Privacy Policy

Rezzly LLC (“Company,” “we,” “us,” or “our”) is committed to protecting the privacy of individuals who use our HOA covenant violation documentation and management platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, retain, and protect your information when you access or use the Service.

This Privacy Policy is incorporated into and forms part of our Terms of Service. By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Scope and Applicability

This Privacy Policy applies to all Users of the Service, including HOA board members, property management company representatives, residents who submit potential violations, and homeowners who access the Service to view or pay violation-related fines. It covers information collected through the Service’s web application, APIs, email communications, and any other interactions with the Company related to the Service.

This Privacy Policy does not apply to third-party websites or services that may be linked from or integrated with the Service. We encourage you to review the privacy policies of any third-party services you access.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Photo Metadata (EXIF Data)

If you do not want the location in a photograph’s metadata recorded, strip its metadata before uploading it or turn off location tagging in your camera. A photograph without GPS coordinates is accepted exactly as one with them, and no location is read from it.

A photograph taken with the Service’s own camera control is handled differently, because it usually reaches us with no location in its metadata. As you take it, the Service asks your browser or device for its position and, where available, its compass heading, and records them with the photograph if you have allowed it (see Section 11). If you do not want that recorded, decline the location permission your browser or device asks for, or upload an existing photograph instead; the photograph is accepted either way.

Only the visible content of the photograph and, where present, the coordinates, accuracy, and heading described in this section and in Section 11 are retained; see Section 8.1 for how long they are kept.

2.4 Information from Third Parties

We may receive information about you from third parties, including: identity verification services used to confirm account holder identity; payment processors providing transaction confirmations and fraud detection data; HOA board members or management companies who add you as a User; and publicly available property records used to verify property ownership or addresses.

3. How We Use Your Information

3.1 Providing and Operating the Service

• Creating and managing User accounts and organizational accounts
• Processing and displaying Governing Documents, violation reports, and related records
• Facilitating communication between HOA representatives, residents, and homeowners through the Service
• Processing subscription payments and violation fine payments
• Providing customer support

3.2 AI-Assisted Analysis

• Using uploaded Governing Documents, violation reports, photographs, and descriptions to provide AI-assisted categorization, flagging, and assessment of potential violations. AI-generated outputs are advisory recommendations only; a human staff member records the final determination on each case.
• Collecting User feedback on AI-generated outputs (such as approval/disapproval ratings and written comments) to evaluate and improve the quality and accuracy of the Service’s AI-assisted features, including refining how results are presented and identifying areas for improvement. This feedback is used for product quality assurance and is not used to train or fine-tune machine learning models.
• Periodically reviewing a small sample of Users’ conversations with the Service’s AI features (such as the case chat and the notice-letter drafting assistant) to evaluate the quality, accuracy, and safety of AI-generated responses and to improve the Service — for example, by refining the instructions we give to AI models and identifying features that need improvement. These reviews are performed by a limited number of authorized personnel who are bound by confidentiality obligations and access only what is needed for the review, consistent with the access controls described in Section 9. Conversations reviewed this way remain subject to the retention periods in Section 8 and, like the feedback described above, are not used to train or fine-tune machine learning models (see Section 3.3).

3.3 Voluntary AI Training Programs

From time to time, we may offer Users the opportunity to voluntarily participate in programs designed to improve our AI capabilities through model training. Participation in any such program is entirely optional and requires your explicit, informed consent before any of your data is used for training purposes. We will clearly describe what data would be used, how it would be processed, and how long it would be retained before requesting your consent. You may withdraw your consent at any time, and withdrawal will not affect your access to or use of the Service.

3.4 Service Improvement and Analytics

• Analyzing usage patterns to improve the Service’s features, performance, and user experience
• Conducting research and development on new features
• Generating aggregated, de-identified analytics and benchmarking reports

3.5 Security and Fraud Prevention

• Detecting, investigating, and preventing fraudulent, unauthorized, or illegal activity
• Monitoring for security threats and protecting the integrity of the Service
• Enforcing our Terms of Service

3.6 Legal Compliance and Communications

• Complying with applicable laws, regulations, and legal processes
• Sending transactional communications (account confirmations, billing notices, security alerts)
• Sending product updates and service announcements (you may opt out of non-essential communications)

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 Within Your Organization

Information you submit through the Service, including violation reports and associated photographs, is accessible to authorized Users within your HOA or management company account in accordance with role-based access controls. Board members and management company representatives can view all violation data for their community. Residents can view information related to their own submissions and, where the HOA permits, violation records pertaining to their property. Homeowners with payment accounts can view violation notices and payment records pertaining to their property.

