privacy policy

JR Generations LLC d/b/a SpotHOA (“we”) runs SpotHOA and collects four categories of information about you. The public HOA directory is a separate dataset that is not about your account at all; it has its own section below.

• Account data: your name, email address, mobile phone number (confirmed with a text message code; needed only to create or claim a community or to approve people who join by join link, and optional otherwise), profile photo (optional), and the HOAs you belong to. Provided by you or through Stytch at sign-up.
• HOA data: anything your HOA uploads or records — documents, ledger events, dues charges and payments, meeting minutes, votes, violations, work requests, and member directory entries.
• Usage data: server-side ledger events tied to your account (“user X exported ledger Y at time Z”), and error reports from the browser and server with personally identifiable fields scrubbed. When you create a community we also record where your connection appears to come from (the country and region, read from the connection and not kept as an IP address, with a position rounded to about seven miles) and the state, ZIP and a rounded position of the home address you picked, so staff can check that a new community is real. Only SpotHOA staff can see this, and it is deleted with your account.
• Calls and emails to us: if you call our phone line or email hello@spothoa.com, we keep what you tell us (your name and number or email address, a transcript of the call or the text of the email, and a summary) so we can answer you. We do not store call audio.

We intentionally keep the data footprint small. SpotHOA does not:

• Set advertising or retargeting cookies.
• Use third-party tracking pixels outside email delivery. The one analytics tool we run, Cloudflare Web Analytics, sets no cookies and is kept off the sign-in and signed-in pages (see the cookie policy).
• Pull social-graph or profile data beyond what Stytch returns to identify you (name + email).
• Sell any data to third parties. Ever.
• Use your HOA's data to train machine-learning models.

The HOA directory exists so a homeowner can find their association before anyone at that association has heard of us. It is built from public records, so most of what it holds is not personal data and is not tied to any account. This section is for the parts that can be.

• Where listings come from: public agency records, chiefly management certificates filed with the Texas Real Estate Commission, plus public association websites. Every listing names its source, links to the source record where one exists, and shows the date we retrieved it.
• What a listing holds: the association's name, city, county, state, postal code, association type, and the reference to the source record. There is no field for a board member name, a phone number, an email address, or a street address, so we neither import nor publish any of those. What a listing does carry is whatever the source filed: for some associations the place shown is a management company's office rather than the community itself, and the name on the filing is sometimes the management company's. If a listing gets your association wrong, tell us and we will correct it.
• Suggestions: anyone can suggest a missing association at /find-hoa/suggest. We store what the form asks for and nothing else: the association name, city, state, and a public source link. The form does not ask for a name, an email address, or an account, and the stored record carries no submitter identity. Suggestions stay private while staff check the source; a reviewer either creates a listing or rejects the suggestion.
• Claims: a board representative who claims a listing is signed in, and gives the role they hold plus a free-text proof reference, whatever evidence of authority they choose to provide. That text, the reviewer's note, and the decision record are kept as the audit trail for an access decision.
• Abuse controls: the suggestion form is rate limited against a hashed IP address held in short-lived edge storage and protected by Cloudflare Turnstile. The raw IP address is not written to our database.

Removal and correction. Anyone can ask us to remove or correct a listing, whether or not they have an account. Every listing page carries a removal link, or email legal@spothoa.com with the listing reference shown on the page. We aim to acknowledge within 10 business days. Where the underlying record is a public agency filing we can correct or remove our copy; we cannot change the agency's record.

No relationship implied. A listing here is drawn from public records and public sources. It does not mean the association uses SpotHOA, has any relationship with SpotHOA, or endorses SpotHOA, and it is not an endorsement or sponsorship by the Texas Real Estate Commission or the State of Texas.

We rely on the following subprocessors to operate the service. If you disagree with this list, don't use SpotHOA.

