Wexford HOA
Back to Home

Privacy Policy

Effective: 2026-05-08

This Privacy Policy explains what information the Wexford Homeowners Association communication and governance platform (the “Platform”) collects, how that information is used, who has access to it, and the choices you have. This Policy is incorporated into the Platform’s Terms of Service.

1. What We Collect

The Platform collects the following categories of information:

  • Account information: the name, email address, and password you provide when creating an account.
  • Verification information: the lot number, street address, and any documentation you submit to confirm you are a Wexford homeowner.
  • Governance activity: votes you cast on Platform-hosted polls and amendments, comments you submit on decisions, and ACC requests you file.
  • Communications: emails the Platform sends to you (announcements, reminders, transactional notices) and any delivery-status information returned by the email provider.
  • Document uploads:any files you (as an operator) or the Board uploads to the Platform’s document library.
  • Technical data: the IP address, user-agent string, and request timing of your interactions with the Platform, captured by web infrastructure logs and used for security, rate-limiting, and fraud detection.

2. How We Use It

We use this information to:

  • verify your eligibility to participate in Association governance;
  • enforce one-vote-per-person rules and other governance integrity controls;
  • send you Association notices, reminders, and updates;
  • operate, monitor, and secure the Platform;
  • detect and respond to fraud, abuse, or violations of the Terms of Service or Community Guidelines;
  • comply with applicable law and the Association’s governing documents;
  • maintain records required by N.C. Gen. Stat. Chapter 47F (the Planned Community Act) and Chapter 55A (the Nonprofit Corporation Act).

3. Who Has Access

  • You. You can view your own account information, the votes you have cast, and your own ACC requests.
  • Other verified homeowners. Aggregate vote tallies, public announcements, and published meeting recaps are visible to other Users. Individual vote choices are not visible to other homeowners.
  • Board members and operators. Authorized Board members and Platform administrators can view governance data (including individual vote choices, comments, ACC submissions, and audit trails) for the purpose of administering the Association.
  • The Operator. The Operator (the Board-designated technology volunteer) may access any data on the Platform as necessary to operate, maintain, and secure the service.
  • Law enforcement and legal process. We may disclose information when required by law, court order, subpoena, or legitimate governmental request.

4. Third-Party Service Providers

The Platform relies on the following third-party service providers, each subject to its own privacy policy:

  • Google Cloud (Cloud Run + Firebase). Hosting, authentication, and data storage. Information is stored in the United States.
  • Resend. Email delivery for announcements, reminders, and transactional notices.
  • Google reCAPTCHA. Bot defense on response and submission endpoints.

These providers receive only the information necessary to perform their function. They are contractually prohibited from using your information for their own purposes.

5. Cookies and Sessions

The Platform uses a single first-party session cookie to keep you signed in after authentication. The cookie is marked HttpOnly, Secure, and SameSite=Lax. We do not use third-party tracking cookies, advertising cookies, or analytics cookies that identify you individually.

6. Data Security

We protect your information using the security controls provided by Firebase Authentication and Cloud Firestore, including encryption in transit (TLS) and encryption at rest. Administrative access to Platform data is restricted to authorized Board members and the Operator and is audited. Despite these measures, no online service can guarantee absolute security; you use the Platform at your own risk.

7. Breach Notification

If we become aware of a security incident affecting personal information of North Carolina residents, we will notify affected individuals without unreasonable delay and notify the Consumer Protection Division of the North Carolina Department of Justice as required by N.C. Gen. Stat. § 75-65. The notice will describe the nature of the incident, the categories of information affected, the steps we are taking, and the steps you can take to protect yourself.

8. Retention

The Platform retains information for the following periods:

  • Account records: while your account is active, plus thirty (30) days after deletion.
  • Governance records (votes, certifications, official meeting minutes, recorded amendments): indefinitely, consistent with Association records-retention obligations under N.C. Gen. Stat. Chapter 47F and Chapter 55A.
  • Operator audit log:indefinitely (the audit log is the Association’s administrative record). The Board may adopt a written retention schedule that archives older entries; this Policy will be updated to reflect any such schedule.
  • Web infrastructure logs:approximately thirty (30) days, subject to the underlying cloud provider’s log-retention defaults.

9. Your Rights

You may:

  • access and download a copy of your account information by contacting the Operator;
  • correct inaccurate account information at any time;
  • delete your account, subject to the Association’s obligation to retain governance records (votes you cast on binding decisions cannot be deleted from the official record even if your account is deleted);
  • withdraw your consent to receive electronic notices under N.C. Gen. Stat. § 47F-3-108 by notifying the Association in writing.

10. California Residents

Wexford is a North Carolina community, and the Platform is not directed to California residents. If you are a California resident and you believe the California Consumer Privacy Act applies to your data, contact us and we will respond to your request as required by applicable law.

11. Children

The Platform is not directed to and does not knowingly collect information from children under the age of thirteen. If you believe a child under thirteen has provided information to the Platform, contact the Operator and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The Effective date at the top of this page reflects the most recent revision. Material changes will be communicated to Users by email and by a re-acceptance prompt at next sign-in.

13. Contact

For questions about this Privacy Policy, to exercise the rights described in Section 9, or to report a suspected privacy incident, contact the Association through the contact information posted on the Platform.