Privacy Policy

Arbor Lane is operated by Cloudproper LLC, a Michigan limited liability company based in Holland, MI. References to "we," "us," and "Arbor Lane" throughout this policy mean Cloudproper LLC operating the Arbor Lane service.

We collect what the product needs to run, and nothing else. From the resident side: your name, email, phone number (optional), the unit you're associated with, your ledger (charges and payments), tickets you file or comment on, forms you submit, signatures you give, and notifications we've sent you. From the operator side: the same plus organization metadata, your role and permissions, your billing email, and your payout banking details (account routing, last 4 — full numbers stay at Stripe). We also store one functional cookie for your session and one for tenant-scoped CSRF protection.

We use your data to operate the service — to render your community's surfaces, route notifications, collect dues through Stripe, send transactional email, and let operators do their job. We use aggregated, non-identifying signals to make the product better. We do not sell your data. We do not share it with advertisers. We do not run analytics that build a profile of you.

If you're in the EU or UK, we process your personal data under one of these legal bases: contract performance (when we run the service you signed up for), legitimate interest (when we operate the platform securely and improve it), and consent (when you accept these terms at sign-up). You may withdraw consent at any time by deleting your account — see "Your rights" below.

We rely on a small number of third parties to run the service: Cloudflare (compute, storage, networking), Stripe (billing and dues collection), SendGrid (transactional email), and Expo (mobile push). Each is a sub-processor under our agreement with you. We list them in detail, with their data processing addenda, at /legal/subprocessors. We'll give customers who subscribe at least 30 days' notice before adding a new sub-processor.

We keep your data for as long as you have an active account. When you delete your account, most data is removed within 30 days (after a grace period that lets you restore the account). Two exceptions: electronic signatures are retained for seven years per our e-sign retention policy (a legal-evidence requirement), and audit logs are retained for seven years for security and compliance review. Backups roll off on a 30-day window.

Wherever you live, you have the right to access your data, correct it, and delete it. We honor these for everyone.

We encrypt data in transit with TLS 1.3 and at rest using Cloudflare D1 and R2 defaults. We isolate tenants at the data layer so one community can never see another. We log every state-changing administrative action. We're working toward SOC 2 Type II certification — see /legal/security for the current posture in detail.

Arbor Lane is a B2B platform for HOAs and property managers. We don't knowingly collect data from anyone under 13. If you believe a child has registered, email legal@arborlane.app and we'll delete the account.

Arbor Lane runs on Cloudflare's US infrastructure. If you access the service from outside the US, your data is transferred to and processed in the United States. For EU and UK data subjects, we rely on Standard Contractual Clauses to authorize the transfer. Email legal@arborlane.app for the SCC documentation if your procurement requires it.

For any privacy question — including data-subject-rights requests — email legal@arborlane.app. We aim to respond within seven business days. Our privacy contact is Michael McNees (Cloudproper LLC, Holland, MI).

When we make a material change to this policy — anything that affects what we collect, how we use it, who we share it with, or your rights — we'll ask you to accept the new version the next time you sign in. Minor changes (typos, clarifications) don't require re-acceptance but bump the "Last updated" date below.