Privacy Policy

Effective date: June 7, 2026

This Privacy Policy explains how HOA in a Box ("we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you visit this Site, communicate with us, or use our community association management platform (the "Platform," together with the Site, the "Services"). It also describes the choices and rights you have regarding your information.

1. Who we are and the scope of this policy

We provide software that helps community associations — homeowners associations, condominium associations and similar bodies — manage their own affairs: a public website, a portal for residents, and a console in which the board records assessments, payments, violations, architectural requests, complaints, official notices, meetings and votes. We are a U.S.-based company and the Services are intended for use by associations and their authorized representatives located in the United States.

This policy distinguishes between two categories of personal information:

• Information we control. Information we collect for our own purposes — for example, when you browse the Site, submit a quote or contact form, or administer an account. For this information, HOA in a Box acts as the "controller" (or "business"), and this Privacy Policy governs.
• Information we process on behalf of an association. When an association uses the Platform to run its affairs, we process information about its members, residents and households — their contact details, what they owe and have paid, their correspondence with the board, and the records of requests, violations and complaints — on that association's behalf and under its instructions. For this information, the association is the controller and HOA in a Box is the "processor" (or "service provider"). Our handling of that information is governed by our Data Processing Addendum — not by the controller terms of this Privacy Policy. If you are a resident or owner in one of our customer associations, please direct privacy requests to your association in the first instance.

2. Information we collect

2.1 Information you provide to us

• Inquiries and forms. When you ask what the service costs, start a community, or contact us, we collect the name, email address, the name of the association, and the contents of any message you submit.
• Account and Platform users. If you are an authorized user of the Platform, we collect your name, email address, your role in the association (for example, president, treasurer or resident), the association you belong to, and the credentials used to authenticate you.
• Correspondence. Records of your communications with our support, sales, and compliance teams.

2.2 Information collected automatically

• Log and device data. IP address, browser type, operating system, referring pages, and timestamps, collected through server logs for security, diagnostics, and fraud prevention.
• Cookies and similar technologies. See Section 3.

2.3 Customer Personal Data processed on behalf of associations

Through the Platform, we process information that our association customers submit or generate about their members, residents and households. This may include names and contact details; the property or unit a person owns or occupies and their role in it; assessments, payments and payment plans; correspondence with the board; requests, architectural applications and complaints; violation records and official notices; amenity reservations; and votes cast in association ballots.

Two categories are handled with particular care. The identity of a person who files a complaint is withheld from the wider board and disclosed only to the association's president or a super-administrator, enforced by the Platform itself rather than by convention. Ballots record that a member voted and, where the association has configured an anonymous ballot, do not record how. We process this information only as a processor under the instructions of the relevant association, as described in Section 1 and our Data Processing Addendum. We do not use Customer Personal Data for our own marketing or sell it.

We do not knowingly collect payment card information through the Site. We do not seek to collect sensitive personal information beyond what is necessary to operate the Services.

3. Cookies and analytics

The Site uses a minimal set of cookies and similar technologies. We use only strictly-necessary and functional cookies required for the Site to operate (for example, to remember your theme preference and to protect forms). We use Cloudflare Turnstile to distinguish humans from automated abuse on our forms.

We do not use third-party web analytics, Google Analytics, the Meta Pixel, or any cross-site behavioral advertising tracker, and we do not set advertising cookies. Any usage measurement we perform is first-party and privacy-respecting, and is limited to aggregate, server-side metrics derived from the log data described in Section 2.2. We do not engage in cross-context behavioral advertising; because none of our cookies are used for advertising, there is nothing to opt out of in response to a Global Privacy Control signal, and where the law treats such signals as an opt-out of sale or sharing, we honor them by virtue of not selling or sharing personal information.

4. How we use information

• To respond to your inquiries, provide quotes, and schedule demos.
• To provide, maintain, secure, and improve the Services.
• To authenticate users, administer accounts, and provide customer support.
• To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity.
• To comply with legal obligations, enforce our Terms and Conditions, and establish, exercise, or defend legal claims.
• To send administrative and service-related communications. We send marketing communications only where permitted, and you may opt out at any time using the unsubscribe link or by contacting [email protected].

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not disclose personal information to data brokers.

5. Legal bases for processing

Where data protection law requires a legal basis to process personal information, we rely on one or more of the following: performance of a contract with you or your organization; our legitimate interests in operating and securing the Services (balanced against your rights); compliance with a legal obligation; and your consent where consent is required (which you may withdraw at any time). HOA in a Box is currently focused on the United States market; where the European Union General Data Protection Regulation, the United Kingdom GDPR, or similar laws apply to a particular engagement, those obligations are addressed through our Data Processing Addendum and the additional commitments in our EU AI Act Policy.

