Privacy Policy

1Scope of this policy

This Privacy Policy explains how BoardMatch, a product of NeighborLink Inc., handles information collected through the BoardMatch website and portals (the “Service”). It applies to Board members and association representatives, management company personnel, and site visitors.

It does not apply to: information a management company collects directly from you outside the Service; information handled by any third-party site we link to; or information an association collects from its own members. Those are governed by their own policies.

2The short version

• Bidding companies see your community’s scope under an anonymized label — unit count, type, market, budget band, required services, priorities. Not your name, not your phone number, not your email, not the association’s name.
• Your contact information moves only when your Board affirmatively releases it. There is no default release, no automatic release, and no release triggered by inactivity.
• We do not sell, rent, license, or trade personal information, and we do not share it for cross-context behavioral advertising.
• We publish market statistics only in aggregated, de-identified form, with small cells suppressed.
• You can access, correct, delete, or export your information, and opt out of marketing, at any time.

3Information we collect

From Boards and Board members. Name, role on the Board, work or personal email address, and phone number where you provide it. Association name, address, city, state, ZIP, unit count, property type, age, amenities, on-site staffing, annual operating budget band, current management arrangement and fee, meeting cadence, committee structure, the issues you have with current management, the issues you want a new manager to focus on, your ranked priorities, site-visit preferences, timeline, questions you submit, votes and comments inside your Bid, ranked reasons for declining a proposal, and ranked reasons for selecting a company.

From management companies. Contact name, work email, phone, title; legal entity name, year founded, states of operation, service areas and markets; doors and associations under management, community manager headcount, average portfolio load, manager turnover; licenses, designations, professional memberships, insurance and fidelity bond limits; management platform and technology; service packages, base pricing, complete ancillary and a la carte fee schedules; scope declarations, staffing plans, service-level commitments, financial delivery timing and method; answers to the Q&A library; booking links, website, and linked public review pages; billing contact and payment authorization details.

Account and security information. Email address, hashed password, role, organization, session and login records, password reset records, invitation and acceptance records, and audit-log entries of significant actions.

Automatically collected. IP address, browser and device type, operating system, referring page, pages viewed, timestamps, approximate location derived from IP, and — only if you use the “use my location” feature in the intake — the precise location your browser reports, which we use once to suggest your city and do not store as a location record.

Payment information. Where a management company authorizes ACH or card payment of placement fees, that information is collected and stored by our payment processor. We receive a token and limited descriptive detail such as the last four digits and account type. We do not store full bank or card numbers.

What we do not collect. We do not ask for and do not want Social Security numbers, government identification numbers, driver’s license numbers, precise financial account credentials, health information, biometric data, or information about anyone under 18. Do not submit these through the Service.

4Where information comes from

• Directly from you — intake, profile, proposal, messages, forms.
• From your Board colleagues — a Board member who invites you to review proposals provides your name and email.
• From your company — an administrator at a management company who invites you as a user.
• From BoardMatch administrators — where we invite a management company to join based on publicly available business information.
• Automatically — from your device and browser as described above.
• From public and licensed sources — state licensing registries, business registries, public review pages you link, and geographic reference data, used to verify credentials and populate service-area options.
• From service providers — our payment processor, email delivery provider, and identity providers where you use single sign-on.

5How we use information

• To operate the Service: run intakes, match Bids to qualified companies serving that market, collect and normalize proposals, produce the BoardMatch Report, run Q&A, votes, and selections.
• To verify management company licensing, insurance, credentials, and service areas.
• To send transactional messages: invitations, status updates, report delivery, questions and answers, vote reminders, invoices, security notices.
• To calculate, invoice, and collect placement fees, and to detect and address circumvention.
• To provide support and respond to inquiries submitted through the contact form.
• To secure the Service: authentication, fraud prevention, abuse detection, audit logging, and enforcement of our Terms.
• To improve the Service and develop new features, including analysis of which comparison structures and questions actually help Boards decide.
• To produce de-identified, aggregated market research and benchmarks as described in Section 9.
• To send marketing communications where permitted, from which you can unsubscribe at any time.
• To comply with law and to establish, exercise, or defend legal claims.

We do not use your information to build advertising profiles, and we do not run behavioral advertising.

6When contact information is disclosed

This is the section Boards care about, so it is stated exactly.

