Privacy Policy

This Privacy Policy describes how UFO Chaser LLC (“we,” “us,” “our”) collects, uses, shares, and protects personal information through the HOA King service at hoakingapp.com (the “Service”). It applies to all visitors, account holders, and anyone whose information is present in documents uploaded to the Service.

1. Information We Collect

1.1 Account Information

When you create an account we collect your name, email address, and a password (hashed; we never store plaintext passwords). During onboarding you also provide your HOA or community name and the number of units, which we use to determine your plan tier.

1.2 Uploaded Documents and What We Store

You may upload HOA governing documents (CC&Rs, bylaws, rules), reserve studies (PDF), and bank statement CSV files. We process each file to provide the analysis you request. We do not retain the original uploaded file after processing. Instead, we store only the information derived from it, associated with your account:

• Governing documents: the extracted text passages and their numerical embeddings, used to answer your questions.
• Reserve studies: the structured funding figures, components, and projections extracted from the study.
• Bank statements: the individual transaction rows and category summaries.

We keep this derived data so you can revisit past analyses. You can export or permanently delete it at any time (see Section 4).

1.3 AI Processing of Your Content

When you use the Docs Q&A, Reserve Study Analyzer, or Financial Dashboard features, the relevant content is transmitted to trusted third-party AI providers to generate results:

• Anthropic (Claude models): receives your reserve study PDF, the transaction rows from your bank statement, and your governing-document questions, to produce analyses and answers.
• OpenAI: receives passages of your governing documents to create the numerical embeddings that power document search and Q&A.

These providers process your content under their commercial API terms. Under those terms, your inputs and the AI outputs are not used to train their models. Providers may retain submitted content transiently (generally up to 30 days) for security and abuse-prevention purposes before deleting it, unless a shorter zero-retention arrangement applies. We do not use your documents or AI outputs to train any models.

1.4 Automatically Collected Information

With your consent, we use Google Analytics to collect usage data such as pages visited, session duration, device type, and approximate location derived from IP address. We also use the Abacus.AI platform chat widget for in-app support. See the Cookies and Tracking section below.

1.5 Authentication Data

If you sign in with Google, we receive your name, email, and profile image from Google. We do not access your Google Drive, Gmail, or other Google services.

1.6 Billing Information

If your association subscribes to a paid plan, payments are handled by Stripe, our payment processor. Stripe securely collects and stores your payment method directly; we never receive or store your full card details. On our systems we retain only a Stripe customer reference, your subscription status, and your current billing-period end date, so we can provide access to paid features.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process uploaded documents through AI analysis at your request
• Authenticate your identity and secure your account (including optional MFA)
• Determine your plan tier based on community size
• Communicate about your account, security, or changes to this policy
• Measure site usage and improve features (with consent; see Section 5)

3. How We Share Your Information

We do not sell personal information. We share information only in these circumstances:

• AI processing: Anthropic (Claude) and OpenAI process the document content you submit in order to generate analyses, under their commercial API terms which prohibit training on your data.
• Hosting & infrastructure: the Abacus.AI platform provides application hosting, database, and the in-app support chat widget.
• Analytics & optional sign-in: Google (analytics, with your consent, and optional Google sign-in).
• Payment processing: Stripe processes subscription payments on our behalf. When your association subscribes, Stripe collects and stores your payment details (such as card information) directly under its own security and privacy terms. We do not store full card numbers on our systems — we retain only a customer reference, subscription status, and renewal date.
• All of these providers process data on our behalf under contractual obligations.
• Legal requirements: When required by law, regulation, legal process, or enforceable government request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.

4. Data Retention

We retain your account data and the analysis data derived from your uploads for as long as your account is active. From your Account page you can export a copy of all your data or permanently delete it, and you can delete individual analyses from each tool's history at any time. When content is sent to our AI providers for processing, those providers may retain it transiently (generally up to 30 days) for security and abuse-prevention purposes before deletion, per their commercial terms. Upon account deletion, we remove your personal information within 30 days, except where retention is required by law.

5. Cookies and Tracking Technologies

Cookie Table

Analytics cookies are loaded only after you give consent via the cookie banner. If you decline or close the banner, no analytics cookies are set.

Global Privacy Control (GPC)

We honour the Global Privacy Control (GPC) browser signal. If your browser sends GPC, we treat it as an opt-out of non-essential tracking and analytics cookies will not load, regardless of any prior consent choice.

6. AI and Automated Decision-Making

HOA King uses artificial intelligence to analyze uploaded documents and generate outputs including:

• Docs Q&A: AI-generated answers to natural-language questions about your governing documents.
• Reserve Study Analyzer: Automated assessment of reserve funding health, projected shortfalls, and component timelines based on uploaded reserve study data.
• Financial Dashboard: AI-driven categorization of bank statement transactions and summary analysis.

These AI-generated outputs are provided to support board decision-making. They are not a substitute for legal, accounting, engineering, or reserve-study professionals. No decisions are made about you based solely on automated processing — the AI processes documents for you at your explicit request.

The AI models are operated by Anthropic (Claude) and OpenAI. The relevant portions of your documents are transmitted to their infrastructure for processing and, under their commercial API terms, are not used to train their models.

7. Data Security

We implement technical safeguards including HTTPS/TLS encryption in transit, AES-256-GCM authenticated encryption at rest for transaction descriptions and stored analysis payloads, encrypted storage for MFA secrets, hashed passwords (bcrypt), and security response headers (HSTS, CSP, X-Content-Type-Options). Transaction amounts, dates, and categories remain queryable so the Service can calculate date-range totals, charts, and forecasts. Access to production systems is restricted and logged.

For reliability and troubleshooting, we retain privacy-safe processing diagnostics for up to 30 days. These records contain a request reference, operation type, status, timing, file size, and sanitized technical error details; they do not contain uploaded document content, transaction descriptions, filenames, account numbers, or AI prompts and responses.

8. Your Privacy Rights

Depending on where you live, you may have rights under state privacy laws including the California Consumer Privacy Act (CCPA/CPRA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Virginia Consumer Data Protection Act (VCDPA), and the privacy laws of Texas, Oregon, Montana, New Hampshire, New Jersey, Indiana, Kentucky, Rhode Island, Utah, and other states.

These rights may include:

• Access / Know: Request the categories and specific pieces of personal information we hold about you.
• Delete: Request deletion of your personal information.
• Correct: Request correction of inaccurate personal information.
• Portability: Receive your data in a portable format.
• Opt-out of sale/sharing: We do not sell or share personal information for cross-context behavioural advertising.
• Non-discrimination: We will not discriminate against you for exercising your rights.

To exercise any of these rights, submit a request through our Privacy Data Request form or email us at [email protected]. We will respond within 45 days (with a possible 45-day extension if needed). If we deny a request, you may appeal by contacting us at the same address.

9. Children’s Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting a notice on the Service and updating the “Last updated” date above. Your continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

UFO Chaser LLC
Email: [email protected]