Privacy policy

Last updated: 29 October 2026

Controller: Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye (“we”). Contact: support@atesensoftware.com.

What we process and why

• Your Intuit sign-in identifier (an opaque user id from Intuit's OpenID Connect). We do not request your e-mail address, name, phone or address from Intuit. Purpose: to keep your exports and plan separate from other users.
• QuickBooks access tokens for each company you connect, encrypted with AES-256-GCM. Purpose: to read transactions and attachments when you ask for an export. We request the single QuickBooks accounting permission Intuit offers; the app only reads and never writes to QuickBooks.
• Export metadata while an export exists: transaction dates, numbers, vendor/customer names, amounts, account ids and attachment file names of the transactions matching your filters. Purpose: to build the preview, the file names and the index. It is deleted automatically 72 hours after the export was created (hourly cleanup), immediately when you delete the export, and immediately when you disconnect the company.
• Attachments (receipts, invoices, documents) pass through our server only while they are streamed into your ZIP download. They are never written to disk, a database or any storage on our side.
• Billing: Paddle.com is the merchant of record and collects your payment and billing details. We receive the subscription/transaction status and a Paddle customer id, never your card details. After a purchase we send one plain-text thank-you and getting-started email to the address on your Paddle payment record, through Resend, and we do not store that address for this.
• Technical logs: ids, counts and error codes only (no names, amounts, file names or tokens), kept by our host for a short period for security and troubleshooting.

Waitlist

If you join the waitlist we store only your e-mail address and the date you joined. We use them only to tell you when Attachment Bundler opens, never share them, and delete them when you ask at support@atesensoftware.com or automatically 12 months after you joined.

Legal bases (GDPR/KVKK)

Performance of our contract with you (providing the export), our legitimate interest in security and fraud prevention, your consent for the waitlist (withdraw it at any time by e-mail), and legal obligations for billing records (handled by Paddle).

Processors

• Cloudflare, Inc. (hosting, database; data may be processed in the EU, US and other regions)
• Paddle.com Market Ltd (payments, merchant of record)
• Intuit Inc. (QuickBooks Online API, sign-in)
• Resend (operator alert e-mails, and the one thank-you email after a purchase)

Retention

Export metadata: up to 72 hours. Connections: until you disconnect or 180 days without use (then revoked, and the tokens and company name are deleted; the QuickBooks company id and the number of free files used stay, so the free allowance of that company stays correct). Account id and billing status: while you have an account and as long as needed for billing records. Disconnecting the app inside QuickBooks also revokes our access.

Your rights

You can delete exports and disconnect companies at any time on the Exports page, and remove your exports, sessions and company connections with “Delete my data” (the account id, billing status and the free-files counter stay). For access, correction, objection or deletion requests, including erasing those, e-mail us; we answer within 30 days. You may also complain to your data protection authority.

We do not sell personal data, use it for advertising or share it with anyone other than the processors above, and we show your QuickBooks data to no one but you.