The short version: we use your information to run Heemah and nothing else. We don’t sell it, we don’t show ads, and we don’t use it to train AI models. The documents your board uploads are read on servers we operate and are never sent to an outside AI provider.
1. Who this covers
Heemah is operated by VLO Labs, Inc. (“VLO Labs,” “we,” “us”). This policy covers the website at heemah.com and the Heemah app at app.heemah.com.
Heemah is a workspace for a homeowners association’s board of directors. The records a board keeps in Heemah belong to the association: the association decides what goes in, who can see it and when it is deleted, and we handle those records on its behalf. For everything else in this policy (your account, billing, the website) we decide how information is used.
2. What we collect
When you contact us through heemah.com
The form asks for your name, email address, association, state, number of directors, whether you want a free trial or a demo, and anything else you choose to tell us. We also record when you sent it and the country your request came from.
When you have an account
- Your name, email address and password. Passwords are stored only as a secure hash.
- Your board position and term dates, as entered on the association’s board roster.
- When you sign in and what you change, so the board has a record of who did what.
The board’s records
Meetings, attendance, motions and votes, minutes, documents, contacts, tasks, compliance dates and conversations with the assistant. These can include personal information about other people (homeowners, vendors, management staff) when the board records it. The association is responsible for what it chooses to keep.
Billing
The association’s billing name, email and address, its plan and subscription status. Card details go directly to Stripe, our payment processor; we see and store only the card brand and its last four digits.
Technical information
Our servers log IP addresses, browser type, the pages requested and errors, to keep Heemah secure and working. The app uses only the cookies it needs to keep you signed in and to protect forms. We use no advertising, analytics or tracking cookies, on the website or in the app.
3. How we use it
- To provide Heemah: store the board’s records, run its features and keep each association separate.
- To send email the board asks for, such as an agenda or approved minutes sent to directors.
- To send service email: sign-in, security, trial reminders, receipts and billing notices.
- To answer your questions and requests, including the ones sent through heemah.com.
- To keep Heemah secure, prevent abuse, and fix problems.
- To meet legal obligations, such as tax and accounting records.
We do not sell personal information, share it for advertising, or use it to train AI models.
4. AI in Heemah
- Minutes are not written by AI. A first draft is assembled from what the board recorded: attendance, motions and votes.
- Uploaded documents stay with us. Reading a document’s text, sorting it and making it searchable all happen on servers we operate. Document text is never sent to an outside AI provider.
- The assistant uses Anthropic. When a director uses the assistant, their messages, and the records the assistant looks up to answer (such as meetings, motions and tasks), are sent to Anthropic, which provides the AI model. Anthropic processes it under commercial terms that do not allow it to train its models on that data. The assistant only proposes changes; nothing is saved until a director confirms it.
5. Who else sees it
Within an association, the directors the board seats can see its records. Outside it, we use these service providers:
- Amazon Web Services: servers, database and file storage, in the United States.
- Cloudflare: the network that carries traffic to Heemah, and hosting for heemah.com and its form.
- Stripe: payments and billing.
- Anthropic: the assistant’s AI model, as described above.
- Twilio SendGrid: email delivery, for the app’s email and the email that tells us someone used the heemah.com form.
- Google Fonts: heemah.com loads its typefaces from Google, so your browser contacts Google, which receives your IP address.
Each provider may use the information only to provide its service to us. We may also disclose information when the law requires it, to protect someone’s safety or our rights, or to a successor if VLO Labs or Heemah is sold or merged, in which case this policy continues to apply.
6. How long we keep it
- Board records are kept for as long as the association has an account. If a trial ends or the association cancels, we keep them so the board can still export everything or pick up where it left off.
- When an association asks us to delete its account, we delete its records within 30 days.
- Backups: copies of the database are kept for up to one year, and earlier versions of uploaded files for 90 days. Deleted information disappears from them as they expire.
- Server logs are kept for 30 days.
- Requests sent through heemah.com are kept while we follow up, and for no more than two years.
- Billing records are kept as long as tax and accounting law requires.
7. Your choices and rights
You can ask us for a copy of your personal information, to correct it, or to delete it, by emailing [email protected]. Any director can export all of the association’s records at any time from inside Heemah.
Because the board’s records belong to the association, a request about something in those records (for example, a homeowner asking about minutes that mention them) is the association’s to decide; we will pass it on and help the board respond.
California residents have the right to know what personal information we collect and how it is used, to delete or correct it, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising.
8. Security
Heemah is served only over encrypted connections, and its database, file storage and server disks are encrypted at rest. Each association’s records are kept separate from every other association’s. A director’s access is tied to their seat: when their term ends, they can no longer sign in. No system is perfectly secure, and if a breach affects your information, we will tell you as the law requires.
9. Children
Heemah is built for HOA boards and is not directed at children. We do not knowingly collect personal information from anyone under 16.
10. Changes
If we change this policy, we will update the date at the top. If a change is significant, we will tell account holders by email before it takes effect.
11. Contact
Questions or requests: [email protected], or write to VLO Labs, Inc., Los Angeles, California, United States.