Data Processing & Security Policy

For data your Organization uploads or enters (including resident and member data), your Organization is generally the data controller and Wealth Building Academy LLC acts as a data processor / service provider, processing such data only to provide the Service and on your documented instructions, except as required by law.

We maintain commercially reasonable administrative, technical, and organizational measures designed to protect data, which may include:

The Service is designed to keep each Organization’s data logically separated so that one community’s records are not exposed to another. Access within an Organization is governed by role-based permissions and document visibility settings (board-only, resident-visible, and private/admin-only) that your administrators configure and control. Board-only and private documents are designed not to appear in resident-facing answers when configured correctly.

To provide AI features, relevant document text and queries are sent to our AI provider, OpenAI, through the OpenAI API, for text extraction, search embeddings, summaries, categorization, and answers, and the results are returned to your Organization. Your original files are kept in our file storage; scanned images and scanned PDFs are also sent to OpenAI as files so their text can be read (OCR). Under OpenAI’s API data-usage policy, content sent through the API is not used to train OpenAI’s models and may be kept by OpenAI for up to 30 days for abuse monitoring before being deleted. AI answers follow the same role-based permissions as the rest of the Service.

We use the following sub-processors to deliver the Service:

We will update this list if our sub-processors change. We are responsible for our sub-processors’ performance of obligations we delegate to them, but are not responsible for their independent acts or omissions beyond those arrangements.

While your account is active, we keep your organization’s data so we can provide the Service. You can export your records at any time.

When your account closes — because you cancel and your paid period ends, or a free trial ends without a paid plan — your organization’s data stays available for export for 30 days. After those 30 days, we permanently delete it.

If you ask us to delete your data by emailing support@communityvault.ai, we permanently delete your organization’s data — documents, member records, and AI search indexes — within 30 days of confirming the request comes from an authorized administrator. Administrators can also delete all uploaded documents and their AI search index at any time using the “Delete all data” button in the app’s Migration Assistant.

Backups. The 30-day deletion timeline includes copies held in our database backups.

Records we must keep. We may keep limited records where the law requires it, such as billing and transaction records.

AI provider. Text sent to OpenAI to provide AI features may be kept by OpenAI for up to 30 days for abuse monitoring and is then deleted, under OpenAI’s API data-usage policy.

We maintain processes designed to detect, investigate, and respond to security incidents. In the event of a confirmed personal-data breach affecting your data, we will notify the affected Organization without undue delay, consistent with applicable law, and provide information reasonably available to help you meet your own notification obligations. You are responsible for notifying your residents, members, and regulators where you are the controller.

While we strive for high availability, we do not guarantee that the Service will be uninterrupted, timely, error-free, or available at any particular time. The Service may be unavailable due to maintenance, updates, or factors outside our control.

We implement reasonable security measures; however, no system, transmission, or storage method is completely secure, and we cannot and do not guarantee absolute security. You acknowledge that you provide and process data through the Service at your own risk and that we are not liable for unauthorized access, disclosure, or loss occurring despite our reasonable measures, or resulting from your configuration, credentials, users, or third-party providers.

We are not responsible for failures or delays, including security incidents, caused by events beyond our reasonable control, including natural disasters, war, terrorism, civil unrest, labor disputes, governmental action, utility or internet failures, cyberattacks, or failures of third-party providers.

You are responsible for: (a) configuring roles, permissions, and document visibility correctly; (b) safeguarding credentials and promptly removing access for departed users; (c) ensuring you have the right to upload and process the data you provide; (d) avoiding upload of unnecessary sensitive personal data; and (e) maintaining your own backups of critical records. The Service complements, and does not replace, your official system of record.

Security questions, vulnerability reports, and data processing requests may be sent to support@communityvault.ai.

Mailing address: Wealth Building Academy LLC, [CONFIRM: company mailing address]