HOA Charter Privacy Policy

Last updated: October 1, 2026

The short version

We wrote this in plain English on purpose. Most people reading it are volunteer HOA board members, and you should not need a law degree to find out what happens to your information.

• We do not sell personal information. Not to data brokers, not to anyone.

• We do not run ads and do not share your information with advertising networks.

• On our website, we collect what you hand us (name, email, phone, and a little about your association) plus basic analytics.

• In the portal, your association is in charge of the data. We hold and process it on their behalf under a signed contract. Homeowners with a question about their own record should start with their board.

• We use a small set of vendors to run the software. They are listed in Section 7 with what each one does.

• If there is ever a breach, we tell the affected association on the clock in its contract, so it can tell its owners. Section 11.

If the short version and the numbered sections seem to disagree, the numbered sections control, but tell us, because it means we wrote the summary badly.

1. Who we are

The McCarty Enterprises Group, LLC ("TMEG," "we," "us") is a Tennessee limited liability company at 145 Rhody Drive, Johnson City, TN 37615. HOA Charter is our software for self-managed homeowners associations. Reach us any time at info@themccartyenterprisesgroup.com.

2. What this policy covers, and what it does not

This policy is mainly about our public website. The portal your association uses is governed by your association's contract with us.

2(a). Website visitors and prospective clients. If you are browsing hoacharter.com, submitting the contact or demo form, calling our support line, or booking a discovery call, this policy governs. There, TMEG decides what to collect and why; we are the controller. Sections 3 through 12 apply to you directly.

2(b). Portal users: homeowners, board members, association staff. If your association uses the HOA Charter portal, the personal information inside it (owner names, emails, phone numbers, unit and lot records, dues ledgers, association documents, ballots and votes, requests and correspondence) belongs to and is controlled by your association. Your Client Services Agreement calls this Association data; the Data Processing Addendum calls it Personal Data; this policy calls it portal data. They are the same thing. Your association is the data controller. TMEG is the service provider / processor: we process that information only on your association's documented instructions, under the signed Client Services Agreement and its Data Processing Addendum ("DPA").

In practice:

• The Client Services Agreement and DPA govern portal data. This policy supplements them; it does not replace, expand, or narrow them. Where this policy and the DPA differ as to portal data, the DPA controls.

• We do not use portal data for our own purposes. No selling it, no mining it for marketing lists, no advertising to your homeowners.

• Requests about portal data go to your board first. That is not a brush-off; the association is the party with authority to act. See Section 10.

• Board members can request a copy of the current DPA at any time.

3. What we collect on the website

What you type into our forms, plus ordinary web analytics.

3.1. Information you give us. When you submit the contact form, request a demo, or book a call:

We do not ask for Social Security numbers, bank or card numbers, government ID numbers, health information, or anything else sensitive through website forms. Please do not send them.

3.2. Collected automatically. Standard web and analytics data: IP address, browser and device type, referring page, pages viewed, and approximate city/region-level location derived from IP. Used to understand which pages are useful and to keep the site running and secure.

3.3. Email correspondence. If you email us, we keep the correspondence. If you message us through one of our social media pages, we treat that message as business correspondence and keep it for 24 months from last contact.

3.4. Discovery calls. Notes we take go into our business records. We do not record discovery calls unless we tell you at the start of the call and you agree.

3.5. Support phone line. HOA Charter's support number is answered by Claire, an automated assistant, not a person. Claire answers general questions about HOA Charter and takes callback requests; a member of our team then calls you back.

• Calls are recorded. Call recordings and their transcripts are kept for 90 days, then deleted.

• Callback requests are stored: your name, the number to call you back on, your community's name, the time of the call, and the reason you called. Callback requests are kept for 24 months as business records.

• No account lookups on the line. Claire cannot look up, open, or change any portal account or record, and will not ask for account, payment, or other sensitive details. Please do not share them on the call.

Tennessee law permits a call to be recorded with the consent of one party to it. Because callers may be in states that require every party's consent, each call opens by telling you it is recorded; if you would rather not be recorded, you can hang up and reach us through the contact form or at info@themccartyenterprisesgroup.com instead.

4. How we use website information

To answer you, show you the product, run the business, and keep the site secure. That is the list.

We use website information to: (1) respond to your inquiry and schedule or conduct a demo or call; (2) send information you asked for, including pricing and onboarding details; (3) prepare and negotiate a Client Services Agreement if your association moves forward; (4) operate, secure, debug, and improve the website; (5) keep ordinary business, accounting, and legal records; and (6) comply with law and enforce our Website Terms of Service.

We do not: sell personal information; share it with advertising networks or data brokers; use it for cross-context behavioral advertising; use portal data to market to homeowners; or allow portal data to be used to train third-party AI models.

4.1. Marketing email. If you request information, we may email you about HOA Charter. Every marketing email carries an unsubscribe link, honored promptly. Transactional messages (a demo link, a calendar confirmation, a contract) are not marketing and are sent regardless.

5. Legal bases and privacy-law coverage

Some privacy laws only apply above certain size thresholds. We are honest here: at our current scale, most do not apply to us yet.

5.1. We process website information because you asked us to contact you, because it is necessary to take steps toward a contract with your association, and because we have a legitimate interest in operating and securing our website.

5.2. At our current size, TMEG is below the revenue and volume thresholds that trigger California's, Tennessee's, and the other states' comprehensive consumer privacy laws, and we do not offer services in the European Union or the United Kingdom. Whether or not any of those laws applies to us, we honor the rights described in Section 10 for everyone who contacts us. If we grow past a threshold, we will update this policy before it applies.

