Privacy Policy

This Privacy Policy describes how UFO Chaser® LLC (“we,” “us,” “our”) collects, uses, shares, and protects personal information through the HOA King℠ service at hoakingapp.com (the “Service”). It applies to all visitors, account holders, and anyone whose information is present in documents uploaded to the Service.

1. Information We Collect

1.1 Account Information

When you create an account we collect your name, email address, and a password (hashed; we never store plaintext passwords). During onboarding you also provide your HOA or community name and the number of units, which we use to determine your plan tier.

1.2 Uploaded Documents and What We Store

You may upload HOA governing documents (CC&Rs, bylaws, rules), reserve studies (PDF), bank statement CSV files, and financial statements (PDF). We process each file to provide the analysis you request. We keep a copy of the original uploaded file in secure, access-restricted cloud storage so you can re-download it and so the Service can re-process it if needed. We also store the information derived from it, associated with your community:

• Governing documents: the extracted text passages and their numerical embeddings, used to answer your questions.
• Reserve studies: the structured funding figures, components, and projections extracted from the study.
• Bank statements: the individual transaction rows (with account and routing numbers masked; see Section 8.1) and category summaries.
• Financial statements: the extracted text and figures used for financial summaries and reports.

When you delete an upload from a tool’s history, or delete your account or community, the original file is deleted from cloud storage together with its derived data. You can export or permanently delete your data at any time (see Section 4).

1.3 Community Records You Enter

You may also enter information directly into the Service, such as vendor contracts and insurance details, compliance deadlines, action items, board meeting agendas, motions, vote counts, meeting notes and minutes, and escalation settings. We store this information with your community so your board can manage and report on it.

1.4 AI Processing of Your Content

When you use an AI feature (listed in Section 6), the relevant content is transmitted to trusted third-party AI providers to generate results:

• Anthropic (Claude models): receives the pages of uploaded PDFs for text extraction (including scanned pages), your reserve study, the transaction rows from your bank statements, your financial statement text, your governing-document questions with the relevant passages, the community records needed to answer Board Copilot questions or build board reports and playbook guidance, and the meeting notes and agenda you choose to turn into AI-drafted minutes.
• OpenAI: receives passages of your governing documents, and the text of your questions, to create the numerical embeddings that power document search and Q&A.

These providers process your content under their commercial API terms. Under those terms, your inputs and the AI outputs are not used to train their models. Providers may retain submitted content transiently (generally up to 30 days) for security and abuse-prevention purposes before deleting it, unless a shorter zero-retention arrangement applies. We do not use your documents or AI outputs to train any models.

AI usage records. To run a fair-use monthly AI budget for each community, we keep a count of AI requests per community, per AI feature and per month, and a log of requests that were paused (for example, because the budget ran out or a document was missing). These records hold counts, feature names and dates, not the content of your questions or documents.

1.5 Automatically Collected Information

With your consent, we use Google Analytics to collect usage data such as pages visited, session duration, device type, and approximate location derived from IP address. We also use the Abacus.AI platform chat widget for in-app support. See the Cookies and Tracking section below.

1.6 Authentication Data

We currently offer email-and-password sign-in. Google sign-in is an optional feature that is not enabled at this time. If we enable it in the future and you choose to use it, we would receive your name, email, and profile image from Google to create or access your account; we would not access your Google Drive, Gmail, or other Google services.

1.7 Agreement and Consent Records

When you create an account, you must affirmatively accept our Terms of Service and this Privacy Policy. To maintain a record of that consent, we store the versions of the documents you accepted, the exact acknowledgment text presented to you, the date and time of acceptance, and the IP address and browser user-agent from which the acceptance was submitted.

