Privacy Policy.

Overview

Your privacy is important to us. This Privacy Policy describes how Timeglass, Inc. ("Timeglass", "we", "us", or "our") may collect, use, store, disclose, process and transfer your personal information through your access to or use of our products and services, including https://www.timeglass.ai/, related websites, subdomains and other offerings (collectively, the "Services"). This Policy provides notice of our practices; it does not itself obtain consent for processing that requires separate consent. We may update this Policy by posting changes at timeglass.ai/privacy and providing any notice or seeking any consent required by applicable law.

Privacy Policy Applicability

This Privacy Policy applies when you use or access the Services or share information with Timeglass. Timeglass may act as a processor when our customers use the Services, in which case we act as a processor on behalf of our customers, who are the controllers of personal data.

This Privacy Policy applies only to the Services, not to third-party websites linked to or from them or websites in which Timeglass content or functionality is embedded. We do not control those parties' privacy policies or practices. Acceptance of this Policy or the Terms of Service does not replace any separate notice or consent required for recording or biometric processing.

Information We Collect about You

In general, we receive and collect all information you provide via the Services, including through website input fields, phone, email (including email campaigns), or other such ways. This includes personal information that can identify or relates to you, including, but not limited to:

You have the choice regarding what information you share and the Services you want to engage. You can choose not to provide information to us, but in general, some information about you is required in order for you to access certain functionalities of the Services. We may periodically obtain information about you from our customers (including your employer or the entity to which you provide services as applicable, affiliated entities, partners and other independent third-party sources and will add it to our database of information, including any information that you provide to third parties that are associated with or whose products or services are integrated with the Services. For example, your employer may provide us with your job description.

We may use cookies, log file technologies, web beacons, device identifiers, session replay technologies, and similar tracking technologies, including those from third-party service providers like Google Analytics and other cloud-based tools, to automatically collect your preferences, performance data, and information about your web usage when you visit the Services. For example, we may collect your IP address, device and Internet service provider information, Web browser details and the address of any referring website. We may also collect information about your online activity, such as pages viewed. This may include collecting geolocation signals from your IP address or device settings to determine your location. By collecting and using this information, we may operate and personalize the Services for you and may also combine this data with other information we have collected about you. For more information on how we use cookies, please see the “Cookies” section below.

We honor Global Privacy Control (GPC) signals. When your browser sends a GPC signal (a setting available in browsers like Firefox, Brave, and DuckDuckGo, or through browser extensions), we automatically treat this as a valid request to opt out of the sale or sharing of your personal information as required by California, Colorado, and Connecticut law. You can learn more about GPC at https://globalprivacycontrol.org. You can control the information collected by such tracking technologies or be alerted when cookies are sent by adjusting the settings on your Internet browser or devices, but such adjustments may affect or disable certain functionality of the Services. You can learn more about Google Analytics and your options for opting out of interest-based Google ads at https://adssettings.google.com. You can learn more about targeted ads and your ability to opt out of receiving interest-based ads at optout.aboutads.info and www.networkadvertising.org/choices.

Sensitive Information

Meeting recordings and transcripts may contain sensitive personal information. Timeglass derives numerical voiceprints from meeting audio to distinguish speakers. With your opt-in, optional Speaker Names profiles recognise you across meetings in the same workspace. Voiceprints may be biometric information under applicable law and are processed and stored using our infrastructure providers. They are not sold or sent to external AI inference providers. Any legally required recording or biometric consent must be obtained before processing.