5.3. Regardless of which laws apply to us, we handle access, correction, and deletion requests as described in Section 10.

6. When we share information

With the vendors that run the software, with professional advisors, when the law requires it, and if the business is ever sold. Never with advertisers.

We share personal information only:

• With the subprocessors in Section 7, under contracts limiting them to processing on our instructions;

• With your association, if you are a homeowner and the information relates to its portal;

• With professional advisors (attorney, accountant, insurer) under confidentiality duties;

• When required by law: subpoena, court order, or valid legal process. Unless the law prohibits it, we notify the affected association before responding to a demand for its portal data so the association can object, and we disclose only what is legally required;

• In a business transfer: if TMEG is merged, acquired, or its assets sold, subject to this policy or a successor policy with equivalent protections.

7. Subprocessors and service providers

The outside companies that make HOA Charter run, and what each one touches.

7.1. About payments. Today, Stripe bills your association's subscription fee; it does not yet process resident dues or assessment payments. If and when dues collection launches, it will run on Stripe Connect: money flows from the homeowner to the association's own Stripe account, then to the association's own bank account. TMEG does not take custody of association funds. Card and bank details are handled by Stripe under its own agreements with the association; TMEG does not store full payment card numbers.

7.2. This list is current as of the publication date above. New subprocessors for portal data are added only with the advance-notice and objection process described in our Data Processing Addendum, Section 5.

8. Cookies and analytics

Cookies to make the site work and to count visits. No advertising cookies.

8.1. Strictly necessary cookies keep the site functioning: security, load balancing, session state.

8.2. Analytics. We use Google Analytics 4 (provided by Google LLC) to understand, in aggregate, which pages people read and how they found us. It uses cookies and collects the standard web data described in Section 3.2. We do not use Google's advertising features or share analytics data with ad networks. Google's own handling of this data is described in Google's privacy policy, and you can opt out of Google Analytics across all websites with Google's browser add-on at tools.google.com/dlpage/gaoptout.

8.3. No advertising or cross-site tracking cookies. No ad pixels, and no analytics data shared with ad networks.

8.4. Your controls. Most browsers let you block or delete cookies; blocking strictly necessary cookies may break parts of the site. Our site shows a cookie notice; analytics cookies are set only after you accept it.

8.5. Do Not Track and Global Privacy Control. There is no agreed standard for browser Do Not Track signals and we do not currently respond to them or to Global Privacy Control signals. If we become subject to a law that requires us to honor those signals, we will, and we will update this section.

9. How we protect information

An honest, high-level description, with no certification claims we have not earned.

9.1. We use our infrastructure providers' security capabilities, including encryption in transit (TLS) between your browser and our systems and encryption at rest for data in our hosted database and file storage.

9.2. Access to production systems and client data is limited to personnel who need it to operate and support the service, protected by authentication controls and reviewed periodically.

9.3. Audit logging is complete for administrative actions. All administrative mutation paths write to an append-only audit log recording who did what, to which record, and when. Owner-portal (non-administrative) actions are not separately audit-logged beyond standard application logs.

9.4. We make no certification claims. HOA Charter has not completed a SOC 2 examination and holds no ISO 27001 or comparable certification. If that changes, this section will be updated, and until it does, do not let anyone tell you otherwise on our behalf.

9.5. No system is perfectly secure. If something goes wrong, Section 11 governs.

10. Your choices and rights

Ask us and we will help. Homeowners with portal questions should start with their board.

10.1. Website visitors and prospects. Email info@themccartyenterprisesgroup.com to access what website information we hold, correct something wrong, delete your inquiry record, or unsubscribe from marketing. Opting out of a sale is not applicable; we do not sell personal information.

We will respond within 30 days. We may need to verify your identity first, usually by replying to the email address we have on file for you, and we may retain records required for legal or accounting purposes.

10.2. Portal users. Because your association controls portal data:

• Homeowners: contact your board or association administrator. They can view, correct, or remove your record directly in HOA Charter, and they know your association's retention rules and governing documents.

• If you contact us directly about portal data, we will forward the request to your association and tell you we have done so. We will not change association records on our own initiative.

• Board members and administrators: you can act on owner requests inside the portal, and can contact us for export, correction, or deletion assistance under the DPA.

10.3. Exercising these rights will never cause us to discriminate against you or your association.

11. Data breach notification

If portal data is affected, we tell the association on the clock in its contract, with what it needs to tell its owners.

11.1. If portal data is affected by a security incident, we notify the association as controller within the time committed in our Data Processing Addendum, with the information it needs to meet its own duties to its owners. The association decides whether and how to notify its owners, and we support that effort.

11.2. If website inquiry data is affected, we notify affected individuals as applicable law requires.

11.3. Owners of associations in other states may be covered by that state's breach law; we will support the association in meeting whichever obligations apply.

12. How long we keep information

13. Children

HOA Charter is a business tool for homeowners associations. Neither the website nor the portal is directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it. Owner and household records in the portal are entered by the association's board, belong to the association, and are governed by its own policies and Section 2(b).

14. Changes to this policy

We may update this policy. When we do, we will revise the "Last updated" date and post the new version at hoacharter.com. For material changes affecting portal clients, we will email association administrators at least 30 days before the change takes effect. Prior versions are available on request.

15. Contact us

The McCarty Enterprises Group, LLC, 145 Rhody Drive, Johnson City, TN 37615, info@themccartyenterprisesgroup.com

Privacy questions, Section 10 requests, and "I do not understand what this means" emails are all welcome. We would rather answer the question than have you guess.

Related: HOA Charter Website Terms of Service. Clients: your Client Services Agreement and Data Processing Addendum govern the portal and control over this policy as to portal data.