The data we hold, and what we won’t do with it.

• Account information — name, email address, phone number, unit number, and password (stored as a one-way hash).
• HOA data — addresses, dues, maintenance requests, violations, votes, documents, and communications you choose to store in your community portal.
• Payment information — processed by Stripe. We never store full card numbers; we keep only the last four digits, brand, and expiration so you can identify saved payment methods.
• Usage data — IP address, user-agent, and timestamps for sign-ins and sensitive actions, retained for security auditing.

• To deliver the portal's core features (announcements, dues, voting, etc.).
• To send transactional emails (invitations, password resets, payment receipts, dues reminders).
• To detect and prevent fraud, abuse, and unauthorized access.
• To meet legal obligations and respond to lawful requests.

We share information only with:

• Your HOA administrators (within your tenant) as needed for portal operation.
• Sub-processors that help us run the service: Stripe (payments), Resend (transactional email), Google Analytics (aggregate, de-identified usage analytics on our marketing site — not used for advertising; see our Cookie Policy to opt out), and our hosting provider.
• Authorities, when legally compelled.

We do not sell personal information.

We keep your information for as long as your HOA maintains an active account, plus a reasonable period afterwards to satisfy tax, legal, and accounting obligations. You can request deletion of your personal record at any time (see "Your rights" below); HOA records that belong to the community are retained per the HOA's policy.

We use TLS in transit, encryption at rest where supported by our providers, role-based access controls, and audit logging on sensitive actions. No system is perfect; if you discover a vulnerability, please contact us responsibly.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Email privacy@hoaflow.io to exercise any of these rights.

The service is not directed at children under 13 and we do not knowingly collect their information.

We will post any changes to this policy on this page and update the "Last updated" date above. Material changes will be communicated through the portal or via email.

Questions or requests: privacy@hoaflow.io.