or a calendar of another provider, we store its sign-in (tokens, API key or, for iCloud, your Apple ID and an app-specific password) in encrypted form, delete it when you disconnect it or delete your account, and revoke it at the provider where possible.

3.1.3 User Preferences and Configuration

When you configure your account and features, we store:

  • Feature Preferences: which automation features are enabled/disabled (e.g., email drafting, meeting scheduling, meeting summaries, categorization, knowledge search)
  • Working Hours & Timezone: your configured working hours and timezone
  • Email Settings: categorization preferences, auto-draft settings, thresholds for automation
  • Meeting Settings: preferred meeting length, scheduling preferences, follow-up behavior
  • Knowledge Search Settings: semantic search preferences, filters, indexing options

These settings can be managed by each user in the timelit control dashboard.

3.2 Data We Collect Automatically

3.2.1 Communication Data (Email)

Through Microsoft Graph API, and based on the permissions you or your tenant admin grant, timelit processes and stores:

  • Full Email Content
    • Email body text (plain and/or HTML)
    • Subject lines
    • Conversation context / threads
  • Email Attachments
    • We store attachments (e.g., PDF, DOCX, PPTX, images) as needed to provide search, summarization, and knowledge features.
  • Email Metadata
    • Sender and recipient addresses
    • CC/BCC information
    • Timestamps
    • Read/unread status
    • Importance flags, categories, conversation IDs
  • Shared Mailboxes
    • If you or your tenant admin grant it, the content of shared mailboxes you have access to, for automations that use them

timelit stores email bodies and attachments as long as your account is active, to provide the promised functionality (drafting, search, summaries, knowledge graph).

3.2.2 Calendar Data

Through Microsoft Graph API, we process:

  • Calendar Events: titles, descriptions, locations
  • Meeting Invitations: invitation details, responses, recurrence rules
  • Attendees: names and email addresses of participants
  • Availability Information: free/busy status and working hours
  • Time Zone: calendar’s configured timezone

This data is used for features such as scheduling, daily briefings, and summarization.

3.2.3 Meeting Data

When you use meeting-related features (e.g., transcription, summarization), timelit processes:

  • Meeting Metadata: meeting title, participants, timestamps, duration
  • Transcriptions: text transcriptions of meeting audio
  • Meeting Summaries: AI-generated summaries, key topics, decisions, action items

There are two distinct paths, and they differ in what is stored and who processes it:

1. Microsoft Teams meetings. We retrieve the transcript that Microsoft has generated, through Microsoft Graph, after the meeting. timelit does not join the call and does not record audio. No audio file reaches us.

2. Audio you upload or record in the browser. The file is uploaded to our Azure Blob Storage and transcribed by Azure AI Speech with speaker diarization. Speaker diarization separates speakers within a recording; it does not create a voice template and is not used to identify anyone, so it is not biometric data within the meaning of Article 4(14) GDPR.

Retention of uploaded audio. These audio files are stored in our Azure environment (Sweden Central). You can remove a recording from the Service at any time. The stored audio file itself is not subject to a time-based expiry and is deleted when the account is deleted.

Transcriptions and summaries are stored in our Azure environment (Sweden Central).

3.2.4 Usage Data

We automatically collect usage data to operate and improve the Service, for example:

  • Service Usage Logs: feature usage (e.g., how often drafting or summarization is triggered), API calls, function executions
  • Performance Metrics: response times, error rates, throughput
  • Configuration Changes: changes to your settings and the time they were made
  • Session Data: sign-in events, last activity timestamp
  • Error Reports: error type, stack trace, application version, browser and device type, together with the identifiers of the signed-in user at the time of the error

Usage and performance telemetry is captured using OpenTelemetry and stored in Azure Application Insights (Sweden Central) with personal data minimized. Error reports are collected in a separate error tracking system that we operate ourselves, hosted in Austria (EU).

In the timelit app, but not on booking pages, we also measure how features are used with Rybbit, an analytics tool that we host ourselves. It records the pages you open, your browser and device type, and events such as using search. It does not receive your name, your email address or the content you work with.

3.2.5 AI-Generated Data

When you use AI features, timelit generates and stores:

  • Cached AI Responses: AI-generated email drafts, suggestions, summaries (stored for a limited technical period as part of providing the Service)
  • Embeddings: vector representations of content (emails, transcripts, chats, automation results, meeting summaries, etc.) stored in Cosmos DB to power semantic search
  • Knowledge Base Entries: processed and indexed communication content (e.g., key entities, topics)
  • Memories: preferences, instructions and facts about you that timelit takes from your own chat messages, together with the words you used. You can delete them in the settings.
  • AI Processing Logs: token usage, model identifiers, processing timestamps, error information

We do not use your content to train our own or third-party foundation models.

