Privacy policy.

Our two roles

For isa accounts, workspace users, prospects and visitors to useisa.com, isa is the personal information controller. For the guest, reservation, payment and website-visitor records that a customer manages in its workspace, the customer (for example a hotel) is the controller and isa is its processor, acting on its instructions under our Terms. Guests should read the privacy notice of the business they booked with and send requests to it; we help that business answer them.

What we collect about isa users

Account details: name, email address, phone number if given, authentication and security events, workspace memberships and roles. Service records: what you create and change in isa, with an audit history. Usage data: screens visited, clicks, dead clicks and other interactions, click heatmaps, errors, page performance, device, browser, operating system, approximate location from IP address, and session recordings, linked to your account identifier, name, email address and workspace. Recordings mask all text, inputs and element attributes and block forms, payment and confirmation details, images, media and embedded content; page addresses are reduced to page templates; console output and network payloads are not captured. Support and sales conversations you have with us.

What we collect on useisa.com

Pages and page templates viewed, time on page, scrolling, contact and demo link clicks, the website or campaign that brought you, device and browser type, country, a random visitor identifier stored in a cookie for up to 180 days, and masked session recordings with the same masking as above. If you allow advertising measurement, advertising click identifiers and advertising cookies. Information you send us through forms or email.

Why we use it and on what basis

To provide, secure and support isa and your account (to perform our contract with you or your organization). To understand how isa and useisa.com are used, find and fix problems, improve features and help you when you contact support (legitimate interest; recorded in a legitimate-interest assessment under NPC Circular No. 2023-07). To measure which campaigns bring visitors and customers to isa (legitimate interest for visitors in the Philippines, who may object at any time; consent for visitors elsewhere). Advertising measurement (consent only). To meet legal, tax and accounting obligations and protect our rights (legal obligation and legitimate interest). We do not sell personal information or use workspace data to advertise to guests.

Cookies and your choices

Necessary cookies keep you signed in and protect forms; they cannot be switched off. On useisa.com, optional measurement has separate settings for analytics, masked replay and advertising; a notice appears on your first visit and Privacy settings lets you change or withdraw your choice at any time. Withdrawal stops future collection and removes the optional visitor cookie. Usage recording inside signed-in isa is part of providing the service under our Terms; you can object by writing to us, and we will consider the objection against the purposes above.

Who receives it

Our sub-processors: Supabase (database and authentication), Cloudflare (hosting, security, email delivery and encrypted backups), PostHog (product analytics and session recordings), Sentry (error and performance reports), Better Stack (uptime monitoring), Resend (email delivery, where enabled) and PayMongo (payments, where a customer enables them). Providers a customer connects to its own workspace, such as Meta, Google or its own analytics account, receive data under that customer’s instructions and their own terms. We disclose information where the law requires it or to protect rights and safety, and to a successor if our business is transferred, with notice to you.

International transfers

Several providers process data outside the Philippines, including in the United States. We use providers bound by contract to protect personal information and to process it only for the services they provide to us.

How long we keep it

Account and workspace records: while the account or workspace is active, then as described in our Terms for export and deletion. First-party usage, website measurement and attribution records: 730 days. Advertising click identifiers: 90 days or until consent is withdrawn. The optional visitor cookie: up to 180 days. Session recordings and provider analytics: up to the retention set in each provider account, which we keep as short as the provider allows. Audit, security, tax and accounting records: as long as the law or the defense of legal claims requires. Backups expire on their own schedule, and restored backups have expired records removed before use.

Security

Workspace data is isolated by database access policies, credentials for connected accounts are encrypted, access is limited by role, sensitive actions require multi-factor authentication, and we keep audit records. We will notify affected people and the National Privacy Commission of breaches as the law requires.

Your rights

You have the right to be informed, to access, correct and port your information, to object, to have it erased or blocked, and to claim damages, as provided by the Data Privacy Act. Write to the contact below; we answer within 15 working days. If you are not satisfied, you may complain to the National Privacy Commission (privacy.gov.ph). Guests of a business that uses isa should contact that business first.

Changes

We post updates here with a new effective date and notify workspace owners of material changes.

Privacy contact

isa

privacy@useisa.com