Privacy Policy

This Privacy Policy explains how Budgetwise Limited (“we”, “us”, “our”) collects, uses, stores, discloses, and otherwise processes personal data when you use the Isaac application and related services (“the Service”). It is issued in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Our appointed Data Controller is Budgetwise Limited (company number 15344334), Highview New Road, Broad Oak, Sturminster Newton, England, DT10 2HF. For data protection enquiries please contact our dedicated data protection email at privacy@isaacmoney.com.

1. Data We Collect

1.1 Data You Provide

When you use the Service, you may provide:

• Account registration data: email address, password (stored in hashed form);
• Financial planning data: pension pot values, salary, retirement age, contribution rates, investment assumptions — entered at your discretion;
• Correspondence: messages sent to us via support channels;
• Subscription and billing data: managed by Apple App Store, Google Play, or Stripe (for web subscriptions) — for web billing we receive Stripe customer and subscription identifiers plus renewal, cancellation, and entitlement status needed to provide and manage Premium, but we do not store full payment card details;

1.2 Data We Collect Automatically

When you use the Service we may collect:

• Device identifiers and platform information (iOS/Android version);
• Crash reports and diagnostic logs (anonymised where possible);
• Subscription status from RevenueCat (entitlement status only);
• Subscription status from Stripe for web purchases (renewal, cancellation, and entitlement status);
• App usage analytics (where enabled — see Cookie Policy for details);
• If you allow notifications on your phone: a token that lets us send notifications to it, the app version, and which notifications you have switched on (partner updates, updates from Isaac, offers). We use these to send the notifications you allow, and to pick who an update is relevant to from how you use the Service (such as your plan type, when you last opened the app, or whether you have retired), under our legitimate interest in telling you about the Service. Offers are sent only if you turn them on. The token is deleted when you sign out, delete your account or the phone stops taking notifications.
• When you create an account: the advert campaign, if any, named in the link that brought you to the web app or, on Android, passed on by Google Play when you installed the app. We use it to see which adverts lead to accounts, under our legitimate interest in knowing what our marketing achieves, and it is deleted with your account.

On our website (www.isaacmoney.com) we also collect:

• Page views and referrers, through Umami, which doesn’t use cookies;
• On the download page, counts of how far each visit gets (the video, the buttons, and the answer if you tell us why you’re not downloading), with the advert campaign from the link, the kind of device, and whether the page was open in Facebook’s or Instagram’s own browser. These use no cookies, store nothing on your device, and keep no IP address or browser details, so they can’t be linked to you. We keep them for 400 days;
• If you choose “Accept all” in the cookie banner: which buttons you use on a page, and Meta Pixel page-view events, and whether you then created an Isaac account in the web app, so we can measure our Facebook and Instagram adverts.

1.2b Employer enquiries

If you ask for our employer guide or a demo on behalf of an organisation, we keep the name, email address, organisation, team size and role you give us, the page you asked from, and when you opened the guide we sent you. We use them only to reply to you about Isaac for your organisation. We delete guide requests after two years, or sooner if you ask at support@isaacmoney.com. Legal basis: legitimate interests (Article 6(1)(f) UK GDPR), in responding to an enquiry you made.

1.3 Data We Do Not Collect

We do not collect:

• Full payment card or bank account details;
• Government-issued identity documents;
• Sensitive personal data (health, biometric, etc.) — the Service is not designed to process such data.

2. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases:

Performance of contract (Article 6(1)(b) UK GDPR):

• Creating and managing your account;
• Delivering the Service, including Premium Features for subscribers;
• Processing and verifying subscription entitlements;
• Restoring purchases;
• Responding to support requests.

Legitimate interests (Article 6(1)(f) UK GDPR):

• Improving the Service and fixing bugs (using anonymised diagnostic data);
• Detecting and preventing fraud, abuse, or security threats;
• Defending legal claims;
• Conducting anonymised aggregate analytics.

Compliance with legal obligations (Article 6(1)(c) UK GDPR):

• Retaining transaction records for tax and accounting purposes;
• Responding to requests from regulatory or law enforcement authorities.

Consent (Article 6(1)(a) UK GDPR):

• Sending marketing communications (where you have opted in);
• Setting non-essential cookies or similar technologies (see Cookie Policy).

3. Data Storage

3.1 On-Device Storage

Your financial planning data (plans, assumptions, calculations) is stored on your device using local storage for fast, offline access. This local copy:

• enables the app to work without an internet connection;
• is deleted when you uninstall the app or clear app data; and
• may be lost if your device is lost, stolen, or factory reset.