Cookies

Cookies, also known as tracking cookies or browser cookies, and similar technologies such as web beacons, clear GIFs, pixel tags, and JavaScript (collectively, “Cookies”) are small pieces of data, usually text files, placed on a computer, tablet, phone, or similar device when you use that device to access the Services. We use the following types of Cookies:

• Essential Cookies. Essential Cookies are necessary for providing you with the Services and features that you requested. For example, these Cookies allow you to log into and stay logged into secure areas of the Services, save language preferences, and more. These Cookies are required to make the Services available to you, so they cannot be disabled.
• Functional Cookies. Functional Cookies are utilized to record your choices and settings, maintain your preferences over time, and recognize you when you return to our Services. These Cookies help us personalize our content for you, greet you by name, and remember your preferences.
• Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors (like you) use the Services. These Cookies accomplish this by collecting information about the number of visitors to the Services, what pages visitors view the most, and how long visitors view specific pages. These Cookies also help us measure and manage the performance of our advertising campaigns in order to help us improve the campaigns and the Services’ content. For example, Google LLC (“Google”) uses cookies in connection with its Google Analytics services. Google’s ability to use and share information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt-out of Google’s use of Cookies by visiting the Google advertising opt-out page at http://www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/.

Marketing and Analytics Partners

We use the following third-party services for marketing, analytics, and communications:

• Google Analytics & Tag Manager (Analytics)
• RB2B/Retention.com (Visitor Identification)
• Apollo.io (Sales Intelligence)
• Customer.io (Email Marketing)
• Microsoft Clarity (Session Replay)

You have the option to decide through your internet browser’s settings whether or not to accept Cookies. Most browsers allow users to choose whether to turn off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the browser) allow you to toggle whether to accept each new Cookie. You can also clear all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit the Services and some functionalities may not work. To explore what Cookie settings are available to you, look in the “settings”, “preferences” or “options” section of your browser’s menu.

To find out more information about Cookies, including information about how to manage and delete Cookies generally, please visit http://www.allaboutcookies.org/.

Website Visitor Identification

When you visit our website, we use RB2B (operated by Retention.com, LLC) to identify business visitors. This service uses cookies, IP addresses, and device identifiers to associate your visit with business contact information from their database. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or online profiles. We (or service providers on our behalf) may then send communications and marketing to these emails or profiles. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

To request information about what data RB2B has collected about you, visit:

https://app.retention.com/request_my_data

How We Use Your Information

We process your personal information with your consent or as needed to provide you the Services. We may also use your personal information to comply with legal obligations, operate our business, protect the vital interests of you, our customers, or the public, or for other legitimate interests of Timeglass as described in this Privacy Policy.

More specifically, we may use your personal information to:

• Optimize and improve the Services. We continually try to improve the Services based on the information and feedback we receive from you and our other users, including by optimizing the content on or functionalities of the Services.
• Personalize the user experience. We may use your information to measure and optimize engagement with the Services and to understand how you and our other users interact with and use the Services and other resources we provide.
• Improve customer service. Your information helps us to more effectively develop the Services and respond to your support needs.
• Process transactions. We may use the information you provide to fulfill your requests. We do not share this information with outside parties except to the extent necessary to provide the Services and related activities.
• To send periodic communications. The communication methods you provide through our contact forms will be used to send information and updates pertaining to the Services. It may also be used to respond to your inquiries or other requests. If you opt into our mailing list, you may receive emails that include Timeglass news, updates, product offerings and service information, and marketing material. If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email or you may contact us via the contact information below. Please note that if you unsubscribe from promotional emails, you may still receive communications related to your subscription, your purchase, or other necessary functionalities of the Services.
• Carry out other legitimate business interests. We may use the information you provide to carry out other legitimate business purposes, as well as other lawful purposes.

We may use any aggregated information (as described below) for any purpose.

How We Share Your Information

We share your information with our partners, service providers, contractors, agents, and third-party vendors indicted in the “Information We Collect from You” section as needed to fulfill Services, including for artificial intelligence (“AI”) processing as further discussed below. Please note that our partners may contact you as necessary to obtain additional information about you, facilitate any use of the Services, or respond to a request you submit.

Third-party vendors who provide products, services or functions on our behalf may include cloud database providers, data analytics companies, customer service vendors, AI vendors, communications service vendors, marketing vendors, and security vendors. Third-party vendors have access to and may collect personal information only as needed to perform their functions, may only use personal information consistent with this Privacy Policy and other appropriate confidentiality and security measures, and are not permitted to share or use the information for any other purpose.