• Cloudflare: hosting, edge delivery, D1 (SQLite database), R2 (document + image storage), Workers runtime, Turnstile (CAPTCHA), and Web Analytics (a cookieless page-view counter on our public pages). AI Gateway: every request to an AI provider listed below passes through it. The gateway records which feature made the request, when, and how many tokens it used. For a request that may contain names or other personal details, we tell the gateway to keep no copy of the text it carries.
• Stytch: authentication and user identity (name and email).
• Stripe: online dues collection. Payment card numbers and bank details are handled by Stripe directly; SpotHOA never sees the card number.
• Resend: transactional email delivery (from notifications@info.spothoa.com).
• Sentry: error monitoring. Personally identifiable fields are scrubbed before reports leave the server.
• Anthropic: AI analysis of uploaded documents, answers to questions about an HOA's documents and, from the date the AI switch is turned on, meeting-minutes summaries, announcement drafts, the monthly state-law summary and marketing drafts. Runs only when someone with access asks (the monthly check and marketing drafts send public text only). An analysis sends the document itself; a question sends the question plus the few documents most likely to hold the answer; a minutes summary sends the HOA's name, the meeting title and date and the minutes text; an announcement draft sends the HOA's name and the topic the board member typed. Anthropic does not use this content for model training and handles it under its API terms.
• Google (Gemini): AI drafting. A board admin can ask for a meeting-minutes summary (the HOA's name, the meeting title and date, and the minutes text are sent) or an announcement draft (the HOA's name and the topic they typed are sent). Once a month a check of public state statutes sends the statute text. If you email hello@spothoa.com, an AI model may summarize your message and propose a reply that a person approves before anything is sent. Google handles this text under its Gemini API terms.
• Mapbox: address suggestions. When a signed-in person types an address, for example while setting up a community, our server sends the text they typed to Mapbox and shows the suggestions that come back. We send no name, email address, or other account detail with it, and your browser does not contact Mapbox.
• ElevenLabs: the AI receptionist on our phone line. It turns the caller's speech into text and answers by voice. We keep the transcript text, a summary, and the details the caller gives (such as a name, number, and callback request), not the audio. ElevenLabs keeps its own copy of the call under its retention settings.
• Telegram: alerts to our staff about the service. When a call needs follow-up, the alert carries the caller's name or number and the reason for the call.
• Twilio: text message delivery for one-time phone confirmation codes and optional HOA notifications. Twilio processes your mobile number only to deliver the message, and we do not share mobile numbers with third parties for their marketing. See the text messaging terms.

If a subprocessor changes we'll update this list and notify HOA primary contacts by email.

SpotHOA runs on Cloudflare's global edge network. Your HOA's data lives in Cloudflare D1, backed by primary storage in the United States (North American East region). Document and image uploads live in Cloudflare R2, configured with US jurisdiction.

Email delivery through Resend and error reports through Sentry are processed in the United States as well.

Retention matches what the product actually does — no secret backups that keep “deleted” data forever:

• Documents: soft-deleted for 30 days, then removed from R2. Before the 30 days elapse, an HOA admin can restore from the vault.
• Account deletion: requests enter a 14-day grace period. Sign in and cancel from the data and privacy page at any point in the window. After 14 days, personal fields are scrubbed and audit entries show “Deleted user”.
• Accounting records: dues charges, payments, and refunds may be retained in aggregate form to meet tax and accounting obligations, even after the HOA deletes itself.
• Directory claims: a claim, its proof reference, and the reviewer's note are kept for as long as the listing exists, because they are the audit trail for an access decision. Deleting your account redacts the free text on your claims and on their decision records; the fact that a claim was made and how it was decided remains.
• Directory suggestions: kept as the review record for the listing. Suggestion rows carry no submitter identity, so account deletion has nothing to match on: removal there runs through the request path above.
• Error logs: 30 days in Sentry, then discarded.
• Email delivery logs: 30 days in Resend, then discarded.
• Calls and emails to us: a call or email record is deleted once it is more than 180 days old and we have finished dealing with it.

You can exercise each of the rights below directly in-app:

• Access: download a copy of your personal data via the in-app export flow on the data and privacy page. We email you a signed link that expires after 7 days.
• Delete: request account deletion on the same page. 14-day grace period, reversible during the window.
• Correction: edit your profile (name, email, photo) from settings.
• Restrict: adjust notification preferences per-HOA so we only email you about the things you want.
• Portability: exports are provided as CSV (for tabular data) and JSON (for structured records), both machine-readable.
• Opt out of newsletters: every marketing email (we send very few) contains a one-click unsubscribe link tied to a per-recipient token.

If you can't exercise a right through the UI, email us at privacy@spothoa.com.

SpotHOA is not intended for anyone under 18 years old. We do not knowingly collect information from children. If you believe a child has created an account, email privacy@spothoa.com and we'll delete the account.

If you're a California resident, the California Consumer Privacy Act (CCPA) gives you specific rights:

• Right to know what personal information we collect, why, and who we share it with. The answers are in the sections above.
• Right to delete your personal information, exercised through the account deletion flow.
• Right to opt out of the sale of personal information. We do not sell personal information, so nothing to opt out of — but you have the right.
• Right to non-discrimination for exercising any of the above. We don't charge more or offer less to California residents who exercise a CCPA right.

We apply reasonable security controls to protect your data:

• TLS in transit everywhere.
• Authentication via Stytch, using passwordless email magic links so there is no password to phish or reuse.
• Row-level isolation in the database: every query is scoped to the HOA the caller belongs to, with automated tests that fail if isolation breaks.
• Audited access to the platform admin surface with role-based access gates.
• Cloudflare Turnstile CAPTCHA on public forms (feedback, signups) to resist automated abuse.

No system is perfectly secure. If you find a vulnerability, email privacy@spothoa.com and we'll respond within 5 business days.

We'll revise this page when practices change. For material changes we also email HOA primary contacts at least 14 days before the change takes effect. The “Last updated” date at the top reflects the most recent revision.

Privacy questions, data requests, and breach reports:

• Email: privacy@spothoa.com
• Mail: JR Generations LLC d/b/a SpotHOA, P.O. Box 140572, Dallas, TX 75214