eCommuny Privacy Policy

Version 2026-09-29 · Effective September 29, 2026

This Privacy Policy explains how eCommuny LLC, a Texas limited liability company ("eCommuny," "we," "us"), collects, uses, shares, and protects personal information through ecommuny.com, its subdomains, public association websites we host, and our applications and services (the "Service"). It is part of our Terms of Use. Capitalized terms not defined here have the meanings in the Terms of Use.

1. Two roles: your association's records, and our own

On behalf of associations. Homeowner, condominium, and property owners associations ("Associations") and their management companies use the Service to run their communities. Most personal information in the Service, including member, household, property, account, violation, architectural-review, election, and document records, is entered or collected for your Association and under its instructions. For that information your Association decides what is collected and how it is used, and we act as its service provider (sometimes called a "processor"). If you have questions about your Association's records or want to see, correct, or delete them, please contact your Association; we will help it respond. You may also contact us, and we will forward your request.

For our own purposes. We decide how to use a smaller set of information on our own account: information about visitors to our marketing website, people who contact us or request support, board members and managers who sign up an Association or management company, subscription billing for Associations, and the security and operation of the Service. This Policy applies to both roles, and tells you which is which where it matters.

2. Information we collect

Category	Examples	Source
Identifiers and contact details	Name, email address, phone number, mailing and property addresses, account number, sign-in identifier	You, your Association or management company
Household and property information	Owners, co-owners, spouses or partners, tenants, company contacts, and dependents in the household; unit or lot; purchase and move-in dates; emergency contacts; member photos you choose to upload	You, your Association
Account and payment records	Invoices, charges, credits, ledgers, payment plans, delinquency status, payment method type, card brand and last four digits, bank name, Stripe reference identifiers, reference numbers your Association uses to match bank payments to accounts, receipts	Your Association, Stripe
Community records	Violations (including descriptions, photos, and the location of the reported condition), hearings and appeals, architectural applications and reviews, service requests, amenity reservations, event RSVPs, committee memberships	You, your Association
Elections and signatures	Eligibility, ballots, proxy assignments, typed-name signatures and attestations, and a tamper-evident audit record that includes the IP address and browser of the person voting or signing	You, your Association
Documents and content	Files, images, messages, comments, directory profiles (only if you opt in), and anything else you or your Association upload	You, your Association
Communications information	Email and notification preferences, messages sent to you and whether they were delivered or opened, unsubscribe and bounce records, text-message consent (including the exact wording you agreed to, when, and from which IP address), and mailed-letter records	You, your Association, our email and mail vendors
Agreement records	Your acceptance of our Terms of Use and this Policy: the version accepted, the wording shown, the date and time, and the IP address and browser used	You
Support and contact	What you tell us when you ask for help, including the page you were on	You
Device and usage information	IP address, browser and device type, pages and actions, dates and times, security and error logs	Automatically, when you use the Service
Association and management-company account information	Organization name, address, contact details, subscription and billing information, and information Stripe needs to set up the Association's payment account	Board members and managers, Stripe

What we do not ask for. We do not ask for, and our forms have no fields for, full payment card numbers, full bank-account numbers, Social Security numbers, government ID numbers, or biometric identifiers, and we do not perform facial recognition on photos. When an Association sets up its payment account, Stripe collects the identity and bank information it requires directly, under its own privacy policy. We do not collect precise location from your device. Files and spreadsheets that you or your Association upload (for example, a roster import or a document) contain whatever the uploader puts in them; your Association is responsible for uploading only what it needs, and we treat uploaded files as Association records.

Minors. The Service is not directed to children, and only adults may hold an account. Your Association or an adult in your household may list dependents who live in the household, which can include a minor's name and, if entered, contact information. That information is used only for Association purposes, is not shown in the community directory unless an adult chooses to include it, and can be reviewed or removed by the adult or the Association. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided information to us directly, contact support@ecommuny.com and we will delete it.

3. How we use information

We use personal information to:

provide the Service to you and your Association: show your account, calculate and present balances and statements, process payments through Stripe, deliver notices and messages, run elections and signatures, host documents and websites, and carry out other features your Association uses;
communicate with you about your account, security, the Service, and, for Association administrators, subscription and product information (you can opt out of promotional messages);
secure the Service: authenticate users, keep each Association's information separate, detect and prevent fraud, abuse, and security incidents, and keep audit records;
support and improve the Service: respond to requests, fix problems, and understand how features are used, using aggregated or de-identified information where we can (we do not try to re-identify de-identified information);
comply with law and enforce our agreements, including responding to lawful requests and protecting rights and safety.

We process Association records only to provide the Service to that Association, as it instructs, and as the law requires. We do not sell personal information, do not "share" it for cross-context behavioral advertising, and do not use it for targeted advertising. We do not use personal information to make decisions that produce legal or similarly significant effects about you; decisions about your account are made by your Association.

We disclose personal information only as follows:

With your Association and its administrators, according to the roles and permissions your Association sets. Board members, managers, and committee members of your Association can see records relevant to their role.
With a management company your Association has engaged, which acts for your Association and sees the records it needs to manage your community.
With other members, only where you or your Association choose: for example, a community-directory listing you opt into, or content your Association posts for members.
With the public, only where your Association publishes it on its public website. Anything published there can be seen, indexed by search engines, and copied by anyone; your Association decides what to publish.
With service providers that process information for us under contracts requiring them to protect it and use it only to provide their services:

Provider	Purpose
Microsoft (Azure, Microsoft Entra External ID)	Hosting, databases, file storage, caching, logs, and sign-in. Microsoft holds your sign-in credentials and any phone number or email you use for multi-factor authentication, under the Microsoft Privacy Statement
Stripe	Payment processing and, for Associations, payment-account setup and subscription billing and tax
Twilio SendGrid (or Microsoft Azure Communication Services as a backup)	Sending email
Click2Mail	Printing and mailing letters your Association sends
United States Postal Service	Verifying mailing addresses
A text-message provider (when the feature is enabled)	Sending text messages you opt into

With Stripe as an independent company. When you pay, Stripe processes your payment information under the Stripe Privacy Policy.
With our professional advisers, such as lawyers, accountants, auditors, and insurers, who are bound to keep it confidential.
For legal reasons: to comply with law, subpoenas, or court orders; to protect the rights, property, or safety of eCommuny, our users, or others; and to enforce our agreements.
In a business transfer, such as a merger or sale of assets, subject to this Policy.

