Privacy policy
How Creditloom handles your data. Last updated 28 October 2026. This policy covers the service at creditloom.atesensoftware.com.
This policy is written to describe what the software actually does. It is not legal advice. If anything here is unclear, ask us.
Who we are
Creditloom is operated by Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye (“we”, “us”). You can reach us at support@atesensoftware.com.
What we keep, and for how long
| Data | How long |
|---|---|
| Sign-in details. Your Xero user ID, name and email address, received from Xero when you sign in. | While the account has an organisation connected. Deleted within 30 days of disconnecting the last organisation, or on request. |
| Xero tokens. The access and refresh tokens Xero issues when you authorise a connection. Encrypted at rest. | Deleted the moment you disconnect the organisation in Creditloom. Disconnecting also asks Xero to revoke the connection. |
| The credit note and invoice lists on screen. They come from Xero and are kept as an encrypted scan, so you can change strategy without more Xero calls. | Deleted after 24 hours. |
| An unused preview. A preview that is never run. | Deleted after 24 hours. |
| Job plans. Contact names, document numbers and references. Encrypted. The result CSV needs them, so download it within 30 days. | Deleted 30 days after the job finishes, or immediately when the organisation is disconnected. |
| Audit log and job rows. Credit note ID and number, invoice ID and number, allocation ID, amount, currency, allocation date, outcome code, timestamps and the idempotency key. No contact names. The amounts are financial data. | 12 months. |
| Billing records. Paddle customer, subscription and transaction IDs, the plan and the period. We never receive card data. | As long as the plan needs them and our legal and tax obligations require. |
| Server logs. IDs and codes only. Never tokens, names or amounts. | See “Hosting” below. |
Cookies
The pages you are reading load no scripts and nothing from other sites. There is no analytics script, no advertising or tracking pixel, and no third-party cookie in Creditloom. The server sets three cookies of its own:
| Cookie | What it is for | Lasts |
|---|---|---|
| cl_session | Keeps you signed in. Essential. | 14 days |
| cl_oauth | Carries the sign-in handshake with Xero from start to finish. Essential. | 10 minutes |
| cl_src | Set on your first visit only. It records the website you came from (its host name), the page you landed on and any utm_ tags in the link, so we know which guide or link brought you. It is not set when your browser sends Do Not Track or Global Privacy Control. | 30 days |
Paying happens at Paddle’s checkout, which is governed by Paddle’s own terms and privacy notice. After a purchase we send one plain-text thank-you and getting-started email to the address on your Paddle payment record, through Resend, and we do not store that address for this.
What we do not do
We do not sell your data and we do not use it for advertising. We do not use Xero data to train AI or machine-learning models. Xero data is used only to do what you asked Creditloom to do.
What we ask Xero for
Your sign-in identity (the scopes openid, profile, email and offline_access), accounting.invoices, which Xero lists credit notes and invoices under and which Creditloom uses for the credit note allocation calls, and accounting.settings.read, which lets Creditloom read the organisation’s period lock date and year-end lock date. We do not ask for access to contacts, payments, bank data or reports.
Why we process it
To provide the service you signed up for (contract), to keep it secure and working (legitimate interest), and to meet our legal and tax obligations (legal obligation).
Service providers
- Cloudflare provides the hosting and the database. It processes data on our instructions.
- Paddle takes payments as seller and merchant of record, under its own terms and privacy notice.
- Resend delivers the one thank-you email described above, under its own terms and privacy notice.
- Xero is the source of the data. You authorise the connection, and you can remove it in Xero at any time.
Hosting
Creditloom runs on Cloudflare. Like any host, it processes technical request data, such as your IP address, to deliver pages. Our own server logs hold IDs and codes only.
International transfers
Our providers may process data outside the country you are in. We rely on the contractual safeguards those providers offer.
Retention and deletion
- Disconnecting an organisation deletes its Xero tokens at once and removes its saved job plans.
- The scan, and a preview you never run, are deleted after 24 hours.
- Job plans are deleted 30 days after the job finishes.
- The audit log and job rows are kept for 12 months, then deleted.
- Sign-in details are deleted within 30 days of disconnecting the last organisation, or on your request.
Security
Xero tokens, scans, previews and job plans are encrypted at rest. Everything travels over HTTPS. We ask Xero for a single accounting permission group for documents, plus read access to settings, besides the sign-in identity. If we become aware of a breach affecting your data, we will notify you and Xero promptly.
Your rights
Depending on where you are (for example under the GDPR and UK GDPR, the Australian Privacy Act, the New Zealand Privacy Act, or Türkiye’s KVKK) you may ask for access to your data, correction, deletion, or a copy in a portable form. Email support@atesensoftware.com from the address on your account and we will answer within 30 days. If you are not satisfied, you may complain to your local data protection authority.
Children
Creditloom is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
Changes to this policy
We will post updates on this page and change the “last updated” date above. If a change is material, we will email you before it takes effect.
How to ask us something
Email support@atesensoftware.com. The support page explains what to include so that we can answer on the first reply.