3.3 Data We Receive from Third Parties

3.3.1 Microsoft Graph API

Based on the consent granted by you or your tenant administrator, we receive data from Microsoft Graph API, including:

  • Microsoft user profile information (e.g., name, email, user ID)
  • Email messages and associated metadata and attachments
  • Calendar events, availability, and meeting metadata
  • Meeting transcriptions (via Microsoft services)
  • Other Microsoft 365 resources as explicitly enabled in the product

We only request and use Graph scopes necessary for the specific features you activate.

3.3.2 Microsoft Azure Services

We also receive and generate data through Microsoft Azure services, including:

  • System logs and diagnostics
  • Performance metrics
  • Security event logs
  • Infrastructure metadata for App Service, Cosmos DB, Blob Storage, Application Insights and Log Analytics

All such data is stored in Azure Sweden Central (EU).

3.3.3 Connected Apps (optional)

If you connect a third-party app in Settings › Connections, timelit receives, as the processor of your organisation, the data that app's tools return when you or an automation you set up ask for it: for example issues, tasks, pages, files, CRM records, tickets and conversations, and the names and identifiers of the people in them. timelit sends this data to the AI model to answer you or to run your automation and writes to the app only after you approve each action. Results are kept with the chat or automation run that requested them (Section 8.1.1). We do not use this data to train any model.

For data from Atlassian products, cronio FlexCo, and not Atlassian, is responsible for its processing in timelit. Asana's Privacy Statement does not apply to timelit's processing of data from Asana.

3.3.4 Calendars of Other Providers (optional)

If you connect a calendar of another provider so that its busy times block your booking page:

  • Google Calendar: timelit reads the list of your calendars and their busy times. It never reads event details.
  • iCloud: timelit reads the events of the calendars you switch on, through CalDAV, and keeps only their start, end, identifier and title, in memory and for at most 24 hours.

timelit only reads these calendars and stores nothing from them apart from calendar names, the account label and the sign-in described in Section 3.1.2.

timelit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.4 Special Categories of Personal Data

We do not intentionally seek or require processing of special categories of personal data (Article 9 GDPR), such as:

  • racial or ethnic origin
  • political opinions
  • religious or philosophical beliefs
  • trade union membership
  • genetic or biometric data
  • health data
  • data concerning sex life or sexual orientation

However, such data may incidentally appear in:

  • email content
  • attachments
  • calendar descriptions
  • meeting transcriptions

This content belongs to the customer's Microsoft 365 environment. We process it as a processor, on the customer's instructions, and only to the extent necessary to provide the Service. The customer determines the legal basis for it, including any basis required under Article 9(2) GDPR; in an employment context this is typically Article 9(2)(b) GDPR in conjunction with § 11 of the Austrian Data Protection Act (DSG).

We do not rely on your consent as a legal basis for processing this content, and the Microsoft OAuth and admin consent flow is a technical authorisation, not consent within the meaning of Article 4(11) GDPR.

We do not seek special categories of personal data, do not index them as such, and do not profile or classify users based on these attributes. The safeguards we apply are set out in Annex II of the Data Processing Agreement.

3.5 AI-Generated and Processed Data

3.5.1 AI Processing Data

When AI features are used, we process:

  • Model Inputs: content sent to AI models, such as email bodies, subject lines, calendar texts, meeting transcripts, and your prompts
  • Processing Metadata: token usage, model versions, timestamps
  • AI Model Outputs: generated drafts, summaries, categorizations, action lists, search results
  • Performance Metrics: e.g., response time, error rates

3.5.2 Knowledge Base Data

We build a personal knowledge layer to help you find and reuse information:

  • Indexed Content: processed content of emails, calendar entries, and meeting summaries
  • Vector Embeddings: mathematical representations of text for semantic search
  • Knowledge Relationships: inferred links between topics, projects, people, or threads
  • Search History: your search queries and (where necessary) clicked results

3.5.3 EU AI Act Transparency

We align with the transparency obligations of the EU AI Act:

  • AI System Disclosure: When content (e.g., drafts or summaries) is AI-generated, this is clearly indicated in the Service.
  • Model Training Sources: The base models used (Azure OpenAI) are provided and trained by Microsoft. We do not use your data to further train these foundation models.
  • Decision-Making: timelit does not take legally or similarly significant decisions without human control. You always decide what gets sent or executed.
  • Human Oversight: You can review, modify, or discard AI suggestions before using them.

