Privacy Policy

This policy explains what information [Company legal name, e.g. PingHOA LLC] ("PingHOA", "we") handles, why, and the choices you have. It covers our website and the PingHOA app used by community associations, their board members, managers and owners.

Who is responsible for your data

• Association records. When an association uses PingHOA, the association decides what information to keep about its homes and owners and why. It is the owner ("controller") of that data, and we process it only on its instructions to run the service — we act as its service provider ("processor") under our Data Processing Agreement.
• Our own records. For our website, our customers' billing contacts and the sign-in accounts we operate, we are responsible for the data.

What we collect

• Account details of board members, managers and owners who sign in: name, email, phone (optional), sign-in and security events.
• Association records the board enters or uploads: owner contact details, mailing addresses, charges and payments, violations, requests, meetings, ballots and documents.
• Delivery records: which letters and notices were sent, by which channel, and whether they were delivered.
• Subscription billing contact and plan details for the association (card details are entered on Stripe's page, not ours).
• Basic technical data needed to run and protect the service: IP address, browser type and error logs.

What we never collect or store

• Full card or bank account numbers. Payments are entered on Stripe's pages; we only store references and status.
• Bank sign-in credentials. Bank activity comes in only as CSV files the board uploads.
• Passwords in readable form (they are hashed) or two-step verification secrets in plain text (they are encrypted).

Money. Owner payments (dues, fees, fines) are processed by Stripe directly into the association's own Stripe account and paid out to the association's bank account. PingHOA never holds, receives, pools or moves the association's funds, and never pays vendors on the association's behalf. The association is the merchant for its owners' payments.

How we use it

To provide the service the association signed up for: show ledgers and records, deliver the association's messages, process sign-in and security, provide support, bill the subscription, prevent abuse, and meet legal duties. We do not sell or rent personal data, do not "share" it for cross-context advertising, and do not use association data to advertise.

Services that receive data

We share only what each provider needs to do its job for us, under contracts that limit their use of it:

• Stripe — owner payments into the association's own Stripe account, and our subscription billing.
• Email delivery provider (e.g. Resend) — sends sign-in links, notices and announcements.
• Text-message provider (e.g. Twilio) — sends text messages to people who opted in.
• Printed-mail provider (e.g. Lob) — prints and mails letters the board approves.
• AI provider (OpenAI) — answers questions from the association's documents and drafts text.
• Cloud hosting and database — stores and serves the app.

We may also disclose information if the law requires it, to protect people's safety or our service, or as part of a merger or sale of our business (the new owner would remain bound by this policy).

AI processing

When the board or an owner uses AI features, the relevant documents and question are sent to our AI provider to produce the answer. They are not used to train the provider's models under our agreement with the provider. See AI use and limits.

Text messages

Text messages are sent only to people who have given their mobile number and opted in. Reply STOP to stop, HELP for help. Message and data rates may apply; message frequency varies with the association's activity. Mobile numbers and opt-in consent are never sold or shared with third parties for their marketing.

Cookies

We use only one essential cookie, which keeps you signed in. We do not use advertising or cross-site tracking cookies. Because we don't track you across sites, our handling is the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

Your data: export, correction and deletion

• Export: a board member with settings access can download everything at any time from Settings → Data, as one ZIP of CSV files, PDFs (owner statements, sent letters, approved minutes, signed certificates) and the original uploaded documents.
• Deletion: the president or manager can delete the association from Settings → Data. This permanently removes its records and uploaded files. Backups roll off within 30 days.
• Owners who want their information seen, corrected or removed should contact their board, which controls the association's records. If you contact us, we will forward the request to the association and help it respond.
• Your own sign-in account: you can update your name, email and phone in your profile, and turn optional emails off.

Privacy rights by state

Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have the right to know what personal information is held about you, to get a copy, to correct it, to delete it, and to opt out of its sale or targeted advertising. We don't sell personal information or use it for targeted advertising. To make a request about data we control, email privacy@example.com; we will verify the request and answer within the time the law requires, and we won't treat you differently for using your rights. Requests about association records go to the association, as explained above. You may use an authorized agent; we may ask for proof of authorization.

Retention

We keep the association's data while its account is active. After a subscription ends, we keep it for 30 days so the board can export it or reactivate, then delete it (backups roll off within another 30 days), unless the law requires us to keep something longer. Associations often must keep certain records for years (minutes permanently, financial records about 7 years); the board decides what to keep and should export before cancelling or deleting.

Security

Encryption in transit, hashed passwords, two-step sign-in (required for anyone who can handle money or exports), encrypted second-factor secrets, role-based access per association and an audit log of meaningful changes. No system is perfectly secure; if a breach affects your information, we will notify the association and, where required, you and the authorities.

Children

PingHOA is for adults managing or living in community associations. It is not directed to children under 13 and we do not knowingly collect their information. If you think a child's information was provided to us, contact us and we will delete it.

Links to other sites

Our pages may link to other websites, such as Stripe or an association's own site. Their privacy practices are their own; please read their policies.

Where data is stored

PingHOA is a US service and data is stored in the United States.

Changes to this policy

If we make a material change, we will update the date above and tell association boards by email and in the app at least 30 days before it takes effect.

Contact

[Company legal name, e.g. PingHOA LLC], [Company mailing address]. Privacy questions and requests: privacy@example.com. General support: support@example.com.