Privacy Policy

When an association uses HOAlyst to manage its community, the association decides what resident information is collected and why. We process that information on the association’s behalf.

For accounts, billing and the operation of the service itself, Digital Summit LLC decides how information is used and is responsible for it.

If you are a resident with a question about why your association holds something, ask the association. If it concerns how HOAlyst itself works, write to hello@hoalyst.com.

Account information. Name, email address, phone number where given, password (stored only as a hash), and two-factor authentication settings.

Association records. Properties and unit identifiers, ownership, board roles and committee seats, assessments and ledger entries, violations and their notices, architectural requests, work orders, documents, meetings and votes.

Payment information. Payment history, amounts, dates and the last four digits and type of a payment method. Full bank and card numbers are held by our payment processor and never reach our systems.

Usage and security data. Sign-in times, IP address, device and browser information, and an append-only audit record of financial, enforcement, permission and document actions.

• To run the service an association has asked us to provide
• To keep a durable record of decisions — a fine, a vote, a permission change — so an association can show what happened and when
• To take payments and pay associations out
• To send notices, receipts, invitations and reminders
• To secure accounts, detect abuse and rate-limit sign-in attempts
• To meet legal and tax obligations

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Within an association, information is visible according to the permissions its board sets. Resident email addresses are hidden from other residents by default. A management organization can be authorised by a board to act for it, and can never be given authority over where the association’s money goes.

Outside the association, we use these providers:

We also disclose information where the law requires it, or to establish or defend a legal claim.

When someone asks HOAlyst a question about an association’s documents, the relevant passages are sent to our AI provider to compose an answer with citations. That text is not used to train their models.

Answers are drawn only from the association’s own documents. AI does not decide anything: it cannot set a governing value, issue a notice, assess a fine, decide an appeal or move money.

Association records are kept while the subscription is active and for ninety days afterwards, so they can be exported or the account reinstated.

Some records are kept longer because they evidence a decision: audit entries, ledger entries, and documents cited by a notice. A document is soft-deleted rather than destroyed so that a violation relying on it stays provable. Financial records are retained as long as tax and accounting rules require.

• Data is encrypted in transit and at rest
• Passwords are stored only as salted hashes
• Two-factor authentication is required for board and treasurer accounts
• Sessions are held server-side and can be revoked individually
• Uploads are content-validated and served through URLs that expire in minutes
• Every query is scoped to one association from the session, never from client input

No system is perfectly secure. If a breach affects your information we will notify you and the relevant authorities as the law requires.

Depending on where you live, you may have the right to access, correct, delete, port or restrict the use of your personal information, and to withdraw consent. Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws have these rights, including the right not to be discriminated against for using them.

To exercise a right, write to hello@hoalyst.com. We will respond within the period the applicable law allows.

You can delete your account yourself at any time, from the HOAlyst app or at hoalyst.com/account/delete. That removes your personal details and sign-in methods straight away; the records described below stay with your association.

Where the request concerns records your association controls — your ledger, a violation against your property — we will pass it to the association and help them respond. Some records cannot be deleted on request because the association needs them to evidence a decision, or because the law requires them to be kept.

You can mute categories of notification from your account. Some messages cannot be muted because they are financially or legally material to you: a violation notice, a notice of hearing, a payment receipt, or a payment that failed or was returned. You will always receive those.

HOAlyst is for adults conducting association business and is not directed at children under 13. We do not knowingly collect their information; if we learn we have, we will delete it.

We will post any update here and change the effective date. For a material change we will notify account administrators by email at least thirty days beforehand.

See also our Terms of Service and Payments & Fees.