4.2 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Cloud hosting and infrastructure providers
• Payment processors
• Analytics providers
• Email and communication service providers
• Customer support tools
• AI and machine learning infrastructure providers

These providers are contractually obligated to use your information only as necessary to provide services to us and are bound by confidentiality obligations.

4.3 Legal Requirements

We may disclose your information if we believe in good faith that disclosure is necessary to: comply with applicable law, regulation, or legal process (such as a subpoena, court order, or government request); protect the rights, property, or safety of the Company, our Users, or the public; detect, prevent, or address fraud, security, or technical issues; or enforce our Terms of Service.

4.4 Business Transfers

If the Company is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information for purposes not described in this Privacy Policy with your explicit consent.

4.6 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. This includes industry benchmarking data and aggregate violation trend reports.

5. Your Privacy Rights

Depending on your state of residence, you may have specific privacy rights under applicable law. We honor the following rights for all Users, regardless of location, to the extent technically feasible:

5.1 Right to Know and Access

You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it was collected, and the categories of third parties with whom it has been shared. You may access and download your personal data through your account settings or by contacting us.

5.2 Right to Correction

You have the right to request correction of inaccurate personal information we hold about you. You may update most account information directly through your account settings.

5.3 Right to Deletion

You have the right to request deletion of your personal information, subject to certain exceptions. We may retain information where necessary to: complete a transaction or provide the Service; comply with legal obligations; detect and prevent fraud or security incidents; exercise or defend legal claims; or fulfill the purposes described in this Privacy Policy where retention is reasonably necessary.

Please note that deletion of personal information within violation records may affect the integrity of your HOA’s enforcement documentation. We recommend consulting with your HOA before requesting deletion of violation-related data.

5.4 AI Training Consent

We do not use your data to train or fine-tune machine learning models unless you have explicitly opted in to a voluntary AI training program (see Section 3.3). If you have opted in, you may withdraw your consent at any time by contacting us at legal@rezzly.co or adjusting your preferences in your account settings. Withdrawal of consent will not affect your access to or use of the Service. Upon withdrawal, we will cease using your data for training purposes and will delete any training data derived from your content within thirty (30) days, except where such data has already been irreversibly incorporated into a trained model.

5.5 Right to Limit Use of Sensitive Personal Information

You have the right to direct us to limit our use and disclosure of your sensitive personal information to only what is necessary to provide the Service. The only category of sensitive personal information we collect is precise geolocation, in the three forms described in Section 11 — the position of the device used to file a violation report, the position recorded in an uploaded photograph’s metadata, and the position of the device when a photograph is taken in the Service — and we use it solely to document the violation record it is attached to. We do not collect biometric information or any other category of sensitive personal information as defined under applicable state privacy laws. To exercise this right, contact us at legal@rezzly.co.

5.6 Right to Data Portability

You have the right to request that we transmit your personal information to another entity in a structured, commonly used, machine-readable format, to the extent technically feasible. You may also export your data directly through the Service’s data export feature (see Section 8.2).

5.7 Right to Opt Out of Sale or Sharing

We do not sell personal information as defined under the California Consumer Privacy Act (CCPA) or similar state laws. To the extent that sharing personal information with analytics providers constitutes a “sale” or “sharing” under applicable law, you may opt out by adjusting your cookie preferences (see Section 7) or by contacting us.

5.8 Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights. We will not deny you the Service, charge you different prices, or provide a different level or quality of Service as a result of your exercise of privacy rights.

5.9 Authorized Agents

You may designate an authorized agent to submit privacy requests on your behalf. We may require the agent to provide written authorization and verify your identity before processing the request.

5.10 How to Exercise Your Rights

To exercise any of these rights, contact us at legal@rezzly.co or submit a request through your account settings. We will respond to verifiable requests within forty-five (45) days. If we need additional time, we will notify you of the extension and the reason for it. We may request additional information to verify your identity before fulfilling your request.

5.11 Appeals

If we decline your privacy request, you have the right to appeal our decision by contacting us at legal@rezzly.co with the subject line “Privacy Request Appeal.” We will respond to appeals within sixty (60) days. If your appeal is denied, we will provide information on how to contact your state attorney general’s office, if applicable.

5.12 Rights of Non-User Data Subjects

The Service may process personal information about individuals who are not registered Users, including homeowners, residents, and other individuals who are the subject of violation reports submitted by subscribing organizations. If you are not a registered User but believe the Service contains personal information about you (such as photographs of your property, your address, or your name in a violation record), you have the right to:

• Request confirmation of whether we hold personal information about you
• Request access to the specific personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of your personal information, subject to the exceptions described in Section 5.3

To exercise these rights, contact us at legal@rezzly.co with the subject line “Non-User Privacy Request” and include your name, property address, and a description of your request. We will coordinate with the subscribing organization as necessary to verify your identity and process your request. We will respond to verifiable requests within forty-five (45) days.

