Privacy policy

Last updated 24 October 2026. For your account data the controller is Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye ("we"). For the attendance data of your meetings, you (or your organization) are the controller and we are your processor (see data processing terms).

Data we process

• Account: your Microsoft Entra tenant id and user id, display name and e-mail address, settings (time zone, retention, e-mail preference), sign-in times.
• Microsoft access: OAuth access and refresh tokens (encrypted), the permissions granted.
• Series you add: calendar ids, meeting subject, occurrence dates and times, the online-meeting id behind the join link.
• Attendance reports of those series: for each attendee as reported by Microsoft — display name, e-mail address, Entra id and tenant id (if present), role, join and leave times, total time. Session start/end and participant count.
• Billing: handled by Paddle. We receive subscription status and ids, never card details.
• Purchase e-mail: after a purchase we send one plain-text thank-you and getting-started e-mail, through Resend, to the address on your Paddle payment record; we do not store that address for this.
• Technical logs: ids, counts, error codes and timestamps — no names, e-mail addresses or meeting subjects.

Waitlist

Before sign-in opens you can join a waitlist. We store only your e-mail address, the date and which page the form was on, on the basis of your consent. We use them only to e-mail you once, when you can sign in, and never share them. They are deleted on request (write to support@atesensoftware.com) or automatically after 12 months.

What we do not do

We do not read meeting chats, recordings, transcripts, e-mails or files. We do not write anything to Microsoft 365. We do not sell data, use it for advertising or to train AI models.

Retention and deletion

• Attendance archive: kept for the retention you choose in Settings (6, 12, 24 — default — 36 or 60 months), then deleted automatically.
• Removing a series deletes its archive immediately. "Delete all my data" deletes your series, archive, tokens, sessions and account data immediately.
• Kept after deletion: a keyed hash of your Microsoft ids with the trial end date (so a trial is used once), Paddle's records (Paddle is the seller), and logs for up to 30 days.

Security

TLS in transit; AES-256-GCM at rest for tokens, names, e-mail addresses, subjects and attendance records; read-only delegated permissions; access limited to the operator. Details: Security.

Sub-processors and transfers

• Cloudflare, Inc. (USA) — hosting, database (Workers, D1), global network.
• Resend, Inc. (USA) — sending the monthly summary and service e-mails.
• Paddle.com Market Ltd (UK) — payments as merchant of record (billing data only).

Data may be processed outside your country, including the United States and Türkiye (operator access for support). Where the GDPR, UK GDPR or Turkish KVKK applies, transfers rely on the providers' standard contractual clauses and the safeguards described in the data processing terms.

Your rights

Access, correction, export, deletion and objection: write to support@atesensoftware.com (subject "PRIVACY"). Attendees of your meetings should contact the organizer, who controls that data; we help the organizer answer. EU/UK users may complain to their data protection authority; users in Türkiye to the KVKK Board.

Contact

Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye · support@atesensoftware.com · Series Attendance Roster