Privacy Policy & User Agreement

1. Introduction

HOAM App, LLC dba Anthoam ("Anthoam," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy & User Agreement ("Policy") describes how we collect, use, disclose, and safeguard your information when you use the Anthoam platform ("Platform"). Please read this Policy carefully. By using the Platform, you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, phone number, and role within your HOA community
• Profile Information: Unit number, residency type (owner-occupant, tenant, non-resident owner), mailing address, and emergency contact details
• Financial Information: Payment method details (processed by Stripe; we do not store full credit card numbers), dues payment history, and financial product enrollment data
• Communication Data: Messages sent through the Platform's direct messaging system, maintenance requests, announcements, and community communications
• Documents: Files uploaded to the Platform such as HOA governing documents, meeting minutes, financial reports, and community records
• Voting Data: Votes cast in community polls and elections, including vote selections and timestamps
• Amenity Booking Data: Reservation details, booking dates, times, and facility preferences
• Vendor Information: Vendor contact details, service records, contract information, and performance notes submitted by property managers
• Move-In/Move-Out Data: Inspection records, deposit tracking information, key management records, and related workflow data
• Beta/Lead Request Information: Property details, community information, and notes submitted through our access request forms

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and interaction patterns
• Device Information: Browser type, operating system, device identifiers, and screen resolution
• Log Data: IP addresses, access times, referring URLs, and error logs
• Browser Security Reports: When your browser blocks a resource under our Content Security Policy, it may send us the blocked resource's origin, the policy directive, enforcement status, and HTTP status. We discard page URLs, source-file paths, code samples, referrers, and unrecognized report fields.
• Notification Preferences: Your email notification settings and communication preferences

2.3 AI-Generated Content

When you use AI-powered features (such as Ask Anthoam or document analysis), your inputs may be processed by third-party AI services. For governing-document review, an authorized manager or board member must first choose whether to enable this processing for the community. If enabled, a review may run when requested and automatically each day for governing documents whose text changed; the choice can be declined or changed in community settings. Communities with no recorded choice are not analyzed. The responses generated by these services are stored on the Platform as part of your interaction history. We minimize personally identifiable information sent to AI providers and use data processing provisions available under their business terms.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform and its features
• Process payments and manage financial transactions
• Facilitate communication between community members, managers, and board members through direct messaging and announcements
• Send notifications about community events, maintenance updates, voting deadlines, amenity bookings, and account activity
• Conduct and tally community votes and polls
• Manage amenity reservations and booking schedules
• Facilitate document storage, organization, and sharing within communities
• Support vendor management and service tracking
• Process move-in/move-out workflows and capital project tracking
• Respond to your inquiries and support requests
• Generate financial reports, analytics, and community insights
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our Terms of Service
• Power AI-assisted features such as Ask Anthoam responses, document analysis, and intelligent search (using anonymized or aggregated data where possible)

4. Third-Party Services

We use third-party services to operate the Platform. Depending on the feature you use, these providers may receive the limited information described below:

5. Data Sharing & Disclosure

We may share your information in the following circumstances:

• Within Your Community: Your name, unit number, and community role are visible to other members of your HOA as needed for community management. Your votes in community polls may be visible to managers and board members depending on poll configuration.
• Property Managers & Board Members: Authorized managers and board members can access resident information, payment records, messaging logs, voting data, amenity bookings, and community data for management purposes
• Financial Product Partners: If you enroll in third-party financial products (e.g., home warranties, insurance), your contact and relevant information may be shared with the product provider
• Service Partners: If your community or you request a partner-delivered service through the Platform (e.g., a building or energy audit, capital-loan introduction, project management, insurance, security, or home-warranty inquiry), the contact details and property information needed to scope and deliver that engagement are shared with the matched licensed partner. Partners receive only the information relevant to the requested engagement and contract with you directly under their own privacy practices
• Referrer Attribution: If your community joined Anthoam through a recognized referrer or partner, that referrer's business name and contact information are displayed to your community; conversely, if you are a partner or referrer, the business profile you provide (name, contact details, website, description) may be displayed to the communities you referred or serve
• Legal Requirements: We may disclose your information if required by law, legal process, or governmental request
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity
• With Your Consent: We may share your information for any other purpose with your explicit consent

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Financial transaction records are retained for a minimum of seven (7) years to comply with accounting and tax requirements. Community records, documents, and voting data are retained for the duration of the HOA's use of the Platform. Direct messages are retained as long as your account is active and for a reasonable period afterward. Upon account termination, we will delete or anonymize your personal information within ninety (90) days, except where retention is required by law or for legitimate business purposes. You may request deletion of your data by contacting us at support@anthoam.com.