If you turn on App Lock, a scrambled (hashed) copy of your PIN and a count of recent wrong attempts are kept only on your device, in its secure storage where available. They are never sent to us. Face ID, Touch ID and fingerprint checks are carried out by your device; we never receive biometric data.

3.2 Server-Side Storage

When you create an account, your financial planning data is also stored on our servers (a PostgreSQL database hosted by our cloud infrastructure provider) to enable:

• syncing your data across multiple devices;
• restoring your data if you reinstall the app or switch devices;
• account-level features such as employer benefits and referral programmes.

Server-stored data is associated with your user account and is protected by the security measures described in Section 9. Your data is never shared with other users, except as Section 4 describes for partner planning and Give a month, get a month, and is never made publicly accessible.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with:

Service providers (data processors acting on our instructions):

• RevenueCat Inc. — subscription management (entitlement status only), processed on the lawful basis of contract performance (Article 6(1)(b) UK GDPR) as it is necessary to deliver and verify your Premium subscription;
• Apple Inc. / Google LLC — app distribution platforms (iOS/Android subscriptions);
• Stripe Inc. — payment processing and subscription management (web subscriptions only; Stripe receives payment details directly, while Budgetwise Limited is the merchant of record);
• Crash reporting and analytics providers (anonymised data only), including Umami for website page analytics;
• Expo (650 Industries, Inc.) — delivering notifications to your phone, through Apple and Google, if you allow them;
• Email delivery providers (to send account and service emails);
• Cloud hosting and database providers (for server-side data storage and syncing).

Advertising measurement (website only, with your consent):

If you choose “Accept all” on our website, the Meta Pixel sends Meta Platforms Ireland Limited information about your visit (such as the pages you view, and your browser and IP address). Meta uses it to tell us how our adverts perform and under its own privacy policy. If you then create an account in the Isaac web app (app.isaacmoney.com), our server tells Meta, through its Conversions API, that an account was created, so Meta can link it to the advert you saw. It sends a scrambled (SHA-256 hashed) copy of your email address and account ID, your browser and IP address, the sign-up method, and Meta’s own _fbp and _fbc cookies. It does this only if you chose “Accept all”, and never for accounts created in the iOS or Android app. We never send Meta your financial planning data, and the Isaac app does not contain the Meta Pixel. You can withdraw consent at any time with the Cookie settings link at the foot of each page.

Partner planning:

The Service includes a partner planning feature that allows you to link your account with a partner’s account for joint retirement planning. When you choose to link accounts:

• your linked partner will be able to view and edit shared plan data, including pension details, spending targets, and retirement assumptions;
• linking is voluntary and requires mutual consent from both account holders;
• either partner may unlink at any time, which revokes the other party’s access to shared data; and
• we do not share your login credentials, email address, or any data beyond the shared plan with your linked partner.

Legal basis: consent (Article 6(1)(a) UK GDPR). By linking your account with a partner, you consent to the sharing described above.

Give a month, get a month:

If a friend joins with your code, we show them your first name, so they know who their free month is from, and nothing else about you. We keep a record of which account’s code a new account used, so we can give you your month once your friend has made a plan and keep to the limit of 12 a year. We show you how many friends have joined and how many months you have earned, never who they are or anything in their plans. If you delete your account, we delete your code and the record of who joined with it. If a friend who joined with your code deletes theirs, we keep only the two account numbers, so the yearly limit still counts it. Legal basis: legitimate interests (Article 6(1)(f) UK GDPR), in running the scheme you and your friend chose to use.

Legal and regulatory disclosure:

We may disclose personal data where required by law, court order, or regulatory authority, or to protect our rights, property, or safety.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Account data: retained for as long as your account is active. When you delete your account, we immediately revoke access, anonymise the retained account record, and permanently delete server-held plans, preferences, sessions, consent records, and other user-held application data. Records we must retain for tax, accounting, fraud prevention, or legal claims are retained only for the applicable period and are minimised where possible;
• Subscription records: retained for up to 7 years after cancellation to comply with tax and accounting obligations;
• Support correspondence: retained for up to 2 years after resolution;
• Technical launch diagnostics (short reference and timing milestones only): retained for up to 30 days;
• Anonymised analytics data: may be retained indefinitely as it no longer constitutes personal data.

