Privacy notice
Last updated: September 16, 2026
What we collect, and why
| Data | Why we have it | How long we keep it |
|---|---|---|
| Homeowner name, email, phone, property address | To prepare and submit your architectural application and to keep you informed | Application records are kept indefinitely as part of the property's approval history; contact details are deleted 3 years after your last activity |
| Plans, photos, specifications you or your contractor provide | Because the association requires them with the application | With the application record |
| Your signature and the signed authorization | To act as your agent with the association; it is your proof and ours | 7 years |
| Contractor business details | To provide the service and invoice for it | 7 years (tax records) |
| Association and board contact details | To submit and follow up. Much of this is public record. | While the association is active in our directory |
Artificial intelligence
We use Anthropic's Claude models to read association governing documents, to check a project against those documents, and to suggest a classification for email an association sends us. No output changes anything on its own — a person reviews it.
We send the association's documents and the project details to the model. We do not send your signature, your phone number, or payment information. Anthropic does not train models on API inputs by default, and we have not opted in.
Who else sees your data
Your association, because that is the point. Your contractor, if they engaged us. And the service providers who run our systems: Supabase (database and files), Vercel (hosting), Resend and Postmark (email), Dropbox Sign (signatures), Stripe (payments), Twilio (text messages), Anthropic (AI), Sentry and PostHog (errors and product analytics). We have data processing agreements with each of them. We do not sell personal information.
Text messages
We text you only about your own application. Reply STOP at any time. We do not send marketing by text.
Your choices
Email privacy@whoa.services to get a copy of your data, correct it, or ask us to delete it. We respond within 30 days. Where an association or tax law requires us to keep a record, we will say so and explain why.
Security
Data is encrypted in transit and at rest. Documents are private by default and served through short-lived links. Access is restricted to the people who need it, and administrative access requires multi-factor authentication.
Contact
privacy@whoa.services · wHOA LLC, Florida