3.6 Booking Pages

This section is for you if you book a meeting on the booking page of a timelit user.

Who is responsible. The timelit user who owns the booking page, or their organisation, is the controller of your booking. cronio FlexCo processes it on their behalf as a processor. Please address requests about your booking to them; if you send them to us, we forward them.

What is processed. Your name, email address, the answers to the questions on the booking page, your time zone and language, the time you booked and, if you cancel, the reason you give. timelit creates the meeting in the user's Outlook calendar, from which Microsoft sends you the invitation, and can notify the user by email. Booking records are deleted 365 days after the meeting ends.

What we process as controller. To protect booking pages against automated abuse, we use your IP address and the email address you enter to count requests, in memory and for at most one day, and run a bot check that we host ourselves. The legal basis is our legitimate interest in keeping the Service secure (Article 6(1)(f) GDPR). Booking pages use no analytics and no tracking cookies.

4. How We Use Your Personal Data

4.1 Processing we carry out as a processor

The following processing is carried out on behalf of the customer, on its documented instructions, and exclusively to provide the Service:

  • Email processing: analysing and categorising email
  • AI-generated responses: generating drafts and suggestions
  • Meeting scheduling: proposing and scheduling meetings based on the signed-in user's own calendar and working hours
  • Meeting transcription: transcribing and summarising supported meetings
  • Daily briefings: generating overviews of email, meetings and tasks
  • Knowledge management: indexing and searching historical email, attachments, summaries, chats and automation results, including the generation of embeddings
  • Automations: running the automations you set up, on a schedule or when an event such as an incoming email occurs
  • Booking pages: showing your free times, creating booked meetings in your calendar and notifying you
  • Connected apps and calendars of other providers: reading from them and, after your approval, acting in connected apps
  • User preferences: applying the configuration of the Service

For this processing we do not determine a legal basis of our own. The customer, as controller, determines the purposes, the means and the legal basis. Our obligations are set out in the Data Processing Agreement.

We do not process this content for our own purposes, including product improvement, and we do not use it to train any model, whether our own or a third party's.

4.2 Processing we carry out as an independent controller

4.2.1 Providing and administering your account (Contractual necessity – Article 6(1)(b) GDPR)

  • creating and administering your account and authenticating you through Microsoft Entra ID
  • storing and refreshing the OAuth tokens required to connect your Microsoft 365 account
  • managing subscriptions, trials, invoicing and payment through our payment provider
  • answering your support requests and sending service notifications about status, security and changes

Authentication through Microsoft OAuth is a technical authorisation step necessary to perform the contract. It is not consent within the meaning of Article 4(11) GDPR and we do not treat it as such.

4.2.2 Security and abuse prevention (Legitimate interest – Article 6(1)(f) GDPR)

  • detecting suspicious or unauthorised access
  • preventing misuse of the Service, including trial abuse
  • protecting infrastructure and data from attack
  • keeping security and audit logs

Balancing: our interest is in keeping the Service and the data in it secure, which is also in the interest of every user and every customer. We process the minimum necessary, primarily technical identifiers, access events and error data, and do not use it to evaluate individuals. We consider that your interests and fundamental rights do not override this interest.

4.2.3 Operating and improving the Service (Legitimate interest – Article 6(1)(f) GDPR)

  • diagnosing and fixing technical faults
  • measuring performance, reliability and error rates
  • developing features on the basis of usage patterns

This is limited to Account Data and telemetry. We do not use Customer Content for these purposes. Where we analyse usage patterns, we do so on data that contains no Customer Content and from which neither the customer nor any individual can be identified.

Balancing: the processing is limited to technical and usage data, it is necessary to operate a reliable service, and it produces no decision about any individual.

4.2.4 Legal compliance (Legal obligation – Article 6(1)(c) GDPR)

  • accounting and tax retention obligations
  • handling and documenting data subject requests
  • complying with breach notification obligations
  • retaining the record of acceptance of our contractual documents, which we retain on the basis of Article 6(1)(f) GDPR in order to demonstrate that a valid contract under Article 28 GDPR exists

4.2.5 Marketing communications (Consent – Article 6(1)(a) GDPR)

We send marketing communications only where you have given separate, explicit consent, which you can withdraw at any time.

