Margin Privacy Policy

This Privacy Policy explains how Margin, operated by Fitness Family LLC (we, us, our), collects, uses, and protects information when you use the Service. By using Margin, you agree to this Policy.

• Account information: your name, email address, and password (passwords are stored in hashed form by our authentication provider, we never see them in plain text).
• Practice and financial data: the business and financial information you enter or connect, such as services, prices, costs, overhead, and volumes, used to generate your analysis.
• Payment information: your card details go to Stripe and are held by Stripe. They never reach Margin. Nothing in our system reads or stores a card number, including the last four digits, and there is nowhere in our database for one to go. From Stripe we receive only your customer identifier, your subscription status, the plan you are on, and the date your current period ends.
• Information you send us through public forms: if you request a free profit breakdown, we collect your name, practice name, email address, and the practice type and website you choose to provide, and we email that submission to ourselves so we can prepare your breakdown. The newsletter box on that form is checked by default; if you leave it checked we also add your email address to our newsletter list, and you can unsubscribe at any time.
• Usage information: basic technical data such as log data, IP address, and device and browser information, used to operate, secure, and measure the Service. We record the IP address of free breakdown submissions so we can rate limit that form and prevent abuse.

Margin is built for practice business and financial data only. We do not request, and you must not submit, protected health information (PHI), patient-identifiable medical records, or other data regulated under HIPAA. Margin is not a covered entity or business associate under HIPAA.

We use your information to: provide and operate the Service; generate your financial analysis; process subscriptions and payments; communicate with you about your account; maintain security; and improve the Service. We do not sell your personal information.

We use a small number of service providers to run Margin. Each one processes data on our behalf or under its own privacy commitments, and each receives only what its job requires. Supabase provides our database and authentication and sends account email such as sign up confirmation. Vercel provides hosting, serverless functions, and website analytics. Stripe processes subscription payments. Resend delivers the email we generate when you submit the free breakdown form. Beehiiv stores newsletter subscriptions. Upstash stores the IP address of free breakdown submissions so we can rate limit that form. Google Fonts serves the typefaces on our pages, which means Google receives your IP address and browser information whenever a page loads. Calendly powers our booking links and receives whatever you enter when you book a call.

That is every provider that receives data from Margin today, and we will update this section if it changes. Your practice and financial data goes only to Supabase and Vercel. We do not sell your personal information, and we do not share your data with third parties except: (a) the providers listed above, who help us operate Margin; (b) where required by law; or (c) to protect our rights or the safety of others.

We retain your data for as long as your account is active. You may request deletion of your account and associated data by contacting us at lucas.m.popiel@gmail.com. Some information may be retained as required by law or for legitimate business records (e.g., billing history).

We use reasonable technical and organizational measures to protect your information, including encryption in transit, access controls, and database-level isolation between customers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You may access or update your account information at any time, request deletion of your data, and opt out of non-essential communications.

The Service is not directed to anyone under 18, and we do not knowingly collect information from children.

We may update this Policy; we will update the Last updated date and, where appropriate, notify you of material changes.

Questions about this Policy or your data: lucas.m.popiel@gmail.com