Privacy policy

Issueable("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise handle your information when you use our web application (the "Service"), which helps you generate professional invoices, estimates, quotes, receipts, and purchase orders for businesses in the US, Canada, the UK, the EU and Australia, along with forms such as security deposit itemizations, lien waivers, and rental condition reports.

Please read this Privacy Policy carefully. By accessing or using Issueable, you acknowledge that you have read, understood, and agree to be bound by all the provisions of this Privacy Policy.

1. Information We Collect

When you use Issueable, we collect information that you voluntarily provide to us and information that is automatically collected through your use of our Service.

Information You Provide Directly

When you use Issueable to generate a document, we collect the information you enter into our forms, including:

• Your business information: Business name, address, logo, phone number, and optional tax ID
• Client / vendor information: The counterparty's name, address, and contact details for the document
• Line item details: Descriptions, quantities, rates, optional tax, subtotals, and balance due
• Parties named on a form: Names, addresses, and contact details of the people a form names, such as landlords and tenants, and lien claimants and property owners
• Identification numbers: The tax or registration numbers of businesses, if you enter them
• Property and transaction details: Rental property addresses, rent paid, security deposit deductions and room-by-room condition notes; and project descriptions and payment amounts on lien waivers
• Email Address: Your email address for account access and order communication

Information Automatically Collected

When you visit Issueable, we may automatically collect certain information about your device and browsing activity:

• Device Information: IP address, browser type, operating system, and device identifiers
• Usage Data: Pages visited, how fast they load, and server logs of requests
• Cookies and Similar Technologies: We use essential cookies to maintain your session and enable core functionality

2. How We Use Your Information

We use the information we collect for the following purposes:

• Generating documents: To render invoices, estimates, quotes, receipts, purchase orders, and the forms listed above as professional PDFs
• Processing Payments: To process your payments (one-off purchases or subscription charges) and maintain transaction records
• Order Fulfillment: To complete and support your request for document generation
• Improving Our Service: To analyze usage patterns and improve Issueable's functionality and accuracy
• Compliance: To comply with legal obligations and regulations
• Customer Support: To respond to your inquiries and provide technical assistance

3. Payment Processing

Issueable uses Stripe to process all payments for document generation. When you pay for our service, your payment information (credit card, debit card, or other payment method details) is handled directly by Stripe and is not processed, stored, or maintained by Issueable.

We only receive confirmation of your payment status and a Stripe session ID. We do not have access to your complete credit card numbers, banking information, or other sensitive payment data. All payment information is encrypted and processed in compliance with PCI DSS (Payment Card Industry Data Security Standard) requirements.

For more information about how Stripe handles your payment information, please review Stripe's Privacy Policy at https://stripe.com/privacy.

4. Data Retention

We keep the form data you provide (your business information, client/vendor info, line-item details, and the details entered on forms) with your order, so your document can be downloaded again and, if you subscribe, listed in your history.

We store the following information in our SQLite database for transaction purposes: your Stripe session ID, the form data JSON you submitted, and your email address. Once your document has been successfully generated, you may request deletion of your data at any time by contacting us (see Section 8: Your Rights).

Checkouts that are started but never paid are deleted automatically after four days. Paid orders and your history are kept until you ask us to delete them, except where we must keep records for legal, tax or compliance reasons.

5. Third-Party Services

Issueable uses the following third-party services to deliver our Service:

Stripe

We use Stripe as our payment processor. Stripe handles all payment processing and maintains PCI DSS compliance. Your payment information is subject to Stripe's privacy practices. For details, visit https://stripe.com/privacy.

Resend

We use Resend for transactional email delivery, such as login links and account notifications. Your email address is shared with Resend solely for the purpose of delivering these messages. For information about Resend's privacy practices, visit https://resend.com/privacy.

Railway

Issueable runs on Railway, which hosts our servers and the database that stores your account, orders and history. Your documentPDFs are generated on our own server, so the form data in them is not sent to any outside PDF service. For information about Railway's privacy practices, visit https://railway.com/legal/privacy.

These third parties are contractually obligated to use your information only as necessary to provide services to Issueable and to maintain the confidentiality and security of your information.

6. Cookies and Tracking

Issueable uses a minimal cookie footprint. We do not run behavioral analytics, advertising pixels, or third-party tracking of any kind. The only cookies we set are essential to providing the Service:

• Session cookie— a signed, HttpOnly token (__Host-issueable_session in production) that keeps you logged in after you click your magic link. Expires 7 days after sign-in or when you log out.
• Sign-in link cookie— an HttpOnly random value set when you request a magic link, so the link only works in the browser that asked for it. Deleted when you sign in, and expires after 15 minutes otherwise.
• CSRF protection— standard origin and referrer checks on state-changing requests. No additional cookie is set; the protection relies on browser-supplied headers.