Canceled communities. When a community's subscription is canceled, we retain the community's data and uploaded files for ninety (90) days so the community can reactivate it or export its data during that window. At the end of the 90-day window, the community's active-service data and uploaded files are removed under our deletion process and are no longer available through the Platform, except where longer retention is required by law (for example, the financial transaction records described above). Limited provider-managed backup or retention copies may persist under the provider's retention practices; exact backup lifecycle and deletion timing are not established. Such copies are not available for ordinary reactivation or account use. If a community pauses its subscription instead of canceling, its data and uploaded files are preserved for the duration of the pause.

7. Data Security

Anthoam uses technical and operational safeguards to reduce risk. The controls below describe the current product boundaries; they do not guarantee absolute security.

• Sign-in and sessions: Sessions rotate after sign-in and use Secure, HttpOnly cookies in production. Session activity is checked on the server, and malformed activity timestamps are rejected rather than trusted.
• Organization and role access: The server checks active role assignments before guarded requests proceed. For guarded row-based resources, Anthoam resolves the resource's owning organization before it decides whether the request may continue.
• File upload boundaries: Uploads use short-lived, single-use authorization tied to the actor, organization, and purpose. After upload, Anthoam verifies the declared file size and type against object metadata and requires an object generation value. A mismatch fails closed.
• Request and browser protections: State-changing requests use CSRF protection and production sends browser-security headers. Production responses send browser-security headers including a nonce-based Content Security Policy, HSTS, frame and object restrictions, and constrained browser permissions.
• Payment boundaries: Payment-card entry stays in Stripe components; Anthoam does not store full card numbers. Stripe webhook handling requires a signature header and preserves the raw request body for Stripe's signature verification.
• Monitoring and audit records: Production error context is sanitized, and relevant changes create scoped audit records. Relevant application changes write scoped audit records. Anthoam does not represent these controls as continuous human monitoring or as a complete, tamper-proof forensic log.

However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

Reporting a vulnerability: please use our security-report form and provide a safe summary without secrets, personal data, or exploit details. We do not publish an acknowledgement or remediation-time commitment. See our Security page for the current control summary and reporting guidance.

8. Your Rights & How to Exercise Them

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request a copy of your data in a structured, machine-readable format
• Opt-Out: Opt out of certain data processing activities, including marketing communications

How to submit a request: If you have a Anthoam account, you can submit data export and account deletion requests directly from your Settings > Data & Privacy page. Alternatively, you can email us at support@anthoam.com. We will respond to your request within thirty (30) days.

9. California Privacy Rights (CCPA) & Do Not Sell

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights
• Do Not Sell: We do not sell your personal information to third parties. You can formally opt out using the control below

To submit a CCPA request, contact us at support@anthoam.com or use the data request tools available in your account settings. We may need to verify your identity before processing your request.

10. Cookies & Tracking

The Platform uses session cookies and local storage to maintain your authentication state and preferences. We use essential cookies necessary for the Platform to function properly and may use analytics technologies from services identified in Section 4 to understand page and feature usage. We do not use this data to sell personal information or serve third-party behavioral advertising. You can configure your browser to reject cookies, but this may limit your ability to use certain features of the Platform.

Anthoam uses analytics cookies by default to understand site activity, improve the Platform, and keep it reliable. You can select “Continue without” in the analytics notice to opt out. After you opt out, Google Analytics and Microsoft Clarity receive a denied analytics-storage signal and may provide limited, cookieless measurement without recognizing you across visits. A browser Global Privacy Control signal also forces analytics storage to remain denied. Advertising storage and personalization remain disabled. Your choice is stored locally and can be changed by clearing site data. Anthoam does not sell personal information or use these services to serve third-party behavioral advertising. Essential session cookies used for authentication and security remain necessary for the Platform to function.