4.2.6 Legal basis overview

Processing activity Our role Legal basis Article
Email, calendar, contacts, meeting and knowledge features Processor Determined by the customer Art. 28
AI drafting, summarisation, categorisation, embeddings Processor Determined by the customer Art. 28
Storage of email, attachments, transcripts, audio Processor Determined by the customer Art. 28
Account creation, authentication, token storage Controller Contractual necessity 6(1)(b)
Subscription, invoicing, payment Controller Contractual necessity 6(1)(b)
Support and service notifications Controller Contractual necessity 6(1)(b)
Security monitoring, abuse prevention Controller Legitimate interest 6(1)(f)
Telemetry, error tracking, service improvement Controller Legitimate interest 6(1)(f)
Record of contract acceptance Controller Legitimate interest 6(1)(f)
Accounting, tax, statutory retention Controller Legal obligation 6(1)(c)
Marketing communications Controller Consent 6(1)(a)

4.3 Legitimate Interests

Where we rely on legitimate interests (Article 6(1)(f) GDPR), we do so only as an independent controller and never for Customer Content. They include:

  • Security & Abuse Prevention: ensuring account and system security
  • Service Quality: improving performance and stability
  • Business Operations: operating the Service sustainably
  • Error Handling: detecting and fixing bugs
  • Compliance: demonstrating and maintaining legal compliance

You have the right to object to processing based on legitimate interests at any time (see Section 9).

5. Digital Services Act (DSA) Compliance

timelit is a business productivity tool for Microsoft 365 users, not a public social network or content platform. As such, DSA obligations are limited, but we still:

  • provide ways to report security or abuse issues
  • log system behavior and access for integrity
  • cooperate with competent authorities where required by law

timelit does not provide public user-generated content feeds or recommender systems to the general public.

6. How We Share Your Personal Data

6.1 Third-Party Service Providers (Processors)

We share your personal data with selected third-party processors who act on our behalf and only according to our documented instructions.

6.1.1 Microsoft (Azure, Graph, Azure OpenAI)

Services:

  • Microsoft Azure (App Service, Cosmos DB, Blob Storage, Application Insights, Log Analytics)
  • Azure OpenAI (inference and embeddings)
  • Azure AI Speech (transcription of uploaded and recorded meeting audio)
  • Microsoft Graph API (Outlook, Calendar, Contacts, Teams meeting transcripts)
  • Microsoft 365, for the emails timelit itself sends (briefings, reports, notifications)

Data Shared:

  • all data stored and processed in our Azure environment (as described above)
  • content sent to Azure OpenAI for AI processing
  • audio sent to Azure AI Speech for transcription
  • email, calendar, contact and meeting data accessed via Graph

Purpose:

  • core infrastructure hosting
  • AI inference (drafts, summaries, embeddings) and speech transcription
  • secure access to Microsoft 365 data via Graph

Location:

  • All data at rest is stored in Azure Sweden Central (EU), apart from copies of the emails timelit sends, which are kept in our Microsoft 365 mailbox for 30 days. Our Azure OpenAI resources are in the EU, primarily in Azure Italy North, and are reached through an AI gateway that we operate in Azure Sweden Central.
  • Inference may take place outside the EEA. All four of our Azure OpenAI model deployments (gpt-5, gpt-5-mini, gpt-5.6-terra, text-embedding-3-small) currently use the GlobalStandard deployment type. Microsoft states that for this deployment type prompts and responses may be processed in any geography in which the relevant model is deployed, while data stored at rest remains in the designated geography. Any resulting transfer to a third country is covered by the standard contractual clauses adopted under Article 46(2) GDPR that form part of the Microsoft Data Protection Addendum.
  • Because our deployments are global, the Microsoft EU Data Boundary commitments do not cover this inference. We do not claim their protection for it.

Abuse monitoring by Microsoft:

  • By default, Azure OpenAI stores a sample of prompts and completions for up to 30 days where its automated systems flag possible abuse, so that the sample can be reviewed.
  • Review is automated by default. Authorised Microsoft employees may review flagged data where necessary. For models deployed in the EEA those reviewers are located in the EEA, and the store is located in the geography of our Azure resource.
  • This means that, in the case of a flagged interaction, content can be seen by Microsoft personnel. We state this because a claim that no one but you ever sees your content would not be accurate.

Safeguards:

  • Microsoft Products and Services Data Protection Addendum, including the standard contractual clauses for third-country transfers
  • Microsoft is contractually bound not to use prompts, completions or embeddings to train its foundation models
  • encryption at rest and in transit

Privacy policy: https://privacy.microsoft.com/

6.1.2 Stripe Payments Europe Ltd.

Services:

  • payment processing and billing

Data Shared:

  • billing email and name
  • billing address (if applicable)
  • subscription details
  • payment method token (timelit does not store full card numbers)

Purpose:

  • manage subscriptions
  • process payments
  • issue invoices

Location:

  • Stripe’s EU entity processes data within the EEA (or with appropriate safeguards).