6. State-Specific Privacy Disclosures

6.1 California (CCPA / CPRA)

If you are a California resident, you have the rights described in Section 5, including the right to know, access, delete, and correct your personal information, the right to opt out of the sale or sharing of personal information, the right to limit use of sensitive personal information (Section 5.5), and the right to data portability (Section 5.6). In the preceding twelve (12) months, we have collected the categories of personal information described in Section 2. We do not sell personal information as defined by the CCPA. The only sensitive personal information we collect, as defined by the CCPA/CPRA, is precise geolocation, in the forms and for the purposes described in Section 11; you may limit its use as described in Section 5.5. California residents may submit requests as described in Section 5.10.

6.2 Virginia (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and the right to opt out of the processing of personal data for targeted advertising, sale, or profiling. To exercise these rights, contact us as described in Section 5.10.

6.3 Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Other States

Residents of Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have rights similar to those described above. We will comply with applicable state privacy laws and honor all verifiable consumer requests in accordance with those laws. We will update this section as additional state privacy laws take effect.

6.4 Illinois (BIPA)

We do not collect biometric identifiers or biometric information as defined under the Illinois Biometric Information Privacy Act (BIPA). Our AI analysis does not use facial recognition technology. Other than the GPS coordinates, positioning accuracy, and compass heading described in Section 2.3, photo metadata is removed at upload and not retained.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

7.2 Managing Cookies

You can manage your cookie preferences through the cookie settings banner displayed when you first visit the Service, or at any time by accessing “Cookie Preferences” in your account settings or in the footer of our website. You may also configure your browser to block or delete cookies, though this may affect the functionality of the Service.

7.3 Google Analytics and Google Ads

We use Google Analytics to collect and analyze usage data. Google Analytics uses cookies to collect information about your use of the Service, which is transmitted to and stored by Google. Google may use this data to contextualize and personalize ads within its own advertising network. You may opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-On. For more information on Google’s privacy practices, visit Google’s Privacy Policy.

Our public website also uses Google Ads conversion measurement. When you request a demo or contact us from one of our campaign landing pages, we report that request to Google Ads so we can measure our advertising’s effectiveness. The link you arrived on may carry campaign identifiers (such as “utm” parameters or a Google click identifier); we keep those with your contact request so we know which campaign it came from, retain them for as long as the request itself, and use them for no other purpose. If your browser sends a Global Privacy Control signal, nothing is reported to Google Ads (see Section 7.4).

7.4 Do Not Track and Global Privacy Control

Some browsers transmit “Do Not Track” (DNT) signals. There is no uniform standard for responding to DNT signals. Currently, the Service does not respond to DNT signals. However, you can manage tracking through your cookie preferences as described above.

The Service does recognize and honor Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we will treat it as a valid request to opt out of the sale or sharing of your personal information as required by the California Consumer Privacy Act and other applicable state privacy laws. On our public website the signal is also passed to Google’s tags as a denial of advertising and analytics storage, and no advertising conversion is reported.

8. Data Retention

8.1 Retention Periods

8.2 Data Export

During your Subscription, you may export your data at any time through the Service’s data export feature. For thirty (30) days following termination, we will make your data available for export upon your written request, unless prohibited by law or unless termination resulted from a material breach that remains uncured. Exported data will be provided in commonly used, machine-readable formats (such as CSV and JSON for structured data, and original file formats for uploaded documents and images).

The thirty (30) day window governs how long your data remains available for export after termination. It is separate from the retention periods in Section 8.1, which govern how long we retain data before deletion and which may be longer where enforcement records, legal holds, or financial recordkeeping require it.

8.3 Deletion After Retention Period

After the applicable retention period, we will securely delete or de-identify your personal information using industry-standard methods, except where retention is required by applicable law. Some information may persist in encrypted backups for a limited period; such backups are not actively used and are overwritten according to our standard backup rotation schedule.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent
• Role-based access controls limiting employee and contractor access to personal data on a need-to-know basis
• Regular security assessments and penetration testing
• Multi-factor authentication available for all User accounts
• Automated monitoring for unauthorized access attempts
• Incident response procedures for data breaches

While we take reasonable measures to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security and are not responsible for the actions of unauthorized third parties who breach our security measures despite our efforts.

10. Data Processing Roles

10.1 Company as Service Provider / Data Processor

When the Service processes personal data of residents, homeowners, or other individuals on behalf of a subscribing HOA or management company, the subscribing organization acts as the business (or data controller) and the Company acts as the service provider (or data processor). The subscribing organization determines the purposes and means of processing personal data and is responsible for ensuring that its use of the Service complies with applicable privacy laws, including providing any required notices to consumers and data subjects before submitting their personal information to the Service.