11. GDPR — European Data Protection Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent local legislation. This section supplements the rest of our Privacy Policy.

Lawful Basis for Processing

We process your personal data on the following legal bases:

• Contract Performance: Processing necessary to fulfill our obligations under your service agreement (e.g., account management, payment processing, community features)
• Legitimate Interests: Processing for our legitimate business interests, such as improving the Platform, preventing fraud, and ensuring security, where those interests are not overridden by your data protection rights
• Consent: Processing based on your freely given consent, such as marketing communications or optional AI features. You may withdraw consent at any time
• Legal Obligation: Processing necessary to comply with applicable laws and regulations

Data Subject Rights

Under the GDPR, you have the following rights:

• Right of Access: Obtain confirmation of whether we process your data and request a copy of it
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data, subject to legal retention obligations
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller
• Right to Object: Object to processing based on legitimate interests, including profiling and direct marketing
• Right to Restrict Processing: Request restriction of processing under certain circumstances while we verify or resolve concerns

To exercise any of these rights, please contact our Data Protection Officer at the email below. We will respond within thirty (30) days. You also have the right to lodge a complaint with your local data protection supervisory authority.

Cross-Border Data Transfers

Your personal data may be transferred to, stored, and processed in the United States or other countries outside the EEA. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other legally recognized transfer mechanisms. You may request a copy of the applicable safeguards by contacting us.

Data Protection Officer

12. Children's Privacy

The Platform is intended only for users who are at least 18 years old. It is not directed to anyone under the age of 18, and we do not knowingly collect, use, or disclose personal information from anyone under 18. In compliance with the Children's Online Privacy Protection Act (COPPA), we likewise do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from anyone under 18, we will take steps to delete such information promptly. If you believe someone under 18 has provided us with personal information, please contact us at support@anthoam.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Policy on the Platform and updating the "Last Updated" date. Your continued use of the Platform after any changes indicates your acceptance of the updated Policy.

14. SMS / Mobile Messaging

If you opt in to receive SMS text messages from Anthoam, this section describes the messages we send, how often, the costs you may incur, and how we handle your mobile phone number. By providing your mobile phone number and checking the consent box on the SMS opt-in surface in your account, you agree to the terms in this section.

Opting in to SMS is optional. You can create an account and fully use Anthoam without enabling text messages — SMS consent is not a condition of creating an account, using the service, or completing any transaction.

Message Types

All Anthoam text messages are operational and transactional, including: account verification codes, maintenance and work-order updates, payment and billing reminders, operational community notices from your manager or board, including emergency alerts, governance notices (voting, board meetings), and (for vendors) quote invitations. "Community notices" are operational messages a community's manager or board sends to its own residents through Anthoam; they are not Anthoam marketing. Anthoam does not send promotional or marketing text messages, and we do not request consent for marketing.

Message Frequency

Message frequency varies based on community activity and the events you are subscribed to. You may receive multiple messages per week during periods of active community business and few or none during quiet periods.

Message & Data Rates

Msg & data rates may apply. Standard message and data rates from your mobile carrier may apply to messages you send to or receive from Anthoam, depending on your mobile service plan. Anthoam does not charge a fee for receiving SMS messages.

HELP and STOP

Reply HELP to any Anthoam text message for help, or email support@anthoam.com. Reply STOP to any Anthoam text message to opt out at any time. After opting out, you will receive a confirmation message and no further SMS from Anthoam. You may also remove your mobile number from your account at Settings → Notifications.

Non-Sharing of Mobile Numbers

Mobile phone numbers and SMS opt-in consent records are used solely to deliver the messages described above and to support account security. We do not sell, rent, or share mobile phone numbers or SMS opt-in data with third parties or affiliates for marketing or promotional purposes. The only third parties that receive your mobile number are the telecommunications providers necessary to deliver your messages (e.g., Twilio and downstream carriers).

Consent Records

When you opt in, we record the timestamp, IP address, user agent, and the exact consent text you agreed to. These records are retained as long as your account is active and for a reasonable period afterward to demonstrate compliance with applicable law and carrier requirements.

The public mirror of the SMS opt-in disclosure is available at /sms-opt-in.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at support@anthoam.com.