Privacy policy: https://stripe.com/privacy

6.1.3 Azure Application Insights (via OpenTelemetry)

Services:

  • telemetry collection and diagnostics

Data Shared:

  • technical logs, error traces, performance metrics
  • pseudonymized identifiers (minimized)

Purpose:

  • monitoring and maintaining the Service
  • detecting failures, performance issues, security anomalies

Location:

  • Azure Sweden Central (EU)

We design all logs and telemetry to avoid storing raw email content or transcripts wherever possible.

6.2 Data Processing Agreements

All processors are bound by:

  • Data Processing Agreements (DPAs)
  • obligations to process personal data only on our instructions
  • appropriate technical and organizational security measures
  • confidentiality obligations
  • audit and oversight rights where appropriate

6.3 Legal Requirements

We may disclose personal data if required to do so by law or in response to valid legal requests, such as:

  • court orders or subpoenas
  • requests from supervisory authorities or other public bodies

Where legally permissible, we will inform you before disclosing your data.

6.4 Business Transfers

If cronio FlexCo undergoes a merger, acquisition, or sale of assets:

  • your personal data may be transferred to the acquiring entity as part of the transaction
  • any such entity will be required to respect this Policy or a substantially equivalent policy
  • you will be informed of any material change in controller or purposes

6.5 With Your Consent

Where you explicitly request or consent (in the Service or otherwise), we may share data with additional parties for specific purposes (e.g., integrations). You can withdraw such consent at any time.

6.6 Connected Apps and Calendars of Other Providers

When you approve an action in a connected app, timelit sends the data of that action to the app's provider. Connected apps and calendars of other providers are services your organisation has chosen itself; their providers process data under your own agreement with them and are not our sub-processors.

7. International Data Transfers

7.1 Data Storage Location

All Customer Content and all data of the Service's main data stores is stored at rest in:

  • Microsoft Azure Sweden Central (EU)

This includes:

  • Azure App Service (application)
  • Azure Cosmos DB (main data store)
  • Azure Blob Storage (meeting audio)
  • Azure Application Insights and Log Analytics (telemetry and logs)
  • the Azure AI Speech resource

The Azure OpenAI resources are in the EU, primarily in Microsoft Azure Italy North. Copies of the emails timelit sends are kept in our Microsoft 365 mailbox for 30 days.

Error reports are stored in our own error tracking system, hosted in Austria (EU). International transfers are described in Section 7.2.

Database backups are taken periodically, two copies are kept, and the retention period is eight hours. Backup storage is zone-redundant, so backups remain within the same Azure region as the live data.

7.2 Current International Transfers

At the time of this Policy:

  • Inference by Azure OpenAI may take place outside the EEA. All four of our model deployments use the GlobalStandard deployment type. Microsoft states that for this deployment type prompts and responses may be processed in any geography in which the relevant model is deployed, while data stored at rest remains in the designated geography. This means that email, calendar and transcript content sent to the model for processing may be processed outside the EEA, even though it is stored inside it.
  • Safeguard: any such transfer is covered by the standard contractual clauses adopted by the European Commission under Article 46(2) GDPR that form part of the Microsoft Products and Services Data Protection Addendum. Clause 7.8(b) of our Data Processing Agreement expressly contemplates this mechanism.
  • Because the deployments are global, the Microsoft EU Data Boundary commitments do not apply to this inference, and we do not claim them for it.
  • Microsoft Graph, Azure AI Speech and all data stores operate on our resources in Sweden Central.
  • Stripe uses its EU entity, Stripe Payments Europe Ltd. (Ireland), for payment processing.
  • If a connected app is hosted outside the EEA, data that timelit writes to it on your instruction is transferred to that provider. The transfer relies on the mechanism your organisation has in place with the provider, such as its certification under the EU-U.S. Data Privacy Framework or standard contractual clauses. Calendars of other providers are only read.

We are working on changing the Azure OpenAI deployment type so that inference stays within the EU. Until that change is live, this section describes what actually happens rather than what we intend.

7.3 Your Rights Regarding Transfers

You have the right to:

  • request information about the transfers described above
  • object to certain transfers, where legally permissible
  • request details of the safeguards applied, including a copy of the relevant standard contractual clauses

Where we act as a processor, these rights are exercised against the customer as controller. Write to us at support@timelit.ai and we will forward the request.