By default, bidders see: unit count, property type, city and market, budget band, current fee band, required and optional services, meeting cadence, committee structure, stated priorities and issues, site-visit preferences, and timeline — all under an anonymized label such as “A 240-unit condominium association in the Tampa market.”

By default, bidders do not see: your name, your role, your email address, your phone number, the association’s legal name, or the association’s street address.

Contact information is released only when your Board takes one of these actions:

• requests a meeting or call with a specific company — releasing to that company only;
• switches the Bid to open disclosure in Board settings — releasing to invited bidders;
• publishes the association address for self-guided site inspection — releasing the address only, and only to invited bidders;
• confirms a selection — releasing contact details both ways so the parties can execute an agreement.

You control the underlying preferences — share phone, share email, share address — in your Board profile settings, and can change them at any time. Changing a setting does not retract information already released, which is why the default is off.

7Who we share information with

With invited management companies — the anonymized scope described above, and contact details only on Board release.

With your Board colleagues — members you invite to a Bid see the Bid, the proposals, the Report, and each other’s votes and comments.

With colleagues at your management company — users on your company account see your company’s invitations, proposals, answers, results, and billing.

With service providers who process information on our behalf under contract and only on our instructions: cloud hosting and database, email delivery, payment processing, support ticketing, error monitoring, and analytics. They may not use it for their own purposes.

With NeighborLink Inc., our parent, as operator of the Service, and for the de-identified aggregated research described in Section 9. Where NeighborLink submits its own proposal to a Bid, it receives exactly the same anonymized scope as every other bidder and no more.

For legal reasons — where required by law, subpoena, or legal process; to enforce our Terms; to investigate fraud, circumvention, or abuse; or to protect the rights, safety, or property of any person.

In a business transaction — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply or to notice being given.

With your direction — anywhere else you tell us to send it.

8We do not sell or share personal information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended and under comparable state laws. We have not done so in the preceding twelve months.

We do not operate a lead-buying customer base, we do not charge management companies per lead or per contact, and there is no arrangement under which any third party pays for access to Board information.

You may still submit a do-not-sell-or-share request as a matter of record, and we will honor it and confirm.

9De-identified and aggregated data

Running this marketplace produces genuinely useful information about how community association management is priced and chosen: per-unit-per-month rates by market and size band, cost per door by property type, budget ratios, package composition, staffing ratios, request volume by state and city, and the reasons Boards give for declining and selecting.

We compile, analyze, and publish this information in de-identified and aggregated form — in market reports, benchmarks, published articles, and product features, and to inform affiliated services. We construct aggregates so that no individual association, Board member, or management company is identifiable, and we suppress any cell representing fewer than ten observations.

We maintain de-identified information in de-identified form, do not attempt to re-identify it, and contractually require the same of anyone we provide it to. We will not publish a statistic identifying a specific association, or a specific company’s pricing, without written permission.

10Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary — a signed session cookie that keeps you logged in, and a site-access cookie during the pre-launch preview period. The Service cannot function without these.
• Preference — remembering choices such as intake progress, so you do not lose a partially completed form.
• Analytics — aggregate measurement of which pages are used and where flows break down, so we can fix them. We use Google Analytics for this. It is configured with IP anonymization and with Google Signals, advertising features, and ad personalization switched off, so the data is not used to build advertising profiles of you. We do not send it your name, your email address, your Association’s name, or anything you type into an intake, a proposal, or a message.

We do not use advertising cookies, third-party ad pixels, or cross-site tracking. You can block or delete cookies in your browser, though blocking strictly necessary cookies will prevent you from signing in. We honor Global Privacy Control and other recognized opt-out preference signals where your browser sends them.

11Your communication choices

Transactional messages — invitations, Bid status, report delivery, questions, votes, invoices, security notices — are part of the Service and continue while your account is active.

Marketing email — unsubscribe from any message, or change your preferences in your profile.

Text messages — only if you opt in. Reply STOP to stop, HELP for help. Message and data rates may apply; frequency varies; carriers are not liable for delayed or undelivered messages.

Email drip during a Bid — Boards receive progress updates during an active Bid. You can reduce these to essential-only in your Board profile settings.