6. How we share information

We disclose personal information only as described below:

• Service providers (subprocessors). We use vetted vendors to operate the Services, including cloud hosting and content delivery, transactional email delivery, security and bot-mitigation, and first-party analytics. These providers may process personal information only to perform services for us and under contractual confidentiality and data-protection obligations. A description of the categories of subprocessors is maintained in our Data Processing Addendum.
• Payment processing. Card payments are made through Stripe. Card details are submitted directly to Stripe and do not reach our systems; we receive the outcome of the payment and enough detail to record it against the correct household. Where an association posts an official notice through the Platform, the name, address and notice are passed to the mail provider that prints and posts it, at the association's direction.
• Legal and compliance. We may disclose information to comply with applicable law, regulation, legal process, or governmental request, and to protect the rights, property, and safety of HOA in a Box, our customers, and the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred subject to this policy and applicable law.
• With your direction or consent. Where you ask us to share information or otherwise consent.

7. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, to provide the Services, to comply with our legal and recordkeeping obligations, and to resolve disputes. Inquiry and marketing-contact information is retained while there is an active or prospective relationship and for a reasonable period thereafter, unless you ask us to delete it sooner.

Records processed through the Platform are retained for as long as the association keeps them, because we hold them on its behalf and it decides. An association's own retention obligations come from its governing documents and from state law — which commonly requires that assessment ledgers, meeting minutes, ballots and official notices be kept for a period of years, and which the association is responsible for determining. Records of assessments, notices and board actions are append-only by design and are corrected by a further entry rather than by deletion, which is what makes them worth anything as evidence. We do not delete an association's records on its behalf without authorization. On termination, records are returned or deleted as described in our Data Processing Addendum.

8. How we protect information

We maintain administrative, technical, and physical safeguards designed to protect personal information. These include encryption of data in transit and at rest, role-based access controls with least-privilege access, logging and auditing of production access, network and application security controls, and dependency and vulnerability review as part of our deployment process. No method of transmission or storage is perfectly secure; we work continually to strengthen our controls. For more information, see our Trust Center. To report a security concern, contact [email protected].

9. Your privacy rights and choices

Depending on where you live and the nature of our relationship, you may have the right to:

• Access and obtain a copy of the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Request deletion of your personal information.
• Opt out of the "sale" or "sharing" of personal information and of targeted advertising (note: we do not sell or share personal information, and we do not engage in targeted advertising).
• Limit the use of sensitive personal information to what is necessary to provide the Services.
• Not be discriminated against for exercising your privacy rights.

To exercise any of these rights, email [email protected]. We will verify your request and respond within the timeframes required by applicable law. You may use an authorized agent to submit a request on your behalf, subject to verification. If you are a resident or owner whose information we process on behalf of an association, we will refer your request to that association and assist them as their processor.

California residents. The categories of personal information we have collected in the past twelve months are described in Section 2 (identifiers, internet activity, and, through the Platform on behalf of associations, records of residence, assessments and payments, correspondence, and association governance). We disclose personal information to service providers for the business purposes described in Section 6. We have not sold or shared personal information for cross-context behavioral advertising in the past twelve months. California residents may exercise the rights above and may appeal a denial by replying to our response.

10. Children's privacy

Our public website is intended for businesses and organizations and is not directed to children, and we do not knowingly collect personal information directly from children through the Site. If you believe a child has provided us personal information through the Site, contact [email protected] and we will take appropriate steps to delete it.

The Platform is used by associations to record households, and a household record may name a minor who lives there — typically no more than a name and their relationship to the owner. We process that only as a processor, on the association's documented instructions. Residents do not receive their own sign-in unless the association issues one, and the Platform is not designed or marketed for use by children.

11. International users and data location

The Services are operated from, and personal information is processed and stored in, the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States, where data protection laws may differ from those in your jurisdiction. Where we process personal information subject to data protection laws that restrict international transfers, we implement appropriate safeguards as described in our Data Processing Addendum.

12. Third-party links

The Site may link to third-party websites and resources that we do not control. This policy does not apply to those third parties, and we encourage you to review their privacy practices.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the effective date above and, where appropriate, provide additional notice. Your continued use of the Services after an update takes effect constitutes acceptance of the revised policy.

14. Contact us

For privacy questions, to exercise your rights, or to send a legal notice, an abuse report or a security report, email [email protected] and say which it is about.

You may also reach us by mail at:

Last updated: June 7, 2026