We also may share your information:

• In response to subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases we reserve the right to raise or waive any legal objection or right available to us.
• When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities; to protect and defend the rights, interests, or safety of our company or the Services, our customers, or others; or in connection with our Terms of Service and other agreements with customers of which you may be affiliated.
• In connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

Other than as set out above, we will attempt to notify you when your personal information will be shared with third parties.

Personal Information You Post in Public Areas. When you post a message in a Timeglass forum, chat room, message board, review, or customer feedback, the information you post may be accessible to other users of the Services and the public. If you post personal information anywhere on the Services that is accessible to other users or the public, you are advised that such personal information can be read, collected, used, or disseminated by others and could be used to send you unsolicited information or for other purposes. Accordingly, you assume full risk and responsibility for posting such information and agree that Timeglass is not responsible in any way for personal information you choose to post in these public areas. Aggregated Information. We may use, publish, share, distribute, or disclose personal information that has been aggregated with information from other users and otherwise anonymized and de-identified in a manner that does not allow third parties, including Timeglass partners, customers, and vendors, to de-identify the data or identify it as originating from you. Such information may help Timeglass identify and analyze training, demographic, and psychographic trends and information and report to third parties how many people saw, visited, or clicked on certain content, areas of the Services, or other materials. We may also use such data for research purposes and optimizing the Services’ functionality.

AI Processing

We use third-party AI services to generate Timesheet Reports, Invoices, activity summaries and meeting reports. Requests routed through OpenRouter, Inc. may include screenshots of active windows or desktops, visible documents and communications, application usage metadata, activity text and workspace context. Keystroke and mouse activity metrics do not include the content of keystrokes.

TypeSafe AI processes activity evidence and classification context for activity segmentation and project, client and category decisions through OpenRouter.

Meeting audio, where enabled, is captured on your device and uploaded to our cloud storage, then sent through OpenRouter for transcription using Microsoft MAI on Azure, with a DeepInfra-hosted Whisper fallback. Meeting transcripts, participant names and work context may be sent for speaker naming and meeting reports.

Direct Google Gemini Developer API calls support text and audio processing, report questions, avatar validation and embeddings. An optional workspace AI assistant may process chat messages and workspace context using OpenAI and hosted sandboxes.

Current chat-model and transcription routes request zero-data-retention endpoints that prohibit content collection and training. These endpoint controls do not mean that account or billing metadata is never retained; applicable legal and security exceptions may also apply. TypeSafe decision-model requests use a separate API with separate retention terms.

Some providers retain submitted content after processing for abuse monitoring, security or legal obligations under their applicable terms. Google documents 55-day retention of prompts, contextual information and responses for abuse monitoring in the paid Gemini Developer API. This retention applies separately from optional developer logging. Timeglass's zero-day screenshot deletion setting applies to our own storage and does not determine provider retention. Direct Google and OpenAI processing follows their applicable service terms and account settings.

We process this information to provide the Services, do not use AI for employee performance evaluations or unrelated profiling, and use paid AI services under terms that prohibit using your content to train general-purpose models. Google may use abuse-monitoring data for models specifically used for policy enforcement. Current providers, permitted fallback hosts and their processing scope are listed at https://timeglass.ai/sub-processors.

How We Store and Secure Your Information

Personal information collected by Timeglass may be stored and processed in your region, in the United States, and in any other country where Timeglass or its affiliates, subsidiaries, or service providers operate facilities. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective). However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Policy. Meeting audio, where enabled, is captured by an on-device recording component embedded in our desktop application; the component operates entirely locally and does not transmit audio or metadata to its vendor. Recordings are uploaded only to our own cloud storage for transcription as described in the AI Processing section, and meeting participants are presented with a consent flow before recording. Timeglass takes technological and organizational measures designed to protect your personal information against loss, theft, and unauthorized access, use, disclosure, or modification. For example:

• We transmit data over secured communication channels using SSL Login credentials;
• All personal information is stored by trusted third party providers (e.g., HubSpot, Clerk, Supabase, and Google Cloud Platform (GCP));
• All systems used to provide the Services are password protected;
• All Services usage is restricted on a per-user basis on the principle of least privilege; and
• All data is encrypted during transfer and while at rest.

