Privacy Policy

Covenant (operated by Neverstill LLC) provides SB 406 compliance document analysis at georgiahoacompliance.com. This policy explains what information we collect, how we use it, and the choices you have. Plain English, no tricks.

1. What we collect

• Account data: your name, email address, HOA name, and the role you identify yourself with (board member, officer, etc.).
• Governing documents you upload: we extract the text of any PDF you submit to produce your compliance analysis. We store that text against your order so we can regenerate or re-deliver the package if needed.
• Order and billing data: the amount, date, and status of each order. We never receive your card number — Stripe handles payment and returns us a session reference.
• Portal activity: session cookies for logged-in users, last-login timestamps, and IP addresses for security and rate limiting.
• Communications: emails you send us and any support context attached to a ticket.

2. How we use it

• To produce your compliance report and amended governing documents.
• To send transactional email (order confirmations, delivery, password setup, support replies).
• To operate your board portal if you use one.
• To improve the service — for example, detecting patterns in failed orders. We do not train AI models on your documents.
• To meet legal obligations (tax records, subpoenas served on us, etc.).

3. Who we share it with

We use a short list of sub-processors to run the service. Each is bound by its own privacy and security obligations:

• Anthropic — the AI provider that analyzes your documents. Document text is sent to Anthropic's API for processing. Anthropic's commercial terms prohibit training on API inputs by default.
• Stripe — payment processor. Handles card data; we only see their session reference and payment status.
• Resend — transactional email delivery.
• Railway — server hosting.
• Cloudflare — DNS, CDN, and DDoS protection.

We do not sell your personal information. We do not share your governing documents with anyone other than the sub-processors above, the email recipient you specified at checkout, and anyone you explicitly invite into your board portal.

4. How long we keep your data

• Order records and delivered documents: retained so you can re-download your compliance package at any time. Delete on request.
• Uploaded document text: retained for the lifetime of your order so we can honor the 30-day compliance guarantee. Delete on request after the guarantee period expires.
• Portal accounts: retained until you delete them or request deletion.
• Server logs: 30 days at most.

5. Your rights

Regardless of where you live, you can ask us to:

• Access a copy of the personal data we hold about you.
• Correct anything inaccurate.
• Delete your account, your uploaded documents, and any personal data we are not legally required to retain.
• Export your data in a portable format.

Email [email protected] and we will respond within 30 days.

6. Cookies and tracking

We use a small number of cookies that are strictly necessary: a session cookie to keep you logged in to the board portal, and a CSRF-style signed cookie to prevent forged requests. We use Google Analytics 4 (via gtag) on marketing pages for aggregate traffic stats; you can opt out using Google's opt-out add-on.

7. Security

All traffic is served over HTTPS. Passwords are stored salted-and-hashed with bcrypt, never in plain text. Portal sessions are HMAC-signed and marked HttpOnly + Secure + SameSite=Lax. Data is stored on hardened servers behind Cloudflare. No system is perfectly secure — if we discover a breach that affects you, we'll notify you without unreasonable delay.

8. Children

Covenant is intended for adults acting on behalf of an HOA. We do not knowingly collect personal information from children under 13.

9. Changes to this policy

If we make material changes we will post the new version here with a new effective date and, where appropriate, email customers who have an active order in the prior 12 months.

10. Contact

Questions about this policy or about any data we hold? Email [email protected]. Mailing address available on request.

Covenant is an operating brand of Neverstill LLC, a Delaware limited liability company.