This policy covers the website and resident portal operated by The Vistas at Gallahan Farm II Homeowners Association, Inc. ("the HOA," "we," "us"), for the Gallahan Estates community. If you have questions about this policy or how your information is handled, contact the board at board@gallahanestates.org.
We collect the information needed to run resident services, the architectural review process, and CC&R enforcement — nothing beyond that.
Account & property. Name, email address (also used to sign in), phone number, and — for board members — role and board title; property street address, city, state, zip, lot/block/section, a "high-visibility" flag, and internal notes; and the ownership links between residents and properties.
Architectural Change Requests (ARC). Owner name, phone, and email; mailing address; a description of the proposed project; estimated start/end dates; easement disclosures; and any plans, drawings, or photos you upload in support of the request.
CC&R enforcement (violations). The subject property address, a description of the observed condition, the date it was observed, the reporting board member, a category, and any evidentiary photos. Uploaded photos have their EXIF metadata (including embedded GPS location) stripped automatically before storage.
Contact form. Your name, email address, subject, and message body when you use the public contact form.
Chatbot / assistant. The questions you ask and the answers given, along with which channel you used (public or resident) and whether the AI model was used. When the AI features are enabled, your question and the retrieved excerpts from the governing documents are sent to Anthropic (for the answer) and Voyage AI (for search) — see §5.
Security logs. For security-relevant actions (sign-ins, status changes, uploads, and similar), we record who took the action, what it was, the target, the originating IP address, and a timestamp.
When an applicant or a neighboring owner signs an Architectural Change Request, we capture a signature image. That signature is stored as part of the ARC record and the resulting decision packet. For a neighbor, signing indicates awareness of the project — it is not an approval of it; the board makes the decision.
We use the information above to run the architectural review process, administer CC&R enforcement, communicate with residents about their requests and account, and keep the site and resident accounts secure.
We do not sell information. We share it only with the following, as needed to operate the services above:
We use exactly two strictly-necessary cookies:
sessionid — keeps you signed in. HttpOnly, SameSite=Lax, and
Secure in production.csrftoken — protects form submissions from cross-site request
forgery. HttpOnly, SameSite=Lax, and Secure in production.There are no analytics, marketing, or third-party cookies. All scripts and stylesheets are self-hosted — nothing is loaded from an external CDN or font service. Signing in uses a one-time link (a URL token that expires in 15 minutes), not a cookie. Because both of our cookies are strictly necessary for the site to function, they are exempt from cookie-consent requirements, which is why you don't see a consent banner.
We keep records for as long as they're needed to run the HOA's governance, architectural review, and enforcement processes, and as required by our governing documents and applicable law. We do not currently have a formal, board-adopted retention schedule with specific time periods for each record type; if one is adopted, this section will be updated to reflect it.
You may ask us to access, correct, or delete the personal information we hold about you by emailing board@gallahanestates.org. Some records — for example, ARC decisions, signatures, and enforcement history — may need to be retained even after such a request where the HOA has a legal or governance obligation to keep them.
Sign-in uses one-time, 15-minute magic links rather than passwords. Uploaded files are never given a public URL — they're only accessible through views that check your permissions first. The production site is served over HTTPS/TLS. We keep an audit log of security-relevant events. Uploaded photos have EXIF/GPS metadata stripped before storage. Access to administrative functions is limited to board members on a least-privilege basis.
This service is intended for adult homeowners and residents of the community. It is not directed at children, and we do not knowingly collect information from children.
This policy is version-controlled along with the rest of the site's code. The "Last updated" date at the top of this page reflects the most recent change to its content.
Questions about this policy or your information can be sent to the board at board@gallahanestates.org.
As noted above, this policy is not legal advice. It should be reviewed by an attorney familiar with applicable privacy law before the board relies on it.