1.8 Billing Information

If your association subscribes to a paid plan, payments are handled by Stripe, our payment processor. Stripe securely collects and stores your payment method directly; we never receive or store your full card details. On our systems we retain only a Stripe customer reference, your subscription status, and your current billing-period end date, so we can provide access to paid features.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process uploaded documents through AI analysis at your request
• Authenticate your identity and secure your account (including optional MFA)
• Determine your plan tier based on community size
• Communicate about your account, security, or changes to this policy
• Measure site usage and improve features (with consent; see Section 5)

3. How We Share Your Information

We do not sell personal information. We share information only in these circumstances:

• AI processing: Anthropic (Claude) and OpenAI process the content you submit to an AI feature in order to generate results, under their commercial API terms which prohibit training on your data.
• Hosting & infrastructure: the Abacus.AI platform provides application hosting, database, file storage, transactional email (such as password resets and deadline reminders), PDF generation, and the in-app support chat widget.
• Analytics & optional sign-in: Google (analytics, with your consent; and Google sign-in where that optional feature is enabled).
• Payment processing: Stripe processes subscription payments on our behalf. When your association subscribes, Stripe collects and stores your payment details (such as card information) directly under its own security and privacy terms. We do not store full card numbers on our systems — we retain only a customer reference, subscription status, and renewal date.
• All of these providers process data on our behalf under contractual obligations.
• Legal requirements: When required by law, regulation, legal process, or enforceable government request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.

4. Data Retention

We retain your account data, the files you upload, and the analysis data derived from them for as long as your account is active. From your Account page you can export a copy of all your data or permanently delete it, and you can delete individual analyses from each tool's history at any time. Deleting an analysis, your account, or your community also deletes the related original uploaded files from our cloud storage. When content is sent to our AI providers for processing, those providers may retain it transiently (generally up to 30 days) for security and abuse-prevention purposes before deletion, per their commercial terms. Upon account deletion, we remove your personal information within 30 days, except where retention is required by law.

Deletion records for AI fair use. When you delete your account or community, we keep a one-way, salted hash of your email address (or community name) together with that month’s AI usage counts for 90 days. The hash cannot be turned back into your email address. It lets us stop the same AI budget from being reset by deleting and signing up again, and it lets you reactivate your account with a single-use link that expires after 60 minutes. These records are deleted automatically when the 90 days end.

Email confirmation. We send new accounts a link to confirm their email address. We store only a hashed copy of the link’s token, which expires after 48 hours.

5. Cookies and Tracking Technologies

Cookie Table

Analytics cookies are loaded only after you give consent via the cookie banner. If you decline or close the banner, no analytics cookies are set.

Global Privacy Control (GPC)

We honour the Global Privacy Control (GPC) browser signal. If your browser sends GPC, we treat it as an opt-out of non-essential tracking and analytics cookies will not load, regardless of any prior consent choice. When we detect a GPC signal, we display an on-screen confirmation so you can see that your signal was received and honoured.

6. AI and Automated Decision-Making

HOA King℠ uses artificial intelligence to analyze uploaded documents and community records and generate outputs including:

• PDF text extraction: reading the text of uploaded PDFs, including scanned pages, so they can be searched and analyzed.
• Docs Q&A: AI-generated answers to natural-language questions about your governing documents.
• Reserve Study Analyzer: Automated assessment of reserve funding health, projected shortfalls, and component timelines based on uploaded reserve study data.
• Financial Dashboard: AI-driven categorization of bank statement transactions, automatic detection of the statement type (budget, income statement, balance sheet, etc.), financial statement extraction, and summary analysis.
• Anomaly detection: flagging unusual transactions or spending patterns for board review.
• Board Copilot: answers to questions about your community’s records, such as contracts, deadlines, and action items.
• Board reports and playbook guidance: AI-written summaries and step-by-step guidance based on your community’s records.
• Meeting minutes: draft minutes generated from your meeting agenda and notes, for the board to review, edit, and approve.

These AI-generated outputs are provided to support board decision-making. They are not a substitute for legal, accounting, engineering, or reserve-study professionals. Each community has a shared monthly AI budget; when it runs out, AI features pause until the budget resets on the first day of the next month, and all non-AI features keep working. No decisions are made about you based solely on automated processing — the AI processes documents for you at your explicit request.