Text-message information. Mobile numbers and text-message opt-in information are never shared with or sold to third parties for their marketing purposes.

5. Cookies and similar technologies

We use only what the Service needs to work and stay secure:

Sign-in and session cookies that keep you signed in. The cookie holds only a random identifier; the session itself is stored securely on our servers and ends when you sign out or it expires.
Security cookies that protect forms from cross-site request forgery.
Preference storage in your browser that remembers your light or dark display theme.
Stripe.js, which Stripe loads to process payments securely and to help prevent fraud, and which may set Stripe cookies.
Content from other providers: fonts are loaded from Google Fonts, some marketing images from Unsplash, and some help videos may be embedded from YouTube. When your browser loads them, those providers receive your IP address and browser information under their own privacy policies.

We do not use advertising cookies or third-party analytics trackers, and we do not allow third parties to track you across other websites through the Service. The Service and Association websites may link to other websites; their privacy practices are their own, and this Policy does not cover them. Do Not Track and Global Privacy Control: because we do not sell or share personal information or track you across sites, there is nothing for these signals to turn off; we treat a Global Privacy Control signal as a request to opt out of sale and sharing.

6. Your choices

Email. Optional emails (such as announcements) contain an unsubscribe link, and you can manage notification preferences in your profile. Some messages from your Association, such as invoices, statements, and notices it is required to send, cannot be turned off while you remain a member. Security and account messages from us also cannot be turned off.
Text messages. Text messages are sent only if you opt in. Reply STOP to stop, or HELP for help, or change the setting in your profile.
Directory. You decide whether to appear in your community directory and which details to show.
Your data. You can download a copy of your personal data from your profile ("Download my data").

7. Your privacy rights

Depending on where you live, you may have the right to: know what personal information we have about you and how we use it; access or receive a portable copy of it; correct it; delete it; opt out of the sale or sharing of personal information or of targeted advertising and certain profiling (we do none of these); limit the use of sensitive personal information (we use it only to provide the Service); and not be discriminated against for exercising these rights. Residents of California, Texas, and other states with privacy laws have these rights as their laws provide.

How to make a request. For your Association's records, contact your Association; we will help it respond. For information we hold on our own account, or if you are unsure, email support@ecommuny.com with the subject "Privacy request." We will verify your identity using information already associated with your account and respond within 45 days; if we need more time (up to another 45 days) we will tell you why. You may use an authorized agent, who must provide proof of your authorization. Some information must be kept even after a deletion request, for example payment and ledger records your Association is required to keep, election audit records, or information we need for security or legal reasons; we will tell you if that applies.

Appeals. If we decline your request, you may appeal by replying to our decision with the subject "Privacy appeal." We will respond within 60 days. If you are a Texas resident and we deny your appeal, you may contact the Texas Attorney General.

California "Shine the Light." We do not disclose personal information to third parties for their own direct-marketing purposes.

8. How long we keep information

We keep personal information for as long as needed for the purposes in this Policy, including as long as your Association needs it to keep its records:

Association records (membership, property, ledger, payment, violation, architectural, election, and document records) are kept while the Association uses the Service. Associations are often required by law or their governing documents to keep certain records for years (for example, financial and election records), and they decide how long to keep them.
When an Association leaves the Service, it can export its data during a grace period (30 days by default, and up to 90). After the grace period its records are deleted from the live Service. An archive of the Association's records is kept securely for up to seven years so that it can be restored or produced where the law requires, and is then deleted.
Backups. Our database is backed up automatically. Recent backups allow recovery for 35 days; long-term backups are kept on a schedule of up to 12 weeks, 12 months, and seven years. Deleted information remains in backups until they expire, and backups are used only for recovery.
Deleted files are recoverable for 30 days and earlier file versions for up to 90 days, then removed.
Audit records of account, payment, election, and administrative actions (which include the IP address and browser used) are part of your Association's records and are kept with them, because they are the evidence of what was done and by whom.
Technical logs and telemetry are kept for a limited period, typically 30 to 90 days.
Consent, unsubscribe, and suppression records are kept as long as needed to honor your choices and demonstrate consent.

9. How we protect information

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, sign-in through Microsoft Entra with multi-factor authentication available, role-based access controls, separation of each Association's information, server-side session storage, rate limiting, audit logging, and removal of sign-in codes and tokens from our logs. No system is perfectly secure, and we cannot guarantee absolute security. Please protect your sign-in credentials.

If there is a breach. If we confirm a security breach affecting personal information, we will notify affected Associations promptly, and notify affected individuals and regulators as the law requires.

10. Where information is processed

The Service is operated from, and information is stored in, the United States. Our service providers may process limited information in other countries when they support or operate their systems, under their own commitments to us. The Service is intended for communities in the United States.

11. Changes to this Policy

We may update this Policy. We will post the updated Policy with a new effective date and, for material changes, notify you by email or in the Service before the change takes effect.

12. Accessibility

This Policy is available in an accessible format on request. Contact support@ecommuny.com if you need it in another format.

13. Contact us

eCommuny LLC · Email: support@ecommuny.com (subject "Privacy request" for privacy requests).