Privacy Policy
Effective November 10, 2026
This policy explains how ProjectHax LLC ("we", "us") handles personal information in DuesDesk and ClubDues (the "service"), an online tool that helps homeowners associations, clubs and similar groups ("Groups") track dues, send reminders and run a member portal.
1. Two roles: when the Group decides, and when we decide
- Group data (we act for the Group). Treasurers and board members enter information about their members, owners and residents: names, contact details, addresses, dues, charges, payments and documents. The Group decides what it collects and why. We process it only to provide the service on the Group's instructions, under our Data Processing Addendum. If you are a member or homeowner and have a question about your information, please contact your Group first; we pass on requests that reach us.
- Our own data (we decide). Information about people who create an account (treasurers, admins), visit our website, or email our support.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | name, email, password hash if you set one, two-factor settings, the Groups you belong to and your role | you |
| Group roster data | names, emails, phone numbers, property and mailing addresses, unit or membership details, notes | the Group |
| Financial records | dues and assessments charged, payments recorded, balances, check numbers, refunds, disputes | the Group; Stripe (payment status only) |
| Documents and messages | files and announcements the Group uploads; emails we send for the Group and whether they were delivered | the Group; our email provider |
| Requests, votes and events | what a Group and its members enter in the optional features | the Group and its members |
| Technical data | IP address, browser type, security logs | your device |
| Support | the content of emails you send us | you |
We do not receive or store full card numbers or bank account numbers. Online payments are processed by Stripe on the Group's own Stripe account; Stripe's privacy policy applies to the payment details entered there. We do not hold, receive or transfer the Group's money.
Our free calculators run in your browser. What you type into them is not sent to us.
3. How we use it
- To provide the service: keep ledgers, create charges and statements, send the reminders and receipts the Group has set up, show the member portal, and record payments reported by Stripe.
- To secure the service: sign-in, fraud and abuse prevention, audit logs, backups.
- To bill Groups for their subscription and to provide support.
- To improve the service using aggregated statistics that do not identify anyone.
We do not sell or rent personal information, do not use it for advertising, and do not use Group data to train AI models.
4. Who can see Group data
- The Group's own officers, according to the roles its admins give them. Members see only their own unit or membership, plus what the Group shares with all members.
- Our staff cannot view a Group's records unless one of its admins switches on support access. That access is time-limited and read-only, and every page opened is recorded in the Group's audit log.
5. Service providers
We share information only with providers that help us run the service, under contracts that protect it:
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | application and database hosting | United States |
| Cloudflare | network security, file storage, encrypted backups | United States and global network |
| Resend | sending email | United States |
| Stripe | payments, which run on the Group's own Stripe account; also our subscription billing | United States and others |
The current list is at /subprocessors. Group admins are told at least 30 days before we add a new one. We may disclose information if the law requires it, to protect rights and safety, or as part of a business transfer (with notice).
6. How long we keep it
- Group data: while the Group's account exists. If a subscription ends, the Group has 90 days of read-only access and export.
- Deleted people: contact details are erased 30 days after a Group deletes a person. Their charges and payments stay with the unit or membership, because the Group's books need them.
- Deleted Groups: restorable by the Group's admins for 30 days, then erased from live systems, files included.
- Backups: encrypted; daily copies are kept 30 days and monthly copies 12 months, then deleted.
- Email: the text of emails we send for a Group is kept 30 days; the record that it was sent and delivered stays with the Group's history.
- Audit log: kept with the Group for as long as the Group exists.
- Our own billing records: as tax law requires.
7. Security
Encryption in transit, encrypted backups, separation of each Group's data enforced by the database, two-factor authentication for treasurers and admins, an audit log that cannot be edited, and support access only when a Group admin allows it. More detail is on our security page. No system is perfectly secure; if a breach affects your information we will tell the affected Groups without undue delay.
8. Your choices and rights
Depending on where you live (for example California, or the EEA and UK), you may have rights to see, correct, delete or receive a copy of your personal information, and to object to or restrict some uses. Members and homeowners should contact their Group, which controls roster data; we help the Group respond. Account holders and site visitors can email support@duesdesk.app. We will not treat you differently for using your rights. You can unsubscribe from announcement emails with the link in each message; billing notices are decided by your Group.
9. Cookies
We use only the cookies needed to sign you in and to protect forms from forgery. We use no advertising or tracking cookies and no third-party analytics. The sign-in and sign-up pages use Cloudflare Turnstile to tell people from automated abuse: it runs a script from Cloudflare that looks at browser and device signals, and Cloudflare, not we, processes them for that purpose only.
10. Children
The service is not directed to children under 13 and we do not knowingly collect their information. Youth clubs should list a parent or guardian as the contact.
11. International users
The service is hosted in the United States. If you use it from elsewhere, your information is transferred to the United States; where required we rely on appropriate safeguards, such as the Standard Contractual Clauses in our Data Processing Addendum.
12. Changes
We will post changes here and email Group admins at least 30 days before a material change takes effect.
13. No warranty, no liability
This policy describes how we handle information; it is not a guarantee. The service and this website are provided "as is", without warranty of any kind, and to the fullest extent the law allows we are not liable for any loss or damage arising from them, as set out in sections 11 and 12 of the Terms of Service. Nothing here takes away a right that privacy law gives you and does not allow to be waived.
14. Contact
ProjectHax LLC, support@duesdesk.app. Postal address available on request.
Also see: Terms · Privacy · Data Processing Addendum · Subprocessors · Acceptable use