Kenilworth HOA

This policy describes how long Kenilworth Townhome HOA, Inc. retains each category of data collected through the residents-only portal at kenilworth-hoa.com, what events trigger disposal, and how disposal is carried out. It complements our Privacy policy (which covers what we collect and why) and Terms of service (which covers how the site may be used).

Retention schedule

Financial records(charges, payments, voids, autopay history): kept indefinitely as part of the HOA’s audit history; minimum 7 years from the date of record to satisfy IRS recordkeeping for the association’s tax filings.
HOA-published documents(CC&Rs, bylaws, board resolutions, insurance certificates, board correspondence): indefinite. Governing documents are permanent records of the association.
Unit-specific documents (lease agreements, tenant insurance, etc.): while the related ownership or tenant tenure is open, plus 7 years after the tenure closes, in case of later disputes or insurance claims tied to that tenancy.
Profile data (name, email, optional phone, optional profile image): while the account is active. After ownership ends and the account is deactivated, contact fields can be redacted on owner request — typically within 30 days. The account record itself stays attached to closed-tenure history.
Tenant contact info (name, email, phone recorded by the owner of a rented unit): while the tenant tenure is open. Removed within 30 days of the tenure ending. Tenants do not have logins; their data is owner-recorded only.
Authentication credentials (password hash, encrypted TOTP secret, hashed recovery codes): while the account is active; deleted at account deactivation.
Authentication and admin-action audit logs: 18 months. Long enough to investigate a disclosed incident; short enough to avoid an indefinite record of who-did-what.
Provider-held operational data— error reports (Sentry), transactional email logs (Resend), web request logs (Vercel), bank-sync logs (Plaid): retention is governed by the provider’s own policy. We do not store copies of these logs ourselves. As of this writing the provider windows are roughly: Sentry 90 days, Resend 30 days, Vercel runtime logs 1 day, Plaid per their data-retention schedule.
Database backups: managed by Neon under their point-in-time recovery feature (currently a 7-day window on the active plan). Deleted records age out of backups automatically as the recovery window rolls forward.

Disposal procedure

Database rowsare first soft-deleted (kept for tenure auditability) and hard-deleted at the end of the retention window. Hard deletion removes the row from the active database; backup copies age out within Neon’s recovery window.
Google Drive filesare moved to the Drive trash and then permanently deleted at the end of the retention window. Trashed files are recoverable for 30 days under Google’s default behavior.
Stripe customer and payment-method records: when an account is deactivated, the linked payment method is detached on our side. Stripe itself retains the customer record under its own terms; we do not control that retention.
Plaid items: when the HOA’s bank link is disconnected, the Plaid access token is revoked and the corresponding row is deleted from our database.

Triggers for disposal

The retention countdown begins on whichever applies:

Account deactivation — the date the HOA closes the account, usually when an owner sells.
Tenure closure — the date an ownership or tenant tenure record is marked ended, for documents and tenant data tied to that tenancy.
Record creation — the date of the record itself, for financial records and audit logs.
Owner request — for fields that are not retention-locked, the date we receive the request.

Exceptions

Records will be retained beyond the periods above when required by an active legal hold or court order, an open insurance claim or dispute related to the data, an open tax audit or examination, or an open security investigation. Affected records are excluded from disposal until the matter is resolved, then returned to the standard schedule.

Updating this policy

This policy may change as the HOA’s data practices evolve or as third-party providers change their own retention windows. Material changes will bump the last- updated date at the top of this page and will be communicated by email to active owner accounts.

Contact