Privacy Policy

This Policy applies to visitors, business contacts, prospective customers, customers, authorized users, requesters, residents, board members, vendors, and other individuals whose information is handled through AssociationOps360.

For public-site, sales, account, billing, security, and direct-support information, H4 Legacy Holdings, LLC generally determines the purpose and means of processing. For operational records submitted by a customer through the secured service, the customer generally determines the purpose and means of processing and AssociationOps360 processes that information for the customer. Individuals seeking access to customer-controlled operational records may need to contact the applicable association or management company.

Public website and inquiry information may include name, business email, company or association, role, message, requested assessment details, communications, and basic technical information needed to deliver and secure the site.

Account and commercial information may include organization name, property or portfolio, business address, authorized administrator, signatory authority, users, roles, plan, seats, billing contacts, transaction status, agreement acceptance, and support communications. Payment-card data should be handled by the configured payment processor and is not intended for storage in AssociationOps360 application records.

Customer-controlled operational data may include work orders, requests, locations, assets, preventive-maintenance schedules, inspections, projects, inventory, vendors, bids, documents, photographs, comments, approvals, signatures, status history, costs, and reporting information. These records may contain business contact information or personal information about residents, employees, contractors, board members, and vendors.

Technical and security information may include device and browser attributes, IP address, authentication events, access logs, feature activity, error and diagnostic records, upload and export events, and information used to protect accounts and property boundaries.

We receive information directly from individuals and customer administrators; from authorized users, requesters, residents, vendors, and integrations acting under customer direction; automatically from the website or service when necessary for operation and security; and from service providers that support authentication, hosting, storage, communications, billing, support, or security.

The public contact form is intended only for business inquiries. Do not submit passwords, payment-card information, resident records, secured-application content, or other sensitive operational information through that form.

We use personal information to provide, administer, secure, support, and improve the website and service; verify organizations and authorized users; prevent duplicate trials and account abuse; process subscriptions and agreement records; route inquiries; maintain property and role separation; deliver permitted communications; troubleshoot issues; create authorized reports and exports; comply with law; protect rights and safety; and establish, exercise, or defend legal claims.

AssociationOps360 does not use operational records to make autonomous maintenance, employment, credit, housing, insurance, or legal decisions. Optional translation may assist communication, but the original text remains the authoritative customer record unless the customer determines otherwise.

Where a legal basis is required, processing may rely on performance of a contract, steps requested before a contract, legitimate interests in providing and securing a business service, compliance with law, consent where required, or protection of vital interests in a genuine emergency.

When processing customer-controlled operational data, AssociationOps360 acts on the customer’s documented instructions as expressed in the agreement, order record, configured features, and authorized use of the service, except where law requires otherwise.

We may disclose information to the applicable customer and its authorized users; service providers supporting hosting, storage, authentication, communications, billing, support, analytics when enabled, security, and professional services; authorities or other parties when required by law or necessary to protect rights and safety; and an acquirer or successor in a merger, financing, reorganization, or sale subject to appropriate protections.

AssociationOps360 uses Amazon Web Services for private S3 object storage and recovery and for CloudWatch operational logging. Amazon Cognito provides the secured-service identity boundary in U.S. East. Amazon SES and SNS support transactional communications and operational notifications when those configured workflows are used. The Subprocessor List describes the services, purposes, data categories, and processing locations.

We do not sell personal information for money. We do not use customer operational records for cross-context behavioral advertising. If future website advertising or nonessential analytics changes these practices, the public policy and any required consent mechanism must be updated before activation.

The website and secured service may use strictly necessary cookies or similar storage for security, session management, preferences, and core operation. The public website uses Vercel Web Analytics for aggregate visitors and page views, public-page paths, referring domains, countries, and browser or device categories. This analytics service does not use persistent tracking cookies or cross-site advertising profiles.

Our analytics code removes URL query parameters and fragments and excludes sign-in and trial-intake pages. It does not send form fields or customer operational records. Collection is disabled for browsers with Global Privacy Control or an enabled Do Not Track signal. The current plan provides 30 days of aggregate history; Vercel discards its temporary analytics session identifier after 24 hours. The Cookie Policy describes these controls.

Inquiry, account, billing, acceptance, security, and support records are retained for the period reasonably necessary for the stated purposes, contractual and legal obligations, dispute resolution, fraud prevention, and enforcement.

Trial access becomes read-only after 30 days unless converted to paid service. Trial data is retained for up to 90 days after the trial ends and then becomes eligible for deletion, subject to legal holds, disputes, preservation duties, and other applicable restrictions.

After paid-service termination or expiration, eligible customer data may be retrieved for 30 days as described in the Customer Subscription Agreement. Backups and security records may persist for limited periods until overwritten or no longer required.

We use reasonable administrative, technical, and organizational safeguards appropriate to the service as actually deployed. Safeguards may include access controls, authentication, tenant and property separation, logging, encryption supported by configured infrastructure, backups, secure development practices, and service-provider review. No system can guarantee absolute security.

Customers are responsible for user authorization, credential protection, device security, exported copies, lawful collection, and promptly reporting suspected unauthorized access.

Depending on location and applicable law, an individual may have rights to request access, correction, deletion, restriction, portability, or information about processing, and to object to or withdraw consent for certain processing. Rights are subject to verification and legal exceptions.

For customer-controlled operational data, submit the request first to the relevant association, management company, or other customer. AssociationOps360 will assist the customer as required by the applicable agreement and law. Business communications may be stopped using the provided unsubscribe method or by contacting us.

The public website and commercial service are directed to organizations and authorized business users, not children. The service is not designed for children to create accounts independently. Customers must not use the service to collect children’s information without lawful authority and appropriate safeguards.

Do not submit Social Security numbers, full payment-card information, medical records, biometric identifiers, government identification numbers, or other highly sensitive information unless AssociationOps360 has expressly enabled an appropriate workflow and the customer has confirmed a lawful need and required safeguards.

The service is operated from the United States. Information may be processed in the United States and other locations where approved service providers operate. When required, cross-border transfers will use an appropriate legal mechanism described in the applicable Data Processing Addendum.

We may update this Policy to reflect service, legal, or operational changes. The effective date will be revised, and material changes will be communicated through an appropriate website, account, or direct notice. A change does not reduce customer rights under a signed agreement without the process required by that agreement or law.

Privacy questions and requests may be sent to support@associationops360.com. Formal service may be directed to H4 Legacy Holdings, LLC, 7901 4th Street North, Suite 300, St. Petersburg, Florida 33702. We may request information reasonably necessary to verify identity, authority, property, and account scope before responding.