8. Data Retention and Deletion

8.1 Retention Periods

8.1.1 Active Accounts

While your account remains active, we retain:

  • Account Data: registration and profile data
  • Email Data: email bodies, metadata, attachments
  • Calendar Data: events, metadata
  • Meeting Data: transcriptions, summaries, meeting metadata
  • AI Data: knowledge entries, embeddings, cached outputs (for a limited technical duration)
  • Configuration Data: user settings and preferences
  • Memories: until you delete them
  • Usage Logs & Telemetry: stored typically for up to 12 months, unless needed longer for security or legal reasons

Some data is deleted earlier:

  • Automation runs, their chats and reports: 90 days after the run ends
  • Bookings: 365 days after the meeting ends
  • Copies of the emails timelit sends: 30 days in our sending mailbox
  • Results from connected apps: kept with the chat or automation run that requested them and deleted with it
  • Sign-ins for connected apps and calendars of other providers: until you disconnect them or delete your account

8.1.2 Cached Data

We temporarily cache:

  • AI responses (e.g., drafts, suggestions, summaries)
  • semantic search results

These caches are kept only for a short technical duration necessary to provide the Service and improve responsiveness and are then automatically purged.

8.1.3 Terminated Accounts

When you terminate your account or request deletion:

  • we revoke your access immediately
  • we mark all associated personal data for deletion, which you can still cancel during the retention window
  • we delete personal data from active systems within 30 days, by an automated sweep that runs at intervals of no more than six hours across all stores holding your data, including your stored meeting audio
  • backup copies are removed on the ordinary backup rotation, which for the database has a retention period of eight hours

Some data may be retained longer if required by law (e.g., invoicing records).

8.1.4 Legal Requirements

We may retain certain data as required by law, such as:

  • invoice and billing data (e.g., up to 7 years under tax law)
  • records needed to resolve disputes or enforce legal claims
  • logs relevant to security incidents or legal compliance

8.2 Deletion Procedures

When data is deleted:

  • Access Revocation: your account access is immediately disabled.
  • Soft Deletion: data is flagged for deletion and removed from active use.
  • Hard Deletion: data is permanently erased from primary storage within the stated timeframe.
  • Backup Deletion: data is removed from backup systems through their regular rotation, which for the database has a retention period of eight hours. Data in backups is not available for processing in the meantime.

You may request confirmation that deletion has been completed.

8.3 Data Minimization

We implement the principle of data minimization by:

  • only collecting data needed to provide the Service
  • avoiding unnecessary duplication of content
  • pseudonymizing or aggregating data wherever possible
  • restricting internal access (RBAC) to only those with a need to know

9. Your Data Protection Rights

Under the GDPR, you have the following rights with respect to your personal data:

9.1 Right of Access (Article 15 GDPR)

You can request:

  • confirmation whether we process your personal data
  • a copy of personal data we hold about you
  • information about our processing activities (purposes, categories, recipients, retention periods)

9.2 Right to Rectification (Article 16 GDPR)

You can request correction of inaccurate or incomplete personal data, e.g.:

  • your name
  • your email address (if change is supported by your Microsoft account)
  • certain configuration or profile details

9.3 Right to Erasure / "Right to be Forgotten" (Article 17 GDPR)

You can request deletion of your personal data, for example when:

  • it is no longer necessary for the purposes we collected it for
  • you withdraw consent where processing was based solely on consent
  • you object to processing and there are no overriding legitimate grounds
  • processing is unlawful or required to be deleted by law

We may refuse deletion where:

  • retention is required by law
  • data is necessary to establish, exercise, or defend legal claims
  • deletion would adversely affect the rights of others

9.4 Right to Restrict Processing (Article 18 GDPR)

You can request that we restrict processing when:

  • you contest the accuracy of the data (for a period to verify it)
  • processing is unlawful but you prefer restriction instead of deletion
  • we no longer need the data, but you require it for legal claims
  • you object to processing pending verification of our legitimate interests

9.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on consent or contract and carried out by automated means, you can request:

  • a copy of your personal data in a structured, commonly used, and machine-readable format
  • that we transmit such data directly to another controller where technically feasible

9.6 Right to Object (Article 21 GDPR)

You may object at any time to processing based on legitimate interests, including:

  • certain telemetry and analytics
  • certain security and monitoring practices (where feasible)

If you object, we will stop processing unless:

  • we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or
  • processing is required for legal claims.

9.7 Right to Withdraw Consent (Article 7 GDPR)

Where processing is based on your consent (marketing communications, Section 4.2.5), you can withdraw consent at any time by contacting us at support@timelit.ai. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

9.8 Rights Related to Automated Decision-Making (Article 22 GDPR)

timelit does not make automated decisions that produce legal or similarly significant effects without human input.