On-device data (plans, assumptions) is retained on your device until you uninstall the app or clear app data. Deleting your account removes server-stored data but does not automatically remove data cached on your device — uninstalling the app will clear all local data.

6. International Data Transfers

Your data may be processed outside the United Kingdom where our service providers operate. Where this occurs, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the ICO;
• adequacy decisions by the Secretary of State; or
• other lawful transfer mechanisms recognised under UK GDPR.

For further details on international transfers, please contact us at support@isaacmoney.com.

7. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you;
• Right to rectification: to request correction of inaccurate or incomplete data;
• Right to erasure (“right to be forgotten”): to request deletion of your data, subject to legal obligations;
• Right to restriction of processing: to ask us to pause processing in certain circumstances;
• Right to data portability: to receive your data in a structured, commonly-used format;
• Right to object: to object to processing based on legitimate interests or for direct marketing;
• Rights in relation to automated decision-making: Isaac uses automated processing to generate financial illustrations. These describe what the inputs you provide imply, but no automated decision is taken about you that produces legal or similarly significant effects (Article 22 UK GDPR). You retain the right to obtain an explanation of, and to challenge, any output.

To exercise any of these rights, contact us at support@isaacmoney.com. We will respond within one calendar month. We may require proof of identity before fulfilling a request.

You also have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”) at ico.org.uk or by telephone on 0303 123 1113.

8. How to Delete Your Account

You can delete your account at any time directly from the app:

• Open Isaac and go to More, then Account and sign-in;
• Scroll to the bottom and tap Delete Account;
• Confirm the deletion when prompted.

When you delete your account:

• Your personal information (email address, name, password) is permanently anonymised on our servers;
• Your server-held plans, preferences, sessions, consent records, and other user-held application data are permanently deleted;
• A minimised, anonymised account record may be retained where needed to preserve records subject to legal, tax, accounting, fraud-prevention, or legal-claims obligations;
• Any active Premium subscription should be cancelled separately to avoid continued billing: iOS users via the App Store, Android users via Google Play, and web subscribers under More, then Subscription, or by emailing support@isaacmoney.com.

Account deletion is immediate and cannot be reversed. If you need assistance or wish to request deletion by email, contact us at support@isaacmoney.com.

Data stored locally on your device (cached plans) is not automatically removed when you delete your account. To remove all local data, uninstall the app from your device.

9. Data Security

We implement appropriate technical and organisational security measures to protect your data, including:

• encryption of data in transit (TLS);
• hashed storage of passwords;
• access controls and least-privilege principles;
• regular security reviews; and
• device-level security for locally-stored data (dependent on your device settings).

No method of transmission or storage is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

Exported data

The Service allows you to export PDF reports and Excel spreadsheets containing your financial planning data. Once exported, these files are stored on your device and are outside our control. You are solely responsible for the security, storage, and distribution of any reports you export from the Service. We recommend treating exported reports as confidential documents.

10. Children’s Privacy

The Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at support@isaacmoney.com and we will delete it promptly.

11. Marketing Communications

We will only send you marketing communications if you have opted in to receive them. You can withdraw consent at any time by clicking “unsubscribe” in any marketing email or contacting us at support@isaacmoney.com. Withdrawal of consent does not affect the lawfulness of processing before withdrawal. Offers by push notification are sent only if you turn on Offers in More, then Notifications, and you can turn them off there at any time.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notice or email. The “Last updated” date at the top of this policy reflects the most recent revision. Continued use of the Service after a change constitutes acceptance of the updated policy.

13. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (“DPIAs”) where processing is likely to result in a high risk to individuals’ rights and freedoms, as required by Article 35 of the UK GDPR. A DPIA has been conducted for the core processing activities of the Service, including the processing of financial planning data. DPIAs are reviewed and updated periodically or when processing activities change materially.

14. Record of Processing Activities

In accordance with Article 30 of the UK GDPR, Budgetwise Limited maintains a Record of Processing Activities (“ROPA”) documenting all personal data processing carried out in connection with the Service. The ROPA is maintained internally and is available to the Information Commissioner’s Office on request.

15. Contact and Complaints

For any privacy-related questions, requests, or complaints, please contact:
Budgetwise Limited (company number 15344334)
Data Controller
Highview New Road, Broad Oak, Sturminster Newton, England, DT10 2HF
Data protection enquiries: privacy@isaacmoney.com
General enquiries: support@isaacmoney.com
Website: www.isaacmoney.com

You have the right to escalate any unresolved complaint to the ICO (ico.org.uk).