The Company will cooperate with subscribing organizations in fulfilling their obligations to data subjects, including by facilitating responses to access, correction, and deletion requests submitted by non-User data subjects (see Section 5.12). Where the Company receives a privacy request directly from a non-User data subject, we will notify the relevant subscribing organization and coordinate with them to process the request.

10.2 Company as Business / Data Controller

The Company acts as the business (or data controller) for information collected directly from Users for account management, billing, analytics, and Service improvement purposes.

10.3 Data Processing Agreement

Subscribing organizations that require a formal Data Processing Agreement (DPA) may request one by contacting us at legal@rezzly.co. Our standard DPA addresses sub-processor disclosures, data transfer safeguards, breach notification obligations, and audit rights.

11. Geolocation Data

We collect precise geolocation in three situations, each tied to a violation report and each optional:

• Reporting device location. When a User files a violation report, the Service asks the browser or device for its current position. If the User grants permission, that position and the accuracy the device reports for it are recorded on the report as the place it was filed from. If permission is declined or no position is available, the report is filed without one and nothing else changes.
• Photograph location. When a photograph is uploaded as evidence, the GPS coordinates in its embedded metadata, if any, are read and recorded with that photograph as the place its camera reports it was taken, along with the positioning accuracy and the compass heading the camera recorded for that fix, if it recorded them (see Section 2.3). A photograph without them is accepted and no location is read from it.
• Device location when a photograph is taken in the Service. When a User takes a photograph with the Service’s own camera control, rather than choosing an existing file, the Service asks the browser or device for its current position as the photograph is taken and, where the device has a compass and the User allows access to it, the direction the device is facing. If the User has granted location permission, that position, the accuracy the device reports for it, and the compass heading, if any, are recorded with that photograph when it is uploaded, as the place the device reports it was taken. We ask for this because a photograph taken this way usually reaches us with no location in its metadata. If location permission is declined or no position is available, the photograph is accepted and nothing is recorded for it; if only access to the compass is declined, the position is recorded without a heading. Nothing is recorded for a photograph that is never uploaded.

We use this information only to document and corroborate the violation record it belongs to. It is visible to the same people as the rest of that record (see Section 4.1), is retained for the same period (see Section 8.1), and is not used for advertising, profiling, or any purpose unrelated to that record. We do not collect continuous or background location data, and we do not record location at any time other than when a report is filed or a photograph is taken in the Service or uploaded.

Our analytics providers may infer an approximate location, such as a city or region, from your IP address, as described in Section 7.3. That inference is not precise geolocation, is not associated with violation records, and can be limited through your cookie preferences. We do not use location data for advertising or marketing profiling.

If we materially change how geolocation is collected or used, we will update this Privacy Policy and provide notice as described in Section 16 before the change takes effect.

12. Children’s Privacy

The Service is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If we learn that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as promptly as possible. If you believe that a child under 18 has provided us with personal information, please contact us at legal@rezzly.co.

Photographs uploaded as part of violation reports may incidentally capture images of minors. Users must not upload photographs that prominently depict identifiable children. By using the Service, subscribing organizations agree to establish and enforce internal policies that prohibit the upload of photographs in which identifiable minors are a primary subject. If we become aware that a photograph prominently depicting an identifiable minor has been uploaded, we reserve the right to remove or require removal of the photograph. If you believe a photograph containing an image of your child has been uploaded to the Service, please contact us at legal@rezzly.co and we will promptly investigate and take appropriate action, including removal of the photograph if warranted.

13. Data Breach Notification

In the event of a data breach that compromises personal information, we will: notify affected Users and subscribing organizations without unreasonable delay, and in any event within the timeframes required by applicable state breach notification laws (which range from thirty to sixty days depending on the state); provide a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken to address the breach; and cooperate with subscribing organizations in their own breach notification obligations to affected data subjects.

We maintain an incident response plan and conduct periodic tabletop exercises to ensure preparedness for security incidents.

14. International Data Transfers

The Service is operated from and data is stored in the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Service, you consent to the transfer of your information to the United States.

15. Third-Party Links and Integrations

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of third parties and encourage you to review their privacy policies before providing them with any personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on the Service and updating the “Last Updated” date. For material changes that substantively affect how we collect, use, or share your personal information, we will provide at least thirty (30) days’ advance notice via email to the address associated with your account. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

17. Contact Us

If you have questions or concerns about this Privacy Policy, your personal information, or our data practices, please contact us at:
Rezzly LLC — Attn: Privacy — Email: legal@rezzly.co

For privacy-specific requests (access, deletion, correction, opt-out), please email legal@rezzly.co with the subject line “Privacy Request” and include your name, account email, and a description of your request.