Privacy Policy

Introduction

OnlyHOA LLC, a Nevada limited liability company ("OnlyHOA," "Company," "we," "us," or "our"), operates an online community management platform accessible at https://onlyhoa.com and related subdomains (the "Platform"). This Privacy Policy describes how we collect, use, disclose, and safeguard personal information submitted by users of the Platform, including homeowners, board members, property managers, and administrative personnel (collectively, "Users").

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy. If you do not agree, you must discontinue use of the Platform immediately.

Information We Collect

We collect the following categories of personal information:

A. Information You Provide Directly

• Account Registration Data: First name, last name, email address, phone number, mailing address, unit number, and password credentials.
• Community Profile Data: Role within a homeowners association (e.g., homeowner, board member, property manager), community affiliation, and unit information.
• Communications: Messages, announcements, support inquiries, contact form submissions, and any other content you submit through the Platform.
• Financial Data: General ledger entries, invoice records, and association fee information as entered by authorized community administrators. When you make a payment or connect a bank account through the Platform, your payment card or bank-account details are collected and processed directly by our third-party payment and bank-verification providers (see Section 9); OnlyHOA does not store full payment card or bank-account numbers on its own systems.
• Documents and Files: Any documents, images, or attachments uploaded to the Platform.

B. Information Collected Automatically

• Log Data: IP address, browser type and version, operating system, referring URLs, pages visited, access timestamps, and session duration.
• Device Identifiers: Device type, screen resolution, and user agent string.
• Session Data: Authentication tokens and session identifiers stored server-side.

C. Information from Third-Party Authentication Providers

If you authenticate via Google or Microsoft OAuth, we receive your name, email address, and profile picture URL from those providers subject to their respective privacy policies. We do not receive or store your third-party account passwords.

How We Use Your Information

We use the personal information we collect for the following purposes:

• To create, maintain, and authenticate your account on the Platform.
• To provide, operate, and improve the features and functionality of the Platform.
• To facilitate communication between community members, board members, and management personnel.
• To send transactional notifications, system alerts, and service-related communications.
• To enforce our Terms of Service and investigate potential violations.
• To generate aggregated, de-identified analytics for internal business purposes.
• To maintain audit logs and security records as required for platform integrity.
• To comply with applicable legal obligations, court orders, and governmental requests.
• To respond to your inquiries submitted via support channels.

We do not sell, rent, or otherwise transfer your personal information to third parties for monetary consideration. We do not use personal information to serve targeted advertising.

Disclosure of Information

We may disclose your personal information to the following categories of recipients:

• Community Administrators: Property managers and board members of your associated community may access your profile information, unit data, and communications within the scope of their administrative role.
• Service Providers: Third-party vendors that provide hosting, database management, email delivery, and infrastructure services, subject to confidentiality obligations and data processing agreements.
• Legal Compliance: We may disclose information when required by law, regulation, legal process, or enforceable governmental request, including to respond to subpoenas, court orders, or law enforcement inquiries.
• Business Transfers: In connection with a merger, acquisition, asset sale, or other corporate restructuring, your information may be transferred to the successor entity, subject to equivalent privacy protections.
• Protection of Rights: We may disclose information where necessary to protect the rights, property, or safety of OnlyHOA, its users, or the public.

We do not disclose personal information to unaffiliated third parties for their independent marketing purposes.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, to maintain your account in active standing, and to comply with applicable legal, accounting, and regulatory requirements.

Upon termination or deactivation of a user account, we will retain personal information for a period not to exceed seven (7) years for audit and legal compliance purposes, after which time it will be securely deleted or anonymized in accordance with our data retention schedule.

Users may submit a Data Subject Access Request (DSAR) to request deletion of their personal information prior to the end of the retention period, subject to our legal obligations to retain certain records. DSAR requests may be submitted to legal@onlyhoa.com.

Security

OnlyHOA employs enterprise-grade technical and organizational security measures to protect personal information against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption in transit and at rest: Personal information is protected with industry-standard encryption both while transmitted over networks and while stored.
• Password protection: User passwords are protected using strong, salted one-way hashing and are never stored in readable form.
• Access controls: Role-based, least-privilege permission profiles govern access to information, and administrative activity is recorded in audit logs.
• Session protection: Authenticated sessions use anti-forgery protections and configurable timeouts; multi-factor authentication is available to all users and required for privileged roles.

Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security and disclaim liability for unauthorized access beyond our reasonable control.

Your Rights Under the CCPA / CPRA

California residents and users of the Platform have the following rights with respect to their personal information:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding twelve (12) months.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use of sensitive personal information to purposes reasonably necessary to provide the Platform.

To exercise any of the above rights, you may either (a) submit a verifiable request to legal@onlyhoa.com, or (b) use our Privacy Request web form. We will respond within forty-five (45) days of receipt of a verifiable request, with a possible extension of an additional forty-five (45) days when reasonably necessary. (Where GDPR applies, we respond within thirty (30) days.)