The AI models are operated by Anthropic (Claude) and OpenAI. The relevant portions of your documents are transmitted to their infrastructure for processing and, under their commercial API terms, are not used to train their models.

6.1 Human Decision-Making and the Colorado AI Act

We are mindful of emerging rules on artificial intelligence. Colorado has enacted the Colorado Artificial Intelligence Act (SB 24-205, as amended by SB 189), with obligations currently scheduled to take effect January 1, 2027 and enforcement presently stayed pending litigation; we disclose our AI practices proactively in advance of that date. HOA King's AI features are decision-support tools, not automated decision-makers. Any consequential action affecting an individual homeowner — for example, a collections action, a fine, or an assessment determination — is a human decision made by your association's board or its authorized agents. Such decisions may be informed by AI-generated summaries or analyses, but they are not made by the AI, and HOA King does not itself make or execute any decision about a homeowner.

If an AI-generated report references you and you would like to understand it, you may request the underlying data and a plain-language description of the methodology used to produce it through the privacy-rights process described in Section 8.

7. Data Security

We implement technical safeguards including HTTPS/TLS encryption in transit, AES-256-GCM authenticated encryption at rest for transaction descriptions and stored analysis payloads, encrypted storage for MFA secrets, hashed passwords (bcrypt), and security response headers (HSTS, CSP, X-Content-Type-Options). Transaction amounts, dates, and categories remain queryable so the Service can calculate date-range totals, charts, and forecasts. Access to production systems is restricted and logged.

For reliability and troubleshooting, we retain privacy-safe processing diagnostics for up to 30 days. These records contain a request reference, operation type, status, timing, file size, and sanitized technical error details; they do not contain uploaded document content, transaction descriptions, filenames, account numbers, or AI prompts and responses.

8. Your Privacy Rights

Depending on where you live, you may have rights under state privacy laws including the California Consumer Privacy Act (CCPA/CPRA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Virginia Consumer Data Protection Act (VCDPA), and the privacy laws of Texas, Oregon, Montana, New Hampshire, New Jersey, Indiana, Kentucky, Rhode Island, Utah, and other states.

These rights may include:

• Access / Know: Request the categories and specific pieces of personal information we hold about you.
• Delete: Request deletion of your personal information.
• Correct: Request correction of inaccurate personal information.
• Portability: Receive your data in a portable format.
• Opt-out of sale/sharing: We do not sell or share personal information for cross-context behavioural advertising. See Your Privacy Choices.
• Limit use of sensitive information: You may direct us to limit the use of your sensitive personal information (see Section 8.1).
• Non-discrimination: We will not discriminate against you for exercising your rights.

To exercise any of these rights, submit a request through our Privacy Data Request form or email us at [email protected]. We will respond within 45 days (with a possible 45-day extension if needed). If we deny a request, you may appeal by contacting us at the same address.

8.1 Sensitive Personal Information

Some financial documents you upload — in particular bank statement CSV files — can contain sensitive personal information as defined under the CCPA/CPRA and similar laws, such as bank account and routing numbers. We treat this category of data with heightened care:

• Automatic redaction: When you import a bank statement or receivables file, HOA King automatically detects and masks values that look like bank account or routing numbers before the data is stored or sent for AI analysis. Only a masked form (for example, the last few digits) is retained, so full account numbers are not persisted on our systems.
• Sensitive-category descriptions: When you turn on the Limit the Use of My Sensitive Personal Information control (described below), transaction descriptions that appear to reference medical or health providers, mental-health services, reproductive-health services, or religious organizations are automatically replaced with a generic category label before any transaction data is sent to our AI providers for categorization or anomaly analysis. The original description is never transmitted to the AI providers in that case; it remains in your encrypted records and stays visible to your board.
• Encryption: Stored transaction descriptions and analysis payloads are encrypted at rest.
• Limit the use of my sensitive personal information: From your Account settings you can turn on the Limit the Use of My Sensitive Personal Information control. HOA King already limits sensitive-data use to providing the Service you request; this control records your formal direction under the CCPA/CPRA that we not use or disclose your sensitive personal information beyond those permitted purposes.