We do not use Google Analytics, Meta / Facebook Pixel, TikTok Pixel, LinkedIn Insight Tag, Google Ads conversion tracking, session-replay tools (FullStory, Hotjar, etc.), or any other third-party analytics service. Your visits are not profiled, your behavior is not modeled, and no data about your usage of the Service is shared with advertising or analytics networks.

Essential cookies do not require your consent under GDPR, CCPA, or the e-Privacy Directive because they are strictly necessary for the Service to function. You can disable them in your browser settings, but doing so will prevent sign-in and may break other core features.

Server logs — including IP addresses, timestamps, and the URLs you request — are collected for security, fraud prevention, and debugging. They are not used to build a profile of your usage.

If we ever introduce analytics or any other tracking technology in the future, we will update this policy with meaningful notice and provide a clear opt-in mechanism before any tracking begins.

7. Data Security

We take data security seriously and apply the following measures to protect your information:

• Encryption in Transit: All communication between your browser and our servers is encrypted with HTTPS (TLS).
• Encryption at Rest (Infrastructure Level): Our database files are stored on encrypted volumes provided by our hosting provider (Railway). We do not apply additional application-layer field encryption; instead, we minimize the data we collect (see below) so there is little sensitive information at rest in the first place.
• Data Minimization: We do not collect or store payment card numbers or bank account numbers. Payment information is handled directly by Stripe; we receive only a non-sensitive payment reference.
• Access Controls: Access to production data is restricted to the operator(s) of Issueable. Customer data is not shared with third parties except as described in this policy.
• Dependency & Code Hygiene: Our automated build pipeline runs linting, type-checking, automated tests, and a production dependency vulnerability audit on every change to the main branch.

However, no security system is completely impenetrable. While we strive to protect your information, we cannot guarantee absolute security. You useIssueable at your own risk.

8. Your Rights

You have the following rights regarding your personal information:

Right to Access / Data Export

You have the right to request a copy of the personal information we hold about you, including your account record and the history of documents generated under your account. We will provide this information in a portable, machine-readable format (JSON) within 30 days of receiving a valid, verified request.

Account Deletion

You have the right to delete your Issueableaccount and the personal information associated with it. You can delete it yourself at any time from the "Danger zone" section of your dashboard; deletion takes effect immediately. If you can't sign in, email support@issueable.com from the email address on your account with the subject line "Account Deletion Request". Sending the request from the account email is how we verify your identity; if you no longer have access to that inbox, please reply from an email you can prove ownership of and we will follow up with additional verification steps.

Service-level commitment: for emailed requests, we will acknowledge your request within 3 business days and complete deletion within 30 days of verification. Deletion removes your user record, session tokens, saved templates, document history, uploaded logos, and magic-link tokens associated with your account.

What we retain, and why: we keep a minimal record of each order for tax and accounting purposes: the Stripe payment references, amount, currency, product type and dates. When your account is deleted, your email address, the form data (including any names in it) and any logo are removed from these records, including orders you paid for while signed out with that email address; only the financial ledger entry remains. Stripe retains payment records under its own policy — see Section 3.

You can delete your account yourself from the dashboard using the "Delete my account" option. The email process above remains available as an alternative and carries the same SLA.

Right to Opt Out

You have the right to opt out of non-essential communications and data processing. This will not affect your ability to use Issueable's core functionality.

How to Exercise Your Rights

To exercise any of these rights, please contact us using the information provided in Section 11: Contact Us. We will verify your identity (usually by confirming the request is sent from the email address on your account) before processing your request, and will respond within the timeframes stated above or within the period specified by applicable law, whichever is shorter.

9. Children's Privacy

Issueableis not intended for use by individuals under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will take steps to delete such information and terminate the child's use of our Service.

If you believe we have collected information from a child under 13, please contact us immediately at support@issueable.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes to this Privacy Policy, we will notify you by:

• Posting the updated Privacy Policy on our website
• Updating the "Last Updated" date at the top of this Policy
• Sending you an email notification if the changes materially affect how we handle your information

Your continued use of Issueable following the posting of changes means you accept and agree to the updated Privacy Policy. We recommend reviewing this Policy regularly to stay informed about how we protect your information.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We will respond to your request within 30 days. If you are unsatisfied with our response, you may have the right to lodge a complaint with your local data protection authority.