AI systems:

  • only generate suggestions, drafts, or summaries
  • require your review and approval before use (e.g., sending an email)

You have the right to:

  • obtain human intervention
  • express your point of view
  • contest AI-generated outcomes
  • opt-out of specific AI features where technically supported

9.9 How to Exercise Your Rights

You can exercise your rights by contacting us:

Email: support@timelit.ai Postal Address: cronio FlexCo, Eileen-Gray-Gasse 2/24, 1220 Vienna, Austria

To protect your data, we may ask you to:

  • verify your identity
  • provide sufficient detail to locate the data or processing you refer to

Response times:

  • Standard requests: within 30 days
  • Complex or multiple requests: may be extended by up to 2 additional months; we will inform you of any extension.

We will not charge a fee unless a request is manifestly unfounded or excessive.

10. Data Security

10.1 Security Measures

We implement appropriate technical and organizational measures, including:

Annex III of the Data Processing Agreement is the single authoritative description of our technical and organisational measures. It states concretely what is implemented and what is not, and lists the measures we have committed to implement with target dates. Where any other description of our security measures conflicts with it, Annex III prevails.

The main points in summary:

10.1.1 Technical Measures

  • Encryption in transit: TLS for all traffic between clients, our application and the services we use
  • Encryption at rest: Azure platform encryption (AES-256) with Microsoft-managed keys, covering all stored data including the access tokens used to connect to Microsoft 365
  • Isolation: one database partition per connected mailbox, keyed on the Microsoft user and tenant identifier. This is logical isolation; organisations in the Service are a billing and membership construct, not a security boundary.
  • Authentication: exclusively through Microsoft Entra ID. We do not store or verify passwords, and you can revoke our access at any time in your Microsoft account or tenant.
  • Monitoring: infrastructure and application metrics are collected in Azure Application Insights, and application logs are retained for 30 days and then deleted.

10.1.2 Organizational Measures

  • Least privilege: access to data granted only where necessary for the role, and withdrawn on a change of role or departure
  • Confidentiality: all personnel with access to personal data are bound by written confidentiality obligations
  • Data protection by design and default: privacy and security considered throughout development
  • Review: we review our measures whenever the architecture of the Service changes materially, and at least once a year
  • No certification. cronio FlexCo is not certified under ISO/IEC 27001, has not undergone a SOC 2 examination, and does not participate in an approved certification mechanism under Article 42 GDPR. The infrastructure layer we do not operate is covered by Microsoft's certifications for Azure, which we make available on request.

10.2 Security Incidents

In the event of a personal data breach:

  1. We will promptly assess the scope and impact.
  2. We will contain and mitigate the incident.
  3. Where required by law, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours.
  4. Where the breach is likely to result in a high risk to your rights and freedoms, we will also inform affected users without undue delay.
  5. We will document the incident and corrective measures to prevent recurrence.

10.3 Your Role in Security

You are responsible for:

  • maintaining the security of your Microsoft account (strong passwords, MFA)
  • not sharing access tokens or credentials with others
  • reviewing and maintaining your Microsoft tenant’s permissions and policies
  • informing us promptly if you suspect unauthorized access to your timelit account

11. Cookies and Tracking Technologies

11.1 Cookies We Use

Within the timelit web app (timelit.app), we use cookies and similar local storage technologies only where necessary for:

  • Authentication: maintaining your login session
  • Preferences: storing certain UI and configuration preferences
  • Security: protecting against fraud and misuse

We do not use analytics cookies or third-party marketing trackers in the timelit app. Usage measurement inside the app is done through our own telemetry and Rybbit, described in Section 3.2.4.

11.2 Cookie Categories

  • Essential Cookies: strictly necessary for Service functionality and security (cannot be disabled without impacting usage).
  • Functional Storage (where used): may store local preferences (e.g., UI states).

We do not use separate analytics or marketing cookies in the app.

11.3 Managing Cookies

You can control cookies and local storage through your browser settings. Disabling essential cookies or local storage may prevent you from using the Service.

12. Children’s Privacy

12.1 Age Requirements

timelit is designed exclusively for professional use with Microsoft Work or School accounts and is not intended for children under 16 years of age.

12.2 Age Verification

Because registration requires a work/school Microsoft 365 account, Microsoft’s account management and organizational policies apply. We do not knowingly process personal data of children under 16.

12.3 Parental Rights

If you are a parent or guardian and believe a child under 16 is using timelit, please contact us at support@timelit.ai. We will investigate promptly and delete data where required.

13. Automated Decision-Making and Profiling

13.1 AI-Powered Processing

timelit uses AI to:

  • generate email drafts and replies
  • create meeting summaries and action items
  • categorize and prioritize communications
  • support semantic search across your communications
  • extract key information (entities, topics, projects) from text

13.2 Automated Decision-Making

timelit does not make decisions with legal or similarly significant effects on you without human involvement.

