Privacy policy
How Repeatwise handles your data. Last updated 26 October 2026. This policy covers the service at repeatwise.atesensoftware.com.
This policy is written to describe what the software actually does. It is not legal advice. If anything here is unclear, ask us.
Who we are
Repeatwise is operated by Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye (“we”, “us”). You can reach us at support@atesensoftware.com.
What we keep, and for how long
| Data | How long |
|---|---|
| Sign-in details. Your Xero user ID, name and email address, received from Xero when you sign in. | While the account has an organisation connected. Deleted within 30 days of disconnecting the last organisation, or on request. |
| Xero tokens. The access and refresh tokens Xero issues when you authorise a connection. Encrypted at rest. | Deleted the moment you disconnect the organisation in Repeatwise. Disconnecting also asks Xero to revoke the connection. |
| The template list on screen. Read from Xero when you open the page or ask for a preview and sent to your browser. | Not stored by Repeatwise. |
| An unused preview. The plan Run would use (customer names, lines, old and new prices). Encrypted. | Deleted after 24 hours if you never run it. |
| Job plans and saved originals. These include customer names, references, lines and prices. Encrypted. | Deleted 30 days after the job finishes, or at once when you disconnect the organisation. |
| Job log. Counts, template IDs, outcome codes and timestamps. No names and no amounts. | 12 months. |
| Billing records. Paddle customer, subscription and transaction IDs, the plan and the period. We never receive card data. | As long as the plan needs them and our legal and tax obligations require. |
| Server logs. IDs and codes only. Never tokens, names or amounts. | See “Hosting” below. |
Cookies
The pages you are reading load no scripts and nothing from other sites. There is no analytics script, no advertising or tracking pixel, and no third-party cookie in Repeatwise. The server sets three cookies of its own:
| Cookie | What it is for | Lasts |
|---|---|---|
| rw_session | Keeps you signed in. Essential. | 14 days |
| rw_oauth | Carries the sign-in handshake with Xero from start to finish. Essential. | 10 minutes |
| rw_src | Set on your first visit only. It records the website you came from (its host name), the page you landed on and any utm_ tags in the link, so we know which guide or link brought you. It is not set when your browser sends Do Not Track or Global Privacy Control. | 30 days |
Paying happens at Paddle’s checkout, which is governed by Paddle’s own terms and privacy notice. After a purchase we send one plain-text thank-you and getting-started email to the address on your Paddle payment record, through Resend, and we do not store that address for this.
What we do not do
We do not sell your data and we do not use it for advertising. We do not use Xero data to train AI or machine-learning models. Xero data is used only to do what you asked Repeatwise to do.
What we ask Xero for
Your sign-in identity (the scopes openid, profile, email and offline_access) and one permission group, accounting.invoices, which covers repeating invoices. We do not ask for access to contacts, payments, bank data or reports.
Why we process it
To provide the service you signed up for (contract), to keep it secure and working (legitimate interest), and to meet our legal and tax obligations (legal obligation).
Service providers
- Cloudflare provides the hosting and the database. It processes data on our instructions.
- Paddle takes payments as seller and merchant of record, under its own terms and privacy notice.
- Resend delivers the one thank-you email described above, under its own terms and privacy notice.
- Xero is the source of the data. You authorise the connection, and you can remove it in Xero at any time.
Hosting
Repeatwise runs on Cloudflare. Like any host, it processes technical request data, such as your IP address, to deliver pages. Our own server logs hold IDs and codes only.
International transfers
Our providers may process data outside the country you are in. We rely on the contractual safeguards those providers offer.
Retention and deletion
- Disconnecting an organisation deletes its Xero tokens at once and removes its saved job plans and originals.
- The template list on screen is not stored. A preview you never run is deleted after 24 hours.
- Job plans and saved originals are deleted 30 days after the job finishes.
- Job logs are kept for 12 months, then deleted.
- Sign-in details are deleted within 30 days of disconnecting the last organisation, or on your request.
Security
Xero tokens, previews, job plans and saved originals are encrypted at rest. Everything travels over HTTPS. We ask Xero for a single permission group besides the sign-in identity. If we become aware of a breach affecting your data, we will notify you and Xero promptly.
Your rights
Depending on where you are (for example under the GDPR and UK GDPR, the Australian Privacy Act, the New Zealand Privacy Act, or Türkiye’s KVKK) you may ask for access to your data, correction, deletion, or a copy in a portable form. Email support@atesensoftware.com from the address on your account and we will answer within 30 days. If you are not satisfied, you may complain to your local data protection authority.
Children
Repeatwise is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
Changes to this policy
We will post updates on this page and change the “last updated” date above. If a change is material, we will email you before it takes effect.
How to ask us something
Email support@atesensoftware.com. The support page explains what to include so that we can answer on the first reply.