Privacy policy

Last updated 29 October 2026. Controller for website and account data: Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye ("we"). For the Clio data you process with Tidyroll, your firm is the controller and we act as your processor.

Data we process

• Account data: your Clio user id, name and e-mail address (from Clio's "who am I" endpoint), your Clio region, and settings.
• Clio contact data you ask us to scan: contact names, e-mail addresses, phone numbers, postal addresses, company, custom field values, created/updated dates, and flags showing client-portal or co-counsel access and non-zero balances.
• Merge data for merges you start: ids of linked matters, relationships, communications and documents, and the ids of contacts that are calendar attendees (to block those merges); the text of notes on the duplicate (to copy them).
• Billing data: handled by Paddle (merchant of record). We receive the subscription/transaction status and ids, not card details. After a purchase we send one plain-text thank-you and getting-started e-mail, through Resend, to the address on your Paddle payment record; we read that address from Paddle for this one message and do not store it (we keep only a note that the e-mail was sent).
• Technical logs: ids, counts, error codes and timestamps. No names, e-mails, phone numbers or note text.

What we do not do

We do not read document files, bills, trust ledgers or matter descriptions. We do not sell data, use it for advertising, or use it to train AI models. Nothing is shared except with the sub-processors below, as needed to run the service.

Waitlist

You can join a waitlist to hear when Tidyroll opens, or, while merging is not open yet, when merging opens. We store only the e-mail address you enter, the date you joined and the page the form was on. We use it only to send you that one message, never share or sell it, and the legal basis is your consent, which you can withdraw at any time. It is deleted when you ask us at support@atesensoftware.com, and automatically 12 months (365 days) after you joined.

Retention

• Contact snapshot and duplicate groups: deleted 7 days after the scan.
• Change journal (needed for undo): deleted 30 days after the job finished.
• OAuth tokens and account data: until you disconnect or delete your data.
• Aggregate counts and billing records: as long as needed for the service and legal obligations.
• Waitlist e-mail addresses: deleted 365 days after sign-up, or earlier on request.

"Delete my data" in Settings removes your snapshots, groups, plans, journal, tokens and sessions immediately and revokes our access in Clio.

Security

Encryption in transit (TLS) and at rest (AES-256-GCM for tokens and contact data), least-privilege Clio permissions, access limited to the operator, audit journal. Details: Security.

Sub-processors and transfers

Cloudflare, Inc. (hosting and database, global network), Paddle.com Market Ltd (payments), Resend, Inc. (e-mail). Data may be processed outside your country, including in the United States and Türkiye (operator access for support). Where the GDPR or UK GDPR applies, transfers rely on the providers' standard contractual clauses; a data processing agreement is available on request.

Your rights

You can access, correct, export or delete your data, and object to processing, by writing to support@atesensoftware.com. EU/UK users may complain to their data protection authority.

Contact

Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye · support@atesensoftware.com