Security and Compliance

Timeglass is SOC 2 Type II Certified. We have completed an independent SOC 2 Type II audit, which verifies our security controls for data protection, availability, and confidentiality. A copy of our SOC 2 report is available upon request.

We rely on the security policies of HubSpot’s, Clerk, Supabase, and GCP’s to protect personal information while stored in their respective controlled facilities. For more information on HubSpot’s security practices and processes, please see https://legal.hubspot.com/security. For more information on GCP’s security practices and processes, please see https://cloud.google.com/security. For more information on Clerk’s security practices and processes, please see https://clerk.com/legal/privacy . For more information on Supabase’s security practice and processes, please see https://supabase.com/security

Timeglass currently uses Stripe, Inc. (“Stripe”) for payment, analytics, and other business services. Stripe collects identifying information about the devices that connect to each of their services. Stripe uses this information to operate and improve the services they provide to Timeglass, including for fraud detection. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy. As with all third-party providers, Timeglass is not a party to any agreement between you and Stripe, and Timeglass does not control Stripe’s privacy and data security policies. Timeglass reserves the right to change payment processors at any time.

Timeglass complies with applicable data protection laws, including applicable security breach notification requirements.

Data Retention

Timeglass will retain your information as long as necessary for the purposes outlined in this Privacy Policy, in a manner consistent with our data retention policy discussed in this section, and for a commercially reasonable time thereafter for backup, archival, fraud prevention or detection or audit purposes or as permitted by applicable law. Timeglass will retain your personal information consistent with the original purpose of collection or as long as necessary to comply with our legal obligations; maintain accurate accounting, financial and other operational records; resolve disputes; and enforce our agreements. We will never retain your information for a period longer than permitted by law.

Workspace administrators may configure how long raw screenshots are retained. By default, Timeglass uses zero-day retention: each raw screenshot is deleted immediately after AI analysis completes. Administrators may choose a longer period. Derived activity records (such as minute summaries, activity data, and generated timesheet reports) are retained for as long as needed to provide the Services and are deleted upon verified deletion request or account termination in accordance with this Policy.

We determine the appropriate retention period for personal information on the basis of the amount, nature, and sensitivity of the personal information being processed; the purpose for which it was collected; the potential risk of harm from unauthorized use or disclosure of the personal information; whether we can achieve the purposes of the processing through other means; and applicable legal requirements.

Meeting-specific voiceprints are cleared after final processing or summary-skip cleanup; failed or incomplete processing may delay deletion. Reusable profiles and supporting samples are retained until you turn off Speaker Names, delete your account or workspace, or request deletion at privacy@timeglass.ai. Turn off Recognize my voice in Settings under Meetings to delete them across workspaces. There is currently no fixed automatic expiry or automatic deletion when a member leaves or is archived. Applicable legal retention limits still apply.

After expiration of the applicable retention periods, your personal information will be deleted. As discussed below, you may have the right to request we delete this information earlier.

Accessing and Updating Your Information

To the extent provided by the law of your jurisdiction, you may:

• Have the right to access certain personal information we maintain about you and request details about how we process it;
• Request certain information regarding our disclosure of personal information to third parties;
• Request that we update or correct inaccuracies regarding your personal information;
• Object to our use of your personal information;
• Ask us to block or delete your personal information from our database;
• Request to download the information you have shared on the Services; and
• Confirm whether Timeglass stores your data in the United States.

You may make these requests and any other inquiries about this Privacy Policy by emailing support@timeglass.ai. Any such requests are subject to the protection of other individuals’ rights and applicable law. Additionally, to help protect your privacy and maintain security, we may take steps to verify your identity before granting you access to the requested information.

Additional Privacy Information

Data Transfer

Our databases are currently located in the United States. Timeglass makes no claim that its Services are appropriate or lawful for use or access outside the United States. If you access the Services from outside the United States, you are consenting to the transfer of your personal information from your location to the United States. You are solely responsible for complying with all local laws, rules and regulations regarding online conduct and access to the Services. By providing us your information, you further consent to its storage within the United States.

