Privacy notice
Updated 25 October 2026. Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye. Contact support@atesensoftware.com for privacy requests.
What the service uses
Xero user ID, name and email identify your account. Organisation IDs and names bind access to the right tenant. Invoice IDs, invoice numbers, contact names, dates, status, amount due, total and currency support the invoice list and previews. Contact and organisation payment terms are read when needed. OAuth permits invoice read/write, identity, offline refresh and settings read.
Storage and deletion
OAuth tokens, invoice snapshots, date-change plans, old dates and Xero error text are encrypted at rest by the application. Session snapshots expire after 24 hours; Refresh and Sign out clear them. Unrun previews expire after 24 hours. Completed job details and old dates expire after 30 days, ending Undo and detailed CSV access.
Disconnect deletes encrypted tokens, snapshots and job details immediately and attempts Xero revocation. The user record is deleted after the last organisation disconnects; other orphaned users are removed after 30 days. Identifiers, field names, outcome codes and job/audit times remain up to 365 days. Date values and contact names are not kept in those row tables.
Billing and providers
Cloudflare hosts the Worker and D1 database; Xero supplies accounting data; Paddle handles checkout as merchant of record. We store billing customer/subscription/transaction identifiers and plan periods, not card details. Billing event receipts expire after 400 days. Purchase and welcome-email deduplication records remain to prevent duplicate application or sending. Optional Resend sends a plain-text thank-you email; its recipient address is looked up for that send and is not stored by Duemend.
Cookies and your choices
cl_session lasts 14 days; cl_oauth lasts 10 minutes. Optional cl_src remembers referral host/path and UTM fields for 30 days and is disabled by DNT or GPC. No advertising or analytics scripts, third-party cookies, data sales or AI/ML training with Xero data. Request access, correction or deletion through support. Service providers may process data internationally under their own safeguards.


