Privacy Policy

Overview

ReplyHOA provides document drafting assistance and educational information. We are not a law firm and do not provide legal advice. This policy explains what data we collect and how we use it.

What we collect

• Notice text: The HOA notice text you paste or upload so we can analyze it and draft a response.
• Email address: Collected when you unlock a letter, for delivery and receipt purposes.
• Anonymous session ID: A cookie-based identifier that lets you pick up where you left off without creating an account.
• Payment confirmation: Processed by Stripe. We do not store your full card number.

How long we keep your data

• Notice text, uploaded documents, and analysis results: Retained for as long as needed to provide our services to you. We do not currently have an automated deletion schedule. You may request deletion at any time (see the section below).
• Generated letters and delivery records: Retained for 2 years for tax accounting and dispute resolution purposes.
• Anonymous session cookie: Expires automatically after 90 days. Associated session metadata is retained for analytics and service improvement.

Your rights

You can request deletion of your data at any time by emailing privacy@replyhoa.com. We will process your request within 30 days.

California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) to:

• Know what personal information we collect about you and how it is used.
• Delete your personal information, subject to certain exceptions.
• Opt out of the "sale" or "sharing" of your personal information. ReplyHOA does not sell your personal information.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, email privacy@replyhoa.com with "California Privacy Request" in the subject line. We will verify your identity before processing your request.

Third-party services

• Alibaba Cloud (DashScope): Processes notice text and generates letter drafts using Qwen language models. Data is sent to Alibaba Cloud's U.S. endpoints for processing.
• Stripe: Processes payments. Card details never touch our servers.
• Supabase: Stores case and order data with row-level security.
• PostHog: Product analytics and error tracking. No personal notice content is tracked.

Backend data access

ReplyHOA administrators with a valid admin token can view case metadata (status, dates, risk flags) for support purposes. Full notice text is visible only to the case owner. Admin actions are logged for audit purposes.

Contact

Questions about this policy? Email privacy@replyhoa.com.