Collection of Data from Children

The Services are not directed to children, and you may not use the Services or provide any personal information to Timeglass if you are under the age of 18. We do not collect or process personal information of individuals under the age of 18.

California Resident Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete your personal information
• Right to Correct: You may request that we correct inaccurate personal information
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information for targeted advertising purposes.
• Do Not Sell or Share My Personal Information

We may share personal information with third-party advertising and visitor identification partners (such as RB2B/Retention.com) in ways that may constitute a "sale" or "sharing" under California law. To opt out: Click the "Do Not Sell or Share My Personal Information" link in our website footer. Visit https://app.retention.com/optout to opt out of RB2B.

Enable Global Privacy Control (GPC) in your browser (we automatically honor GPC signals).

Meeting Video Recording

Last revised: October 16, 2026

This section explains optional meeting video recording. It supplements the collection, use, sharing, retention and rights sections of this Privacy Policy. These specific limits on video recording apply instead of any broader permissions elsewhere in this Policy.

What video recording can capture

Where optional meeting video recording is available and enabled with your knowledge and consent, Timeglass may also collect video of the meeting, including participant images, names, backgrounds, presentations and shared-screen content visible in the recording. This can include personal or confidential information about you, other participants and people whose information appears on screen. The content captured depends on the recording mode and the meeting content made available to it.

Optional video recording and your choices

Meeting video recording is optional. We record meeting video only with the recording user's knowledge and affirmative consent. Before enabling it, the user must be informed that video will be captured and of its purpose. You can decline video recording, turn it off or stop the recording using the available recording controls. You can continue using Timeglass features that do not require meeting video. Turning off your camera alone may leave other participants or shared-screen content in a meeting recording; stop or disable video recording to stop that capture.

The recording user and, for a customer-managed workspace, the customer must inform all affected participants before recording and obtain any consent required by applicable law, including from guests who do not have a Timeglass account. Participants must be told whether audio, video and shared-screen content will be recorded, why it is being recorded and who can access it. If required consent is absent or withdrawn, the recording user must not start or must stop the affected recording. A participant can ask the recording user to stop and can contact privacy@timeglass.ai about their information.

Accepting this Policy, joining a meeting, granting camera, microphone or screen-recording permissions, or enabling audio recording does not by itself constitute consent to meeting video recording. Automatic recording settings or an administrator's configuration do not replace the recording user's informed choice or any required participant notice and consent. Consent to recording does not authorise facial recognition or other biometric identification from video.

How meeting video is used and shared

We process meeting video to provide the recording and related meeting features you choose, such as playback and review. Recordings may be stored and processed by the infrastructure providers identified on our sub-processor list. Access through Timeglass is governed by the applicable meeting and workspace permissions; users who can access a recording may be able to share or export it through available features. Customers and recording users are responsible for limiting onward sharing to authorised recipients and purposes. Consent to video recording is not blanket permission to send video to every AI provider listed in this Policy. Before introducing materially different video processing, including additional AI analysis, we will explain the purposes, recipients and retention and obtain any further consent required by law. The general disclosure provisions of this Policy, including disclosures required by law, also apply to meeting video.

Video retention and deletion

Meeting video is subject to the retention and deletion provisions of this Policy and any applicable customer agreement or recording-specific retention information provided when the feature is enabled. We retain it only as long as needed for the disclosed purposes, subject to applicable legal obligations. Screenshot-retention settings and voiceprint-retention periods do not determine how long meeting video is kept.

Stopping or disabling video recording prevents future capture through that recording feature; it does not automatically delete an existing recording, transcript, summary or exported copy. To request access to or deletion of video containing your information, or to withdraw consent where processing relies on it, contact privacy@timeglass.ai and, for a customer-managed workspace, your workspace administrator. You do not need a Timeglass account to contact us. We may need to verify your identity and locate the recording. Requests are handled subject to applicable rights, deadlines and lawful exceptions; copies already exported or shared may also require action by their recipients.