Privacy Notice

Who we are

QuorumCast is operated by Open Concepts ("Open Concepts", "we", "us", "our"). This notice explains how we handle personal data in connection with the QuorumCast service (the "Service"). For the personal data we collect from users of the Service, Open Concepts acts as the data controller.

Personal data we collect

• Account data — name, email address, hashed password, HOA affiliation and role.
• HOA & resident data uploaded by admins — residence identifiers, unit numbers, resident names, dues-paid status, hashed 6-digit voting PINs.
• Voting data — a record that a residence cast a ballot, and (for non-secret ballots) the selection made. Secret ballots are stored without a link to the voter.
• Support communications — messages you send us and our replies.
• Usage & device data — IP address, browser and device identifiers, timestamps, pages viewed, and audit-log entries generated by admin actions.
• Cookies — session and security cookies required to keep you signed in.

Payment card details are collected directly by our payment processor (see below) and are not stored by us.

Why we use it, and our legal basis

• Provide the Service — create accounts, run elections, issue and verify PINs, produce results. Legal basis: performance of a contract.
• Security & fraud prevention — rate-limit PIN attempts, detect abuse, keep audit logs. Legal basis: legitimate interests and legal obligation.
• Billing & tax — process subscriptions through our Merchant of Record. Legal basis: performance of a contract and legal obligation.
• Support & communications — answer requests and send service messages. Legal basis: legitimate interests and performance of a contract.
• Product improvement — analyze aggregated usage to improve reliability and features. Legal basis: legitimate interests.

Ballot secrecy

For secret-ballot elections, candidate selections are stored without any link back to the residence or voter identity. A separate ballot receipt records only that a residence has voted, so we can enforce one vote per residence without revealing how the residence voted.

Who we share data with

We share personal data only with the following categories of recipients:

• Paddle — our online reseller and Merchant of Record for all purchases and subscriptions. Paddle collects and processes payment details, handles billing, tax compliance, invoicing, refunds and payment-related customer service. See Paddle's Privacy Notice.
• Cloud infrastructure & hosting providers — to host the Service, database, and backups.
• Email delivery providers — to send transactional and account emails.
• Professional advisers — legal, accounting, and auditors, where necessary.
• Authorities — where required by law, court order, or to protect our rights.
• Your HOA — data you upload as an admin is visible to other admins of the same HOA and, in the case of ballot receipts and tallies, is used to produce official HOA election records.

We do not sell or rent personal data, and we do not share it with third parties for their own marketing.

International transfers

Personal data may be processed in countries outside your own, including the United States and the European Economic Area, by our subprocessors. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

How we protect access

• Voting PINs are stored as one-way hashes, never in plain text.
• After 5 incorrect PIN attempts, voting on that residence is locked for 15 minutes.
• Admin actions are restricted to verified admin accounts and recorded in an audit log.
• Database access is governed by row-level security policies; open-election results are exposed only as aggregate tallies.
• Traffic between your browser and the Service is encrypted in transit (HTTPS/TLS).

Retention

We keep account data for as long as the account is active and for a reasonable period afterwards to meet legal, tax, and audit obligations. Ballot receipts and aggregate tallies are retained as part of the HOA's official election records. Voting PINs lose validity when reissued or when an election closes. Payment records are retained by Paddle in line with their own retention policy. When personal data is no longer needed, it is deleted or anonymized.

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data or update incomplete data.
• Request deletion, restriction, or objection to certain processing.
• Request portability of data you provided to us.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise these rights, contact us using the details below. For payment-related data, requests may need to be directed to Paddle.

Cookies

We use strictly-necessary cookies to keep you signed in and to protect the Service from abuse. We do not use advertising cookies. If we introduce analytics cookies in the future, we will update this notice and, where required, ask for your consent.

Contact

Open Concepts — privacy questions and rights requests: goquorumcast@gmail.com.