12Your privacy rights

Depending on where you live, you may have the right to: know what personal information we hold and how we use it; access a copy; correct inaccuracies; delete it; obtain a portable copy; opt out of sale, sharing, or targeted advertising and of profiling with legal or similarly significant effects; limit the use of sensitive personal information; and not be discriminated against for exercising any of these rights.

These rights are available to residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. We extend the same request process to everyone regardless of residence, because maintaining two standards is more work than maintaining one.

How to submit a request. Use the privacy request form. We will verify your identity through your account email or by reasonable means where you do not have an account, and respond within the period your state’s law requires — generally forty-five (45) days, extendable once with notice.

Authorized agents may submit a request on your behalf with written authorization, and we may still verify with you directly.

Appeals. If we decline a request, our response explains why and how to appeal. Submit an appeal through the same form marked “Appeal.” We respond to appeals within the period required by your state’s law, and will tell you how to contact your state attorney general if you remain dissatisfied.

Limits. We may decline where we cannot verify identity, where the request is manifestly unfounded or excessive, or where an exception applies — for example, we retain records necessary to document a placement, an invoice, or an audit-log entry, and we retain information required by law. We will tell you when that is the reason.

13Additional disclosures for California residents

In the preceding twelve months we have collected the following categories of personal information under the CCPA: identifiers (name, email, phone, IP address, account identifiers); commercial information (proposals, pricing, transaction and invoice records); internet or network activity (site and portal usage); approximate geolocation (from IP, and precise location only if you use the locate-me feature); professional or employment information (role, title, employer, credentials); and inferences drawn to match Bids to qualified companies. The sources, purposes, and recipients of each category are described in Sections 3, 4, 5, and 7.

Sensitive personal information. We do not collect sensitive personal information as defined by the CCPA, and therefore do not use or disclose it for purposes requiring a right to limit.

Sale and sharing. We have not sold personal information and have not shared it for cross-context behavioral advertising in the preceding twelve months, and we do not do either now. We do not knowingly sell or share the personal information of consumers under 16.

Retention. We retain each category for the periods described in Section 14.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

Notice at collection. This policy serves as our notice at collection; no additional collection occurs beyond what is described here.

14Retention

• Account records — for the life of the account and up to twenty-four (24) months after closure, then deleted or de-identified.
• Bid and proposal records — seven (7) years, because a placement fee obligation runs eighteen months from introduction and disputes about a management agreement can arise years later.
• Invoices and payment records — as required by tax and accounting law, generally seven (7) years.
• Audit logs and security records — up to twenty-four (24) months.
• Support and contact-form messages — up to thirty-six (36) months.
• Marketing preferences and suppression lists — indefinitely, so that an unsubscribe is permanent.
• De-identified aggregate data — indefinitely, in de-identified form only.

We delete or de-identify earlier where you ask and no exception applies.

15Security

We maintain administrative, technical, and physical safeguards appropriate to the information we hold: encryption in transit; passwords stored only as salted, iterated cryptographic hashes and never in recoverable form; signed, expiring session tokens; role-based access control separating Board, management company, and administrative access; audit logging of significant actions; least-privilege internal access; and monitored, managed infrastructure.

The Service is not designed to hold, and you should not submit, government identification numbers, financial account credentials, or health information. Payment details are handled by our payment processor rather than stored by us.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any required authority as and when the law requires, and will describe what happened and what we are doing about it.

16Children

The Service is for adults conducting association business. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact us and we will delete it.

17Third-party sites and services

The Service links to third-party sites and features — scheduling and booking links provided by management companies, public review pages, identity providers used for single sign-on, and our payment processor. Their handling of your information is governed by their own privacy policies. We encourage you to read them.

18Where information is processed

BoardMatch is operated in and intended for the United States, and information is processed on infrastructure located in the United States. If you access the Service from outside the United States, you consent to that processing. We do not currently offer the Service to residents of the European Economic Area, the United Kingdom, or Switzerland.

19Changes to this policy

We may update this policy. We will change the effective date and version at the top, and for material changes we will provide notice by email or in the portal before the change takes effect. Continued use after the effective date constitutes acceptance.

20How to reach us

BoardMatch is a product of NeighborLink Inc. We do not publish a mailing address, phone number, or email address — every privacy request, question, and appeal is submitted through the forms below, which creates a written record and routes to the right team.

See also: Terms of Use