Cookies and Tracking Technologies

The Platform uses session cookies and authentication cookies that are strictly necessary for Platform functionality, including maintaining authenticated sessions and anti-CSRF protection. We do not use third-party tracking cookies, advertising pixels, or cross-site behavioral tracking technologies.

You may configure your browser to refuse cookies; however, doing so may impair your ability to use authenticated features of the Platform.

Third-Party Services

The Platform integrates with the following third-party services, each governed by their own privacy policies:

• Google OAuth 2.0 — Authentication service. Privacy policy: policies.google.com/privacy
• Microsoft Identity Platform — Authentication service. Privacy policy: privacy.microsoft.com
• Cloud hosting, email & messaging providers — Hosting, email delivery, and text-message transmission infrastructure, operating under confidentiality and data-processing obligations.
• Stripe — Payment card processing. When you pay by card, your card details are entered into and handled by Stripe. Privacy policy: stripe.com/privacy
• Dwolla — Bank (ACH) transfer processing for association payments. Privacy policy: dwolla.com/legal/privacy
• Plaid — Secure verification of a bank account you choose to link. Plaid handles your banking credentials directly; OnlyHOA never receives them. Plaid End User Privacy Policy: plaid.com/legal
• Anthropic Claude API — AI-powered document search feature, gated by community feature flag. Queries are processed subject to Anthropic's data usage policies.

OnlyHOA is not responsible for the privacy practices of third-party services. We encourage you to review their respective privacy policies.

Artificial Intelligence (AI) Features

Certain optional features of the Platform use artificial intelligence to help staff draft notices, summarize documents, and answer questions. These features are off by default and are enabled per community by an administrator.

Personal information is minimized before AI processing. Where an AI feature would otherwise involve personal information, the Platform removes or replaces identifying details (such as names, email addresses, phone numbers, and addresses) with neutral placeholders before the request is sent to our AI provider, and restores them only within your own session. Some features operate only on non-identifying context (such as a community name and the user's role) or on financial figures that contain no personal information.

Your data is not used to train AI models. Our AI provider, Anthropic, processes requests through its commercial API and does not use the content of those requests or responses to train its models.

AI output is provided to assist authorized staff and is reviewed by a person before any action with legal effect (such as issuing a notice) is taken; the Platform does not make such decisions solely by automated means. AI features can be disabled by your administrator at any time.

SMS / Text Messaging

With your consent, OnlyHOA sends text messages for account verification (multi-factor authentication / one-time passcodes) and account or community notifications. Message frequency varies; message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

To deliver these messages, we share your mobile number and the message content with our third-party messaging and communications providers solely for the purpose of transmitting the message. Those providers may use the information only to deliver the message on our behalf and are prohibited from using it for their own purposes.

Where text messages are sent through the Platform on behalf of a management company or homeowners association (a "Community Organization"), OnlyHOA acts solely as the technology and messaging platform. The Community Organization determines the content and recipients of those messages and is responsible for obtaining any required consents from its members; our handling of that information is governed by our agreement with the Community Organization.

We do not sell or share your mobile phone number or SMS opt-in consent with any third party or affiliate for their own marketing or promotional purposes.

Children's Privacy

The Platform is designed exclusively for use by adults in connection with the administration of residential homeowners associations. Access to the Platform requires an invitation issued by an authorized community administrator; the Platform does not permit open public registration. Accordingly, the Platform is not directed to, and does not knowingly solicit or collect personal information from, individuals under the age of thirteen (13).

In the course of community management operations, a community administrator may input contact information associated with a property whose legal owner or designated household contact is a minor. If you are a community administrator and are aware that a household contact or property owner of record is a minor under the age of thirteen (13), you must contact us at legal@onlyhoa.com prior to entering that individual's personal information into the Platform so that appropriate safeguards may be applied.

If OnlyHOA becomes aware that personal information has been collected from or entered on behalf of a child under the age of thirteen (13) without the implementation of appropriate safeguards or verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA), we will take prompt steps to delete or restrict access to such information.

If you believe we have inadvertently collected or retained personal information pertaining to a minor under the age of thirteen (13), please contact us immediately at legal@onlyhoa.com. We will investigate and respond to all such notices within a reasonable time.

Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Material changes will be communicated to registered users via email notification to the address associated with your account and/or via a prominent notice on the Platform prior to the changes becoming effective.

Your continued use of the Platform following the effective date of any modification constitutes your acceptance of the revised Privacy Policy. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Entity: OnlyHOA LLC (Nevada limited liability company)
• Mailing Address: 732 S 6th St, Ste N, Las Vegas, NV 89101
• Email (Privacy / Legal): legal@onlyhoa.com
• Email (General Support): support@onlyhoa.com
• Website: https://onlyhoa.com

OnlyHOA LLC is organized under the laws of the State of Nevada and operates from Las Vegas, Nevada, United States. All inquiries will be addressed in accordance with applicable law.