Privacy Policy

This policy explains what information Skin by Issa, LLC, a Florida limited liability company operating as IssaBudget (“IssaBudget”, “we”, “us”), collects when you use the application and website at issabudget.com (the “Service”), how we use it, and the choices you have. The short version: we collect what the Service needs to work, we sell nothing, we show no ads, and your books belong to you.

1. Information you give us

Account information: your email address, your first and last name, your phone number, and your business name. Name and phone number are asked for when you create your account; we use them to identify your account, to reach you about the Service, and to help you if you contact support. Business location: the country your business operates in, and, if that country is the United States, the state and, where you tell us, the county or city. We use this only to suggest the sales-tax rate for your area; you confirm or replace the rate yourself, and you can turn sales-tax tracking off entirely. Business records: the information you enter to run your business in the Service, including transactions, account balances, budget envelopes, services and prices, vendors, and your client list (which may include client names, contact details, birthdays, visit history, and service notes you write). Support conversations: if you contact support, we keep the conversation so we can help you.

2. Information collected automatically

Inside your account (every screen you see after you sign in) we use cookies strictly to make the Service function: to keep you signed in and to remember preferences such as your chosen theme. There are no advertising cookies and no marketing trackers anywhere behind the sign-in screen. On our public pages, the ones anyone can visit without an account, we do use measurement tools; Section 5 names them and says exactly what they can and cannot see, and how to switch them off. Our infrastructure providers keep standard server logs (such as IP address, browser type, and pages requested) for security and reliability.

3. Your clients’ information

Client records in the Service belong to your business, and you control them. We process them only to provide the Service to you: storing them, backing them up, and showing them to you and the team members you invite. We never contact your clients, never build profiles of them, and never use their information for marketing or any purpose of our own. If your client asks you to correct or delete their information, the tools to do that are in your hands inside the Service, and we will help if you need it.

4. How we use information

We use information to operate the Service, keep your account secure, provide support, process subscription payments, send transactional messages about your account (such as sign-in codes and billing notices), and improve reliability. We do not sell or rent personal information, and we do not send third-party marketing. Nothing you enter into your books (no transaction, client, figure or note) is ever used for advertising, ours or anyone else’s. The one thing that does touch advertising is described next, and it is limited to pages you can reach without an account.

5. What runs on our public pages

What runs, and where. Our marketing and sign-up pages (the homepage, the sign-in and sign-up pages, and these legal pages) may load the Meta pixel and Google Analytics, so we can tell which adverts and which posts actually bring people to IssaBudget. They record that a page was viewed, roughly where the visit came from, and the ordinary browser information any website receives, and they set their own cookies to recognise a returning visit. Meta and Google may use what they collect for their own purposes under their own policies, including advertising.

Where they never run. Neither is loaded on any page behind the sign-in screen. Not one screen of your books (your budget, your accounts, your clients, your reports, your figures) is visible to either company. That is enforced in the software itself, by an allow-list of public pages, not by policy alone: a page is untracked unless someone deliberately adds it to that list.

How to turn it off. If your browser sends a Global Privacy Control or Do Not Track signal, we honour it: neither the Meta pixel nor Google Analytics loads at all. Firefox, Brave and DuckDuckGo can send that signal from their privacy settings, and a Chrome extension can add it. Any standard tracking blocker also works. The Service behaves exactly the same either way: nothing is withheld, and nothing about your account changes.

Counting visits without tracking anyone. We also use Vercel Web Analytics across the Service. It is deliberately different from the two above: it sets no cookies, it does not follow you between websites, it builds no profile, and it is served from issabudget.com itself rather than by an advertising company. It tells us how many people opened a page. It does not tell us who they are, and there is nothing in it to sell or share, which is why a privacy signal that means “do not sell or share my data” does not switch it off.

The security check on our sign-in pages. The sign-in and sign-up forms run Cloudflare Turnstile, which checks that a form is being filled in by a person rather than by a program, and may store a short-lived value in your browser to remember that the check passed. It exists to stop automated abuse: floods of fake accounts, and bots making our system send sign-in emails to people who never asked for them. It is not advertising and not measurement: it tells us nothing about you, it does not follow you between websites, and it runs only on those two forms. Because it protects the Service rather than markets it, a “do not sell or share my data” signal does not switch it off, and we cannot offer to turn it off, because without it the sign-in page is defenceless.

6. Service providers we rely on

Like nearly all software, the Service runs on infrastructure operated by specialist providers, which process data only on our instructions to run the Service: Supabase (database and authentication hosting), Vercel (application hosting, and the cookieless visit counting described in Section 5), Stripe (subscription payments; your card number goes to Stripe directly and never touches our servers), and WhatsApp by Meta (if you choose to contact support through WhatsApp, that conversation is handled by WhatsApp under its own terms), and Cloudflare (the bot check on the sign-in and sign-up forms described in Section 5). Two further companies, Meta and Google, receive only the public-page measurement described in Section 5, and unlike the providers above they act for their own purposes as well as ours. If we add or change providers, we will keep this list current.

7. Security

Your data is encrypted in transit, and every business account is isolated at the database level so one business can never read another’s records. Access to production systems is restricted and authenticated. No system is perfectly secure, but security is the first law of how this Service is built, and we treat it that way in every change we ship.

8. Retention

We keep your information while your account is active. If you close your account, your data remains available for export for 30 days, after which we may delete it from active systems; backup copies expire on a rolling schedule after that. We may retain limited records where the law requires it (for example, billing records for tax purposes). You can close your account yourself in the app’s Settings; the steps, and how to ask us by email instead, are at issabudget.com/legal/delete-account.

9. Your rights

You can access and update your account information in the app, and you can export your business data. You can also write to us to request a copy of your personal information, ask us to correct it, or ask us to delete it, and we will honor those requests regardless of where you live, subject to records the law requires us to keep. Requests go to support@issabudget.com, and we respond within 30 days.

10. California notice

For California residents: the categories of personal information we collect are identifiers (such as your email address, name and phone number), commercial information (the business records you enter, and the general business location used to suggest a sales-tax rate), and internet activity (server logs, and the public-page measurement described in Section 5). We collect them directly from you and use them only for the purposes described in this policy.

We do not sell personal information, and we have not sold any in the preceding 12 months. We do disclose limited internet-activity information (that a public page was viewed, and the browser identifiers Section 5 describes) to Meta and Google for advertising measurement, which California law treats as “sharing” for cross-context behavioral advertising. That is the full extent of it: it happens only on pages anyone can reach without an account, we have never shared anything from inside a signed-in account, and we do not intend to. To opt out, send a Global Privacy Control signal from your browser (we honour it automatically, as described in Section 5) or write to support@issabudget.com. You may exercise the rights described in Section 9, and we will never treat you differently for doing so.

11. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, write to us and we will delete it.

12. Changes to this policy

If we change this policy in a material way, we will notify you (for example, by email or a notice in the app) before the change takes effect. The date at the top always shows the latest revision.

13. Contact

Privacy questions and requests: support@issabudget.com. You can also review our Terms of Service.