Trust

AI transparency

Last updated 26 August 2026

Timetrackr uses AI in five places. This page says what each one does, what it is given, what it produces, where a human stays in control, and where it can be wrong — so that a buyer, an employee whose work it records, and a regulator can all read the same account.

The short version

No AI feature in Timetrackr makes a decision about a person on its own. Every output is advisory, editable, and attributed. If you run Timetrackr against a local model, no ticket content leaves your network at all.

Every AI feature, in plain terms

Auto Track — session summarisation

What it does: Captures a screen recording of a work session and generates a written summary and a time entry against the ticket.
What it is given: Screen frames that changed during the session, and the ticket the session is attached to.
What it produces: A natural-language summary and a duration. Both are editable before they are billed.
Human oversight: The engineer starts and stops every recording, sees the generated entry, and can edit or delete it before it reaches an invoice.
Known limitations: Summaries can miss context that was never on screen, and can misdescribe unfamiliar software. They are a record of what was displayed, not a judgement about the person.

Reply drafting

What it does: Drafts a response to a ticket in the writing style of the engineer who owns it.
What it is given: The ticket conversation and the engineer’s previous replies.
What it produces: A draft reply, never sent automatically.
Human oversight: An engineer must read, edit and send. Nothing leaves the system unreviewed.
Known limitations: Drafts can state things confidently that are wrong. They are a starting point for a human, not a substitute for one.

Browser agent

What it does: Drives a real browser to carry out routine steps on a ticket.
What it is given: The ticket, and pages on an allow-listed set of domains.
What it produces: Actions taken in the browser, each written to a server-side audit log.
Human oversight: Anything that sends, submits, pays or deletes pauses for explicit human approval. The agent is never given passwords or payment details.
Known limitations: The agent can misread a page or take a wrong-but-permitted action. The allow-list and the approval gate are the controls, not the model’s judgement.

Master AI — cross-ticket assistant

What it does: Answers questions across the whole ticket history, for recurring-issue analysis and client reviews.
What it is given: Ticket records the asking user is already authorised to read.
What it produces: A natural-language answer grounded in those records.
Human oversight: Answers are advisory. Access follows the user’s existing permissions, so it cannot surface records they could not otherwise open.
Known limitations: Context is budgeted to keep the feature runnable on a small local model, so an answer may rest on a subset of the record. Verify before relying on it for a decision.

Compliance assessment

What it does: Flags where ticket handling may relate to ISO 27001 controls.
What it is given: Ticket content and its change classification.
What it produces: Suggested control references and observations.
Human oversight: Advisory only. It is not a certification, an audit, or evidence of conformity.
Known limitations: Suggestions are indicative and must be confirmed by whoever owns the control.

Where your data goes

The AI provider is a configuration choice made by the customer, not by us:

Local models. Point Timetrackr at your own hardware through LM Studio and no ticket content reaches any third party. The same features work.
Your own API key. Content goes to OpenAI or Anthropic under your agreement with them, governed by Standard Contractual Clauses.
Each engineer can select their own model, and screen analysis can be pointed at a stronger model than the rest of the system.

Our position under the EU AI Act

Regulation (EU) 2024/1689 applies obligations by risk tier and by role. Leratech Solutions S.R.L is the provider of Timetrackr. An organisation that runs it is the deployer. Both carry duties, and they are not the same duties.

Transparency (Article 50)

Users are told when they are interacting with an AI system and when content was AI-generated. Drafted replies are marked as drafts, agent actions are logged as agent actions, and generated time entries record that they were generated.

Workplace monitoring — read this part carefully

Annex III(4) of the AI Act treats AI systems intended to monitor and evaluate the performance and behaviour of people in a work relationship as high-risk. Auto Track records an employee’s screen and produces a summary of their work. Whether a given deployment falls inside that definition depends on how the customer uses it — a tool that reconstructs billable time is not the same as a tool used to appraise, rank or discipline staff, but the same feature can be put to both uses.

We do not intend Timetrackr to be used for performance evaluation, and we do not provide scoring, ranking or productivity metrics about individuals. If you intend to use recordings to assess staff, that changes the classification and the obligations that follow, and you should take your own legal advice before doing so.

What deployers must do

Independently of the AI Act, recording employees engages the GDPR, and in most EEA states also employment law. Before switching Auto Track on, a deployer should expect to:

Carry out a Data Protection Impact Assessment (GDPR Art. 35) — systematic monitoring of employees ordinarily requires one.
Identify a lawful basis. Consent is rarely valid in an employment relationship because of the imbalance of power; a legitimate-interest assessment is the usual route, and it has to be documented.
Inform staff clearly and in advance about what is recorded, when, and who can see it.
Consult the works council or employee representatives where national law requires it — Germany, the Netherlands and the Nordics all have rules here.
Ensure AI literacy among the people operating the system (AI Act Art. 4, in force since February 2025).

We support these obligations with the audit trail, per-feature configuration, and the ability to disable any AI feature entirely.

What Timetrackr is not

Not an emotion-recognition system, and not a biometric categorisation system.
Not a productivity score, a ranking, or an automated performance appraisal.
Not a system that takes decisions with legal or similarly significant effects on a person without human involvement (GDPR Art. 22).
Not a certification or audit tool, notwithstanding the ISO 27001 observations.

Scope of this statement

This page describes how the product works and the obligations we understand to apply. It is not legal advice, and it cannot classify your particular deployment for you. Obligations for high-risk systems under the AI Act phase in through 2026 and 2027; where your intended use may fall into Annex III, take your own advice.

Questions

Write to privacy@timetrackr.it. See also our Privacy Policy and sub-processors.