8.2 Requests From Homeowners Who Are Not Account Holders

HOA King℠ is provided to community associations (our customers). If you are a homeowner or resident whose information may appear in documents an association uploaded — but you do not hold a HOA King account yourself — you can still exercise your privacy rights. Because we do not have a direct login relationship with you, we use an identity-verification step to protect everyone's data:

• Submit a request through our Homeowner Privacy Request form, providing your name, the name of your HOA or community, and your unit or property address so we can locate any relevant records.
• To confirm you are who you say you are, we coordinate with your community's board or its authorized administrator to verify your identity within five (5) business days before our staff search stored records on your behalf.
• Once your identity is verified, we process your access, correction, or deletion request within the statutory timeframe (generally 45 days, with a possible extension).

This verification step exists to prevent unauthorized parties from obtaining another person's information. If your community's board cannot confirm your identity, we may be unable to fulfil the request.

8.3 State-Specific Rights and Appeals

The exact rights available to you, and where to appeal or complain if a request is denied, depend on your state of residence. The summaries below cover the states whose comprehensive privacy laws are within the scope of our operations. In every case you may submit a request through our Privacy Data Request form or email [email protected], and where a law provides an appeal right you may appeal a denied request by replying to our decision at the same address. This is a summary for convenience and is not legal advice; the governing statute controls.

California — CCPA/CPRA

California residents have the right to know/access, delete, and correct personal information; to opt out of the sale or sharing of personal information; to limit the use and disclosure of sensitive personal information (see Section 8.1); and to be free from discrimination for exercising these rights. If we deny your request you may appeal by replying to our decision. You may also file a complaint with the California Privacy Protection Agency or the California Attorney General.

Colorado — Colorado Privacy Act (CPA)

Colorado residents have the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; if the appeal is denied you may contact the Colorado Attorney General.

Connecticut — Connecticut Data Privacy Act (CTDPA)

Connecticut residents have the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; unresolved concerns may be submitted to the Connecticut Attorney General.

Virginia — Virginia Consumer Data Protection Act (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; if the appeal is denied you may submit a complaint to the Virginia Attorney General.

Texas — Texas Data Privacy and Security Act (TDPSA)

Texas residents have the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; unresolved concerns may be submitted to the Texas Attorney General.

Oregon — Oregon Consumer Privacy Act (OCPA)

Oregon residents have the right to access personal data (including, on request, a list of specific third parties to which data has been disclosed), correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; unresolved concerns may be submitted to the Oregon Department of Justice.

Montana — Montana Consumer Data Privacy Act (MCDPA)

Montana residents have the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; unresolved concerns may be submitted to the Montana Department of Justice, Office of Consumer Protection.

New Hampshire — New Hampshire Privacy Act

New Hampshire residents have the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; unresolved concerns may be submitted to the New Hampshire Department of Justice, Consumer Protection Bureau.

New Jersey — New Jersey Data Privacy Act (NJDPA)

New Jersey residents have the right to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. You have the right to appeal a denied request; unresolved concerns may be submitted to the New Jersey Division of Consumer Affairs.

Utah — Utah Consumer Privacy Act (UCPA)

Utah residents have the right to access and delete personal data, obtain a portable copy of personal data, and opt out of targeted advertising and the sale of personal data. The Utah law does not provide a right to correct or a formal appeal process. You may direct concerns to the Utah Division of Consumer Protection or the Utah Attorney General.

Residents of other states with comprehensive privacy laws (including Indiana, Kentucky, Rhode Island, and others as they take effect) may have similar rights; contact us and we will honour the rights available to you under applicable law.

9. Children’s Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting a notice on the Service and updating the “Last updated” date above. Your continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

UFO Chaser® LLC
Email: [email protected]