AI Time Tracking Privacy: What the AI Sees and What It Shouldn’t

AI features in a time tracker read the same data your reports already show: hours, apps, websites, and activity levels. Then they turn that data into conclusions about people, like a productivity label, a burnout flag, or a daily summary. That’s why AI time tracking privacy needs two clear lists: what the AI reads, and what it should stay away from.

We’ve put both lists together for WebWork, along with the settings that control them. We also cover what Claude, ChatGPT, or another AI assistant can see once you connect it to your WebWork workspace.

What WebWork’s AI Reads, Feature by Feature

Several WebWork AI features use activity level as an input. WebWork counts mouse clicks, scrolls, and keystrokes during tracked time and rates each member’s activity as High, Medium, or Low. It counts keystrokes without capturing the characters someone types.

Here’s what each AI feature reads and what it gives you:

For example, the AI can label LinkedIn as Productive for your marketing team and Neutral for your developers. Managers can change any label for a single team or for the whole workspace.

Smart Monitoring’s detailed view shows the exact factors behind each label. Open it before you act on an Attention Needed or Negative label.

What WebWork’s AI Doesn’t Have Access To

WebWork’s AI policy sets the default for AI access: AI systems have no access to screenshots, screen recordings, keystrokes, or similar data unless a specific AI feature requires it and a user or admin has enabled that feature.

The same policy sets a few more limits:

1. WebWork doesn’t use customer or workspace data to train AI models. Its AI providers, OpenAI and Anthropic, can’t use WebWork data for training either.
2. Those providers may keep request data for up to 30 days for abuse monitoring, and then delete it.
3. Each AI request uses only the workspace data that the function you started needs.
4. Health, financial, and other sensitive data isn’t processed unless a user includes it in an AI prompt.
5. WebWork AI doesn’t make employment, disciplinary, or compensation decisions. Its outputs are advisory, and users and admins need to validate them before applying them to HR processes.

Two more limits come from how WebWork tracks. App and website monitoring runs only while the timer is on. And when you track AI tool usage across your team, WebWork shows which AI tools people use and how long they spend in them, without capturing prompts or conversations.

5 Things AI Time Tracking Shouldn’t See (or Decide)

Some of these limits come from law, and some come from regulator guidance. We’d apply all five to any AI time tracking tool, WebWork included.

1. Emotions and personal traits

Since February 2, 2025, the EU AI Act (Article 5) has banned AI systems that infer the emotions of a person at work, unless the system is there for medical or safety reasons. WebWork’s AI policy also prohibits using WebWork AI to infer protected characteristics or sensitive attributes.

2. Camera images

In its guidance on monitoring workers, the UK Information Commissioner’s Office (ICO) says employers are “particularly unlikely to be able to justify capturing webcam shots or footage.”

For example, the ICO describes an employer that found a few remote workers starting later than their timesheets showed and rolled out device monitoring with automatic webcam images. The ICO’s view is that this is likely to break data protection law, because it’s disproportionate and there are less intrusive ways to check start times. In WebWork, the attendance report detects late starts and early finishes automatically.

3. What people type

The ICO classifies keystroke monitoring as behavioral biometric data when a worker can be identified by their typing rhythm, and it lists keystroke monitoring as an example of high-risk processing. In the UK, high-risk monitoring needs a data protection impact assessment (DPIA) before it starts.

WebWork uses keystroke counts for activity levels and doesn’t record the keys themselves.

4. The content of someone’s work

WebWork records time spent on applications and projects. As we explain in our post on privacy-conscious employee monitoring, time tracking data doesn’t include the content of the work itself.

If you’re considering monitoring emails and messages, the ICO says you must complete a DPIA first.

5. The final decision on pay, discipline, or a job

Under GDPR Article 22, people have the right not to be subject to a decision based solely on automated processing when it has legal or similarly significant effects on them. The ICO gives a direct example: paying workers based entirely on automated monitoring of their productivity counts as a solely automated decision.

The ICO also says the people reviewing AI outputs shouldn’t just routinely apply the automated recommendation. In another of its examples, an HR manager reviews a worker’s vehicle tracking data and discusses the issue with the worker before issuing a warning, and that decision is not solely automated. Use a burnout flag or a Smart Monitoring label the same way: as a reason to check the data and talk to the person.

EU teams have one more date to note. The AI Act lists AI systems used to monitor and evaluate the performance and behavior of workers as high-risk (Annex III). After the 2026 Digital Omnibus amendment, those high-risk rules apply from December 2, 2027.

The ICO notes that its monitoring guidance is under review after the UK’s Data (Use and Access) Act. This article isn’t legal advice, so check the rules that apply where your team works. Our guide on whether employee monitoring is legal for remote teams covers more of the legal side.

AI Time Tracking Privacy Settings to Check Before You Turn AI On

Here are the WebWork settings that control what the AI reads and who sees the results:

1. AI features and access. Workspace admins can turn WebWork AI features on or off, restrict specific AI capabilities, limit which roles or users can use AI, and review or delete AI-generated content. Smart Monitoring is a paid add-on, so it’s off until you enable it. Its Configuration tab lets you choose which insights you receive by email or notification.
2. App and website categories. Review how the AI labeled your team’s tools, and change any label per team or for the whole workspace.
3. Screenshots. In Settings > Screenshots, you can make screenshots blurred or silent. You can also set the frequency from 1 to 10, show a pop-up when a screenshot is taken, disable screenshots selectively, and set a different screenshot mode per project or per contract.
4. Who sees what. Team Managers see data for their own teams, Project Managers see data for their own projects, and Regular Users see only their own data. The Workspace Owner and Executive Managers see the whole workspace. Here’s the full breakdown of member roles and permissions.

What Claude or ChatGPT Sees Through WebWork’s MCP Connector

WebWork’s MCP connector links an AI assistant such as Claude, ChatGPT, Gemini, Microsoft Copilot, or Cursor to your workspace. Once it’s connected, you can ask the assistant about anything you’d normally open a report for, or ask it to make changes like approving timesheets.

Access works like this:

1. Only the Workspace Owner or an Executive Manager with a verified email address can connect. Other member types can’t.
2. The assistant acts as the signed-in user, with that person’s role and permissions. In the words of our connector guide, “Connecting an assistant doesn’t expand anyone’s access.”
3. It can read the reports you can open, including time, activity, activity descriptions, apps and websites, attendance, timeline, real-time, GPS, and task reports. Screenshots come back read-only, with the member, project, and task each one belongs to.
4. The connector doesn’t keep a separate copy of your workspace data.

Changes have their own safeguards. Deleting or archiving anything needs your explicit confirmation, and the assistant tells you before an action sends a real email, such as a member invitation or a leave approval. During sign-in, you choose whether to grant read, write, or admin access, and your AI client lets you approve tools one at a time. You can disconnect at any time.

A connected assistant can see whatever the person who connected it can see. For a Workspace Owner, that includes screenshots, GPS history, and app usage for the whole workspace. A few habits help:

1. Ask for the data the question needs. For example, ask for team-level hours when you’re planning capacity. The ICO suggests aggregated analytics reports as a way to see trends without identifying individual workers.
2. If you only want reports, grant read access at sign-in and leave write and admin off.
3. Before you pull employee data into a chat, check your AI provider’s settings for chat history and model training. The connector returns its results into your conversation with that assistant.

Make AI Time Tracking Privacy Part of Your Rollout

Tell your team what the AI reads before you turn it on. The ICO says that, apart from very exceptional cases, you must inform workers about any monitoring, and do it in a way that is accessible and easy to understand. The table at the top of this article and WebWork’s AI policy are a good place to start that conversation.