  • AI suggestions remain under your control.
  • Emails to other people are never sent without your action. The one exception is the calendar invitations and updates Microsoft sends for meetings booked on your booking page.
  • You can always modify or ignore AI output.

13.3 Profiling

We may perform limited profiling to:

  • personalize the Service (e.g., better suggestions based on prior choices)
  • improve relevance of summaries and search results

This profiling:

  • does not use sensitive categories (e.g., race, health)
  • is used purely to improve your productivity experience
  • can be limited by disabling certain features or contacting us

You may:

  • object to profiling
  • request more information about profiling
  • opt out of specific AI features where technically supported

14. Changes to This Privacy Policy

14.1 Policy Updates

We may update this Privacy Policy from time to time to reflect:

  • changes in our processing activities or services
  • changes in legal requirements or guidance
  • feedback from users or supervisory authorities

14.2 Notification of Changes

We will inform you of material changes by:

  • displaying a prominent notice within the timelit app, and/or
  • sending an email to your registered address (where appropriate).

For significant changes, we will provide reasonable advance notice before the new Policy takes effect.

14.3 Reviewing Changes

We will:

  • keep a version history of this Policy
  • indicate the effective date and “last updated” date on top of the Policy
  • provide a summary of material changes on request

15. Complaints and Supervisory Authorities

15.1 Right to Lodge a Complaint

If you believe that we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority, in particular in:

  • the EU member state of your habitual residence, place of work, or
  • the place of the alleged infringement.

15.2 Supervisory Authority (Austria)

As cronio FlexCo is established in Austria, our primary supervisory authority is:

Austrian Data Protection Authority (Datenschutzbehörde) Website: https://www.dsb.gv.at/

You can also find a list of all EU supervisory authorities here: https://edpb.europa.eu/about-edpb/board/members_en

15.3 Complaint Process

We encourage you to contact us first at support@timelit.ai so we can try to resolve your concerns directly.

If you remain unsatisfied, you can submit a complaint to the competent supervisory authority.

16. Contact Us

16.1 Privacy Inquiries

For any questions or concerns about this Privacy Policy or our data processing, please contact:

Email: support@timelit.ai Postal Address: cronio FlexCo Eileen-Gray-Gasse 2/24 1220 Vienna Austria

16.2 Response Times

  • General inquiries: usually within 5 business days
  • Data subject rights requests: within 30 days, extendable by up to 2 additional months for complex cases

16.3 Language

This Privacy Policy is provided in English. If translations are provided, the English version prevails in case of any conflict.

17. Additional Information

17.1 Links to Other Policies

  • General terms and conditions: General terms and conditions
  • Cookie Information: included in Section 11 of this Policy
  • Acceptable Use rules are incorporated into the General terms and conditions.

17.2 Third-Party Privacy Policies

17.3 Data Processing Records

We maintain records of our processing activities under Article 30 GDPR, including:

  • categories of personal data processed
  • purposes of processing
  • categories of recipients
  • data transfers (if any)
  • retention periods
  • security measures

You can request high-level information about these records by contacting support@timelit.ai.

Appendix A: Definitions

  • "Controller": The entity that determines the purposes and means of processing personal data. For Customer Content this is the customer; for Account Data it is cronio FlexCo. See Section 1.2.
  • "Processor": An entity that processes personal data on behalf of the controller. Where a customer is the controller of Customer Content, cronio FlexCo is the processor and the providers listed at Sub-processors are sub-processors.
  • "Personal Data": Any information relating to an identified or identifiable natural person.
  • "Processing": Any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.).
  • "Consent": Freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
  • "Data Subject": The individual whose personal data is processed (you).
  • "GDPR": General Data Protection Regulation (EU) 2016/679.
  • "EEA": European Economic Area (EU member states plus Iceland, Liechtenstein, Norway).
  • "Supervisory Authority": Independent public authority responsible for monitoring GDPR compliance.
  • "Data Breach": A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

Appendix B: Technical Architecture and Security Measures

This appendix previously duplicated the description of our technical measures. It has been replaced by a single authoritative description so that the two cannot drift apart.

The technical and organisational measures we apply, described concretely and including the measures we have committed to implement, are set out in Annex III of the Data Processing Agreement.

The architecture of the Service, the categories of data processed, the Microsoft Graph permission scopes used and the location of processing are described in Annex II of the same document. The providers we engage are listed at Sub-processors.

Wählen Sie, ob Analyse-Cookies erlaubt werden. Essenzielle Cookies sind immer aktiv.