Privacy policy
Last updated: 29 October 2026. Payslip Drop is operated by Samet Ateşen, trading as Atesen Software, Sakarya, Türkiye ("we", "us"). Contact: support@atesensoftware.com.
Short version
- Your PDFs are split and matched in your browser. We never receive them for that.
- When you upload to BambooHR, each PDF passes through our server as a stream on its way to BambooHR. It is not written to disk, a database, a cache or logs.
- We store your company's BambooHR subdomain, encrypted access tokens, saved matching profiles and upload results identified by BambooHR employee IDs only. No names, file names or document content.
Roles
For the payroll documents and employee data you process with Payslip Drop, your company is the controller and we act as a processor on its instructions. For your account, billing and support contacts we are the controller. Ask us for a data processing agreement if you need one.
PDF files
The free ZIP download, the text reading, matching and splitting run entirely in your browser tab (pdf.js and pdf-lib). The files stay in the tab's memory and are gone when you close it. When you start an upload, the browser sends each finished PDF to payslipdrop.atesensoftware.com/api/…/upload, and our Cloudflare Worker forwards the same bytes in the same request to yourcompany.bamboohr.com. Nothing of the file is kept after the request ends.
Data from BambooHR
After you connect, the app reads from BambooHR: the active employees' internal ID, employee number, first, last, preferred and display name (to match pages), and the file folders you can see (to choose where files go). These are passed to your browser and not stored by us. To confirm uploads, we read the file list of the employees you uploaded to.
What we store
| Data | Why | How long |
|---|---|---|
| Company subdomain (e.g. acme) | Your account | Until 30 days after the last person disconnects, unless a subscription is still running |
| OAuth access and refresh tokens (AES-256-GCM encrypted) and granted scopes, per connected user | Calling BambooHR for you | Until that user disconnects or BambooHR refuses the access (e.g. revoked); a revoke is noticed the next time we contact BambooHR for that user, and at the latest in our daily check of connections that were not used for a week |
| Pseudonymous user key (a keyed hash of BambooHR's user identifier: the OpenID subject, or your own BambooHR employee ID when BambooHR sends no subject) and a connection counter | Keeping each person's connection and runs apart; a connection is never shared between people | As tokens |
| Saved matching profiles (labels, pattern, file name pattern, folder ID, the creator's pseudonymous key, revision number). The "show to employees" choice is never saved. | Reuse every month; only the creator can change a profile | Until deleted or disconnect |
| Upload runs: BambooHR employee ID, file size, a one-way hash of the source file, page numbers and employee, how the employee was decided (automatically, approved, by hand), status, attempts, BambooHR file ID | Progress, resume without duplicates, undo, your report | 90 days; deleted at once when the last connected user of the company disconnects, or 30 days after BambooHR refused the last user's access |
| Monthly usage: which employee IDs received a file this period | Plan limits | 13 months; the free trial's employee IDs stay until the company's data is deleted (when the last connected user disconnects); on deletion only the number of employees this period remains |
| Operator alert counters (event type, hour, count) | Noticing configuration errors | 7 days |
| A keyed hash of your company subdomain | One free trial per company | Kept |
| Paddle subscription and customer IDs, plan, status, and whether the one thank-you e-mail was sent | Billing | As long as accounting law requires |
| Waitlist: your e-mail address, the sign-up time and which page the form was on | One e-mail when direct upload to BambooHR opens | 12 months, or until you ask us to delete it |
When the last connected user of your company disconnects, we delete the tokens, profiles, runs and usage at once (BambooHR's developer terms require deletion within 30 days); only this period's number of employees is kept, for plan limits. You can also revoke access in BambooHR at any time: we delete that user's tokens as soon as we notice (within about a week at the latest) and keep the upload history for up to 30 days, so uploads can still be checked or undone after reconnecting; after that it is deleted as above.
Waitlist
Before direct upload to BambooHR opened, you could leave your e-mail address on the waitlist. We store the address, the time you signed up and which page the form was on, nothing else. We use it once, to tell you that uploading has opened; it is not shared, sold or used for newsletters. It is deleted automatically 12 months after you signed up, or earlier when you write to support@atesensoftware.com. The legal basis is your consent, which you can withdraw at any time.
Logs
Our service logs contain event names, account and run IDs, HTTP status codes and counts. They never contain names, e-mail addresses, file names, employee numbers or IDs, tokens or document content. File names and employee IDs travel inside request bodies, never in web addresses, so Cloudflare's request logs (kept for a short time to run and protect the service) do not see them either.
Payments
Payments are handled by Paddle.com Market Limited, our reseller and Merchant of Record. Paddle collects your name, e-mail, billing address and payment details under its own privacy notice. We receive the subscription status, plan and IDs. After a purchase we send one plain-text thank-you and getting-started e-mail, through Resend, to the address on your Paddle payment record; we read that address from Paddle for this one message and do not store it.
Cookies and storage
We set one session cookie after you connect, and a short-lived cookie during the BambooHR sign-in. There are no analytics or advertising trackers. Your browser's local storage remembers your matching settings on this device. Paddle's checkout sets its own cookies when you open it.
Sub-processors
| Company | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. (USA, global network) | Hosting (Workers, D1 database, static files) | Everything listed above; PDFs in transit during uploads |
| Paddle.com Market Limited (UK) | Payments, invoices, tax | Billing data |
| Resend, Inc. (USA) | Operator alert e-mails to us; the one thank-you e-mail after a purchase | Account and subscription IDs; the buyer's e-mail address for that one message |
BambooHR is your own system: we send data there only on your instruction.
Security
OAuth only, no API keys. Least-privilege scopes (employee names and job information for matching, employee files read and write). Tokens encrypted at rest. Every upload run is previewed in a dry run; any change after it needs a new dry run. Uploads need a typed confirmation above ten employees, and always when files go straight to employees. Files are hidden from employees by default. A switch lets us stop all uploads at once. Report security issues to support@atesensoftware.com with "SECURITY" in the subject.
Your rights
You can ask for a copy of the data we hold about you or your company, for correction or for deletion, by e-mail. We answer within 30 days. If you are in the EU/EEA, the UK or Türkiye you may also complain to your data protection authority.
Changes
We change the date at the top when this policy changes, and e-mail paying customers about material changes.