Privacy Policy

Last updated: March 2, 2026

1. Introduction

CoolHOA ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use the Service.

2. Information We Collect

Personal Information You Provide

We collect information you provide directly to us, including:

  • Account Information: Email address, HOA name, subdomain, unit count, and timezone when you create an account
  • Billing Information: Payment method details (last four digits, card brand, expiration date) processed securely through Stripe. CoolHOA never receives or stores full card numbers.
  • Communications: Name, email address, subject, and message when you submit our contact form
  • Resident Data: Information about HOA residents that you input into the Service

Information Collected Automatically

When you use our Service, we may collect certain information automatically:

  • Server Logs: Our web servers (nginx and Google Cloud Run) maintain standard access logs that may include IP addresses, request timestamps, and URLs accessed. These logs are used for security monitoring and troubleshooting.
  • IP Address: We collect your IP address when you submit the contact form, for spam prevention and rate limiting purposes.
  • Rate Limiting Data: We track request counts in memory for rate limiting purposes. This data is not persisted to disk.

Cookies and Local Storage

We do not currently use cookies. Authentication tokens are stored in your browser's local storage. If we introduce cookies in the future (e.g., for analytics), we will update this policy and provide appropriate consent mechanisms.

Future Data Collection

When analytics features are enabled, we may collect additional information such as pages visited, features used, time spent on pages, browser type, and operating system. We will update this policy before enabling such collection.

3. How We Use Your Information

We use the information we collect for various purposes, including to:

  • Provide, maintain, and improve the Service
  • Process transactions and send related information
  • Create and manage your account
  • Send transactional emails (account verification, billing notifications)
  • Respond to your comments, questions, and support requests
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations

4. Information Sharing and Disclosure

We may share your information in the following situations:

Service Providers

We share information with the following third-party service providers:

  • Stripe, Inc. — Payment processing (PCI-DSS Level 1 compliant). Receives: customer email address, payment method data via Stripe.js. No full card numbers touch CoolHOA servers.
  • Twilio SendGrid — Transactional email delivery. Receives: recipient email addresses and email content (OTP verification codes, account notifications, contact form notifications).
  • Google reCAPTCHA Enterprise — Spam protection on the contact form. Receives: reCAPTCHA token and your IP address. Subject to Google's Privacy Policy and Terms of Service.
  • Google Cloud Platform — Infrastructure hosting (Cloud Run, Cloud SQL). Your data is processed and stored in the us-central1 (Iowa) region.

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities (e.g., court orders, government requests).

Business Transfers

If CoolHOA is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

With Your Consent

We may share your information for any other purpose with your consent.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

  • 256-bit SSL/TLS encryption for all data in transit
  • Encryption at rest for stored data (Google Cloud SQL)
  • Access controls and authentication requirements
  • Automated backups with secure storage
  • Periodic security assessments

While we strive to use commercially acceptable means to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Specific retention periods include:

  • Email verification records: Automatically expire after 10 minutes
  • Contact form submissions: Retained indefinitely for support records
  • Account data: Retained while your subscription is active; 30-day grace period after cancellation (via soft delete) to allow for reactivation
  • Rate limiting data: Held in memory only; not persisted to disk
  • Database backups: Retained per Google Cloud SQL backup retention policy

After the grace period, your data is scheduled for deletion. We may retain certain information as necessary to comply with legal obligations, resolve disputes, enforce our agreements, and maintain business records.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

Access and Data Requests

You may request a copy of your personal data by contacting us at support@coolhoa.com. We will provide your data in a commonly used format within 30 days.

Correction

You can update or correct your account information through the billing section of your CoolHOA dashboard or by contacting support.

Deletion

You may request deletion of your personal information by contacting us. Note that we may retain certain information as required by law or for legitimate business purposes.

Communications

We currently send only transactional emails (account verification, billing notifications, contact form confirmations). If we introduce marketing emails in the future, you will be able to opt out via an unsubscribe link in each email.

8. Google reCAPTCHA

Our contact form uses Google reCAPTCHA Enterprise to prevent spam. reCAPTCHA may collect hardware and software information, such as device and application data, and send it to Google for analysis. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we learn we have collected personal information from a child under 18, we will delete that information promptly. If you believe we might have any information from or about a child under 18, please contact us.

10. Data Location

Your information is processed and stored in the United States (Google Cloud Platform, us-central1 region). By using the Service, you consent to the processing of your information in the United States.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

  • The right to know what personal information we collect and how it is used
  • The right to request deletion of your personal information
  • The right to opt-out of the sale of personal information (we do not sell personal information)
  • The right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us using the information provided below.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For material changes, we will provide additional notice, such as an email notification.

We encourage you to review this Privacy Policy periodically for any changes. Changes are effective when they are posted on this page.

13. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: