Continuum Privacy Policy

# Privacy Policy

Version 2026-09

Effective date: September 14, 2026. Version: 2026-09. Prior versions: https://continuumhoa.com/legal/archive.

Continuum Technologies LLC ("Continuum," "we," "us") provides a hosted platform that organizes community-association financial and governance information (the "Platform"), together with related websites, email communications, and link-based pages. This policy describes the information we collect, how we use and disclose it, how long we keep it, and the choices available to you. It applies to the Platform and to our websites and communications. It does not apply to information handled by a community association, property manager, or other organization under its own policies.

1. Our roles

We handle information in three capacities.

• Association records. Financial statements, bank records, budgets, reserve studies, governing documents, meeting and decision records, vendor materials, correspondence, and other information are furnished by or on behalf of a subscribing community association (the "Association") and belong to it. These records can include information about owners, residents, users, vendors, and other individuals. We process Personal Information in Association records on the Association's behalf and under its instructions as its processor or service provider, under Schedule 1 (Data Processing Terms) of the Continuum Master Subscription Agreement. Questions or requests about an Association's records should go to the Association or its property manager. We will assist as required.
• Account and service information. We decide how account, business-contact, billing, agreement, security, authentication, support, and product-analytics information is used, for the purposes in Section 4. We are the controller of that information.
• Product improvement and insights. We use Association information other than Personal Information to improve our own products and models and to create aggregated, statistical, or comparative insights, under Section 6.

"Personal Information" means information linked or reasonably linkable to an identified or identifiable individual.

2. Information we collect

Account and affiliation information. Name, email address, user identifier, role, Association affiliation, organization name where applicable, sign-in and authentication events, and notification preferences. This information is provided by you, the Association, or its property manager.

Association records. Information furnished by the Association and its agents, or generated within the Platform from that material, including financial, banking, reserve, budget, vendor, bid, governance, meeting, document, correspondence, and decision records. These records may contain owner or resident names, addresses, unit-linked details, and information about assessments, dues, or other amounts owed to the Association by an identifiable owner or resident.

Usage, device, and log information. IP address; device, browser, operating-system, and screen information; the pages and routes you visit; cookie and local-storage identifiers; server and application logs; performance measurements; feature and interaction events; search terms and assistant inquiries; and support or error context.

Cookies and similar technologies. We use cookies and similar technologies that are strictly necessary to sign you in and keep your session secure, cookies that remember your preferences, and analytics cookies and identifiers set by our analytics provider. We do not use third-party advertising cookies, and we do not permit third parties to collect information across sites for advertising through the Platform. Most browsers allow you to block or delete cookies. Blocking strictly necessary cookies prevents sign-in.

Session replay. Recordings that reconstruct how a signed-in user navigates and interacts with Platform pages, including mouse movement, clicks, scrolling, page content, and inputs. Section 5 describes this practice in full.

Communications. Messages you exchange with us; the content of notifications, digests, and reports the Association or you elect to receive; sender, recipient, subject, and attachment details for email sent to an Association intake mailbox where that workflow is enabled; replies to Platform messages; and delivery, bounce, complaint, open, and click events where our email provider records them.

Link-based access without an account. Some emails and workflows contain links that work without signing in, such as a link to a single item from a digest, a one-click approval or vote link, an unsubscribe link, or an upload link for a short-term-rental report. Each link carries a signed, expiring token. When you use one, we record the token, the action taken, the time, your IP address, and browser details, and we store anything you submit as an Association record. We do not run analytics or session replay on public single-item pages.

Agreement and transaction evidence. The version and hash of each agreement or notice you accept, the acknowledgment text shown, your decision, the date and time, your email address, your IP address or a keyed hash of it, and your browser details. We retain invoice, payment-status, and transaction-reference information needed to administer the subscription. Do not submit full payment-card numbers through the Platform.

We do not intentionally collect government identifiers, payment-card credentials of individuals, health information, biometric information, precise geolocation, or information about children. An Association should not submit such information unless lawful Association administration requires it.

3. Sources

We collect information directly from you; from the Association and the property managers, accountants, reserve professionals, attorneys, and other organizations it authorizes; from vendors and other persons who submit materials for the Association; from your device and browser; from our service providers; and from public records where the Association directs us to use them.

4. How we use information

We use information to:

• provide, maintain, secure, support, and administer the Platform, including sign-in, tenant and role access control, storage, data-quality workflows, troubleshooting, fraud and abuse prevention, and incident investigation;
• process Association records under the Association's instructions, including requested analysis, document extraction, reconciliation, reserve modeling, communications, AI-assisted features, and authorized disclosures;
• understand how the Platform is used and improve its usability, reliability, performance, support, and design, through analytics, performance monitoring, feedback, and session replay;
• develop Continuum's products, models, and methods and create aggregated, statistical, or comparative insights, under Section 6;
• send service and security messages, and the notifications, digests, and reports the Association or you elect;
• invoice and collect fees, maintain agreement evidence, enforce our agreements, establish or defend legal claims, and comply with law.

We do not sell Personal Information. We do not share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects about an individual.

5. Session replay

This Section describes the replay practice referred to in Section 9.1 of the Continuum Master Subscription Agreement and Section 8.2 of the End User Terms.

• Purpose. To diagnose errors, understand how users move through the Platform, and improve usability and support.
• What is captured. Page structure and visible text, mouse movement, clicks, scrolling, and inputs on Platform pages during a signed-in session. In the current configuration, password and sign-in email inputs are masked. Other visible text and non-credential inputs are captured, so a recording can include Association financial, governance, correspondence, or unit-linked information visible during the session.
• Where it is not used. Replay is not initialized on public single-item pages reached from a digest link, on the Reserve Study Companion pilot host, or before a user has accepted the End User Terms.
• Provider. Our contracted analytics and session-replay service provider processes recordings on our behalf, subject to confidentiality, security, and purpose limitations. Provider information is available to subscribing Associations in the signed-in Platform legal area and on request.
• Who can view them. Continuum personnel with an operational need. Recordings are not shared with Associations, other users, or third parties, except as required by law or to investigate a security incident.
• Retention. We retain recordings only while reasonably necessary to diagnose errors, investigate security or support issues, and evaluate usability. We consider the issue’s status, the recording’s sensitivity and usefulness, and legal preservation requirements, then delete recordings through our provider’s retention and deletion processes. Aggregate analytics derived from recordings are retained separately under Section 8.
• Consent. Replay for a user begins only after the user has been presented with this disclosure and has affirmatively accepted the End User Terms. We retain evidence of that acceptance.
• Withdrawal. A user may withdraw consent prospectively by contacting privacy@continuumhoa.com. We stop replay for that account within a commercially reasonable period after verifying the request. Withdrawal does not affect Platform access. Recordings made before withdrawal are handled under the retention criteria above.
• Analytics events. Separately from replay, we record feature and interaction events with identifiers, role, Association context, and technical properties. We do not intentionally place free-text content, secrets, or authentication tokens in analytics event properties.

6. Product improvement and insights

Community associations benefit from learning how similarly situated properties operate, for example ranges for landscaping spend, insurance cost, reserve funding levels, or vendor pricing. We may use, combine, analyze, and transform Association records other than Personal Information to improve Continuum's own products, Services, models, systems, and methods and to create aggregated, statistical, comparative, and other insights. We may use and commercialize the resulting models and insights for benchmarking, research, analytics, and products or services for associations and other market participants.

We apply the following safeguards, which are also commitments in our customer agreement:

• We do not disclose one Association's raw records, source documents, or named results to another customer or data-product recipient without the source Association's documented direction.
• We do not identify an Association as the source of an insight without its documented direction.
• We use reasonable safeguards designed to prevent models and outputs from reproducing source documents, Personal Information, or information expressly identifying a source Association.
• Personal Information, including unit-level owner and resident records linked or reasonably linkable to an individual, is not used for cross-customer model training and is not included in external data products.
• A vendor's nonpublic bid, proposal, or quotation is not disclosed to a competing vendor, including through comparisons or insights.

De-identified data. If we create de-identified data from Personal Information, we take reasonable measures to ensure the data cannot be associated with a natural person, we publicly commit to maintain and use it only in de-identified form and not to attempt to re-identify it, we contractually require recipients to comply with the same restrictions, we reasonably oversee their compliance, and we take appropriate steps to address any known breach of those restrictions.

7. Artificial intelligence

The Platform uses third-party AI infrastructure for document extraction, classification, narration, summarization, and responses to user inquiries. We send only the information reasonably needed for the requested feature. Our agreements and account settings prohibit those providers from using Association Data to train or improve their own general or service models. Provider use of Association Data for training is different from Continuum's own product improvement under Section 6. The former is prohibited. The latter is governed by our customer agreement and this policy.

AI-assisted output may be inaccurate or incomplete. The Platform labels AI-assisted features, and users are told to verify critical information before acting on it. The Platform does not use AI to make decisions about individuals, and its outputs are not consumer reports.

8. Retention

9. When we disclose information

• Service providers (subprocessors). We use providers for application hosting and performance monitoring, database, authentication, and storage, AI infrastructure, email delivery and intake, analytics and session replay, business email and documents. Subscribing Associations receive a current list identifying providers and their processing purposes, locations, and data categories through the signed-in Platform legal area or on request to privacy@continuumhoa.com. We provide additional recipient information where applicable law requires it. Providers are bound by contract to process information only for us and to protect it.
• At the Association's direction. We disclose designated Association records to a recipient identified in the Association's signed Data Disclosure Authorization, for the purpose and period it states. Recipients accept the Continuum Third-Party Terms or a separate written agreement before receiving ongoing access or Personal Information.
• Authorized Users and Organizations. We make Association records available to the board members, officers, employees, property managers, professionals, and other users the Association authorizes, subject to role and tenant controls.
• Vendors and submitters. We make an Association's requests and related materials available to vendors and other persons the Association invites to submit bids, proposals, or other materials, limited to what the submission requires.
• Aggregated or comparative insights. We disclose or license insights as described in Section 6, without Personal Information, raw Association records, source documents, or named Association results.
• Corporate transactions. We may disclose information in connection with a financing, merger, acquisition, reorganization, or sale of the relevant business or assets, subject to confidentiality and continued protection under this policy or a successor policy that is at least as protective.
• Legal, safety, and rights. We may disclose information where required by law or legal process, to protect the Platform, users, or others, or to establish, exercise, or defend legal claims. Where legally permitted, we limit the disclosure and notify the affected Association.

10. Owners, residents, vendors, and other individuals in Association records

If you are an owner, resident, vendor, or other person whose information appears in an Association's records, that information reached us because the Association or its agents furnished it or because you submitted it through a link the Association provided. The Association decides how its records are used and disclosed. To access, correct, or delete information in an Association's records, or to ask how the Association uses it, contact the Association or its property manager. If you contact us instead, we will refer your request to the Association and assist it as its agreement and applicable law require. We do not use information about you in Association records for our own marketing, and we do not sell it.

11. Security

We maintain administrative, technical, and organizational safeguards described in Schedule 2 (Security Measures) of the Continuum Master Subscription Agreement, including access controls, encryption, restricted administrative access, logging, backup and recovery procedures, and incident-response measures appropriate to the information and risks. Audit records are not editable through ordinary user interfaces. Continuum does not presently hold a SOC 2 report or other third-party security certification. No system is perfectly secure. If a security incident affects Personal Information, we notify affected Associations and individuals as our agreements and applicable law require.

12. Your choices and rights

Account and preferences. You may review and correct your account information within the Platform or by contacting us. You may manage notification and digest preferences within the Platform or through the unsubscribe link in each message. Service and security messages cannot be disabled while an account is active.

Session replay. See Section 5 for how to withdraw consent.

Privacy rights. Depending on where you live, you may have the right to confirm whether we process your Personal Information, to access it, to correct inaccuracies, to delete it, to obtain a portable copy, to opt out of sale, targeted advertising, or profiling that produces legal or similarly significant effects, and to appeal a decision on your request. We do not sell Personal Information, use it for targeted advertising, or conduct that kind of profiling, so there is nothing to opt out of in those categories.

How to submit a request. For information Continuum controls independently (Section 1), email privacy@continuumhoa.com, marked “Privacy request”. We will verify your identity using information associated with your account or your request and respond within the time applicable law requires, generally forty-five (45) days. If we deny a request, we will explain why and how to appeal. An authorized agent may submit a request on your behalf with written authorization, and we may confirm the request with you directly. We do not discriminate against anyone for exercising privacy rights.

Information in Association records. Direct the request to the Association or its property manager. See Section 10.

13. Children

The Platform is not directed to individuals under 18, and we do not knowingly collect their Personal Information. An Association should not submit information about a minor unless lawful Association administration requires it.

14. Location of processing and changes

The Platform is operated from the United States and uses United States hosting infrastructure. Service-provider support and ancillary processing may take place in other locations permitted by the governing terms and applicable law. Where a transfer requires additional legal safeguards, those safeguards must be in place before that transfer is enabled.

We may update this policy as our practices, the law, or the Platform change. We will post the new version with its effective date at https://continuumhoa.com/legal/privacy, keep prior versions in the archive, and notify affected users of material changes before they take effect. A material change that requires consent under our agreements or applicable law will not apply to you until that consent is obtained. A change to this policy does not by itself permit a use of Association Data that our customer agreement prohibits.

15. Contact

Continuum Technologies LLC
Nashville, Tennessee
Attention: Chief Executive Officer
Privacy requests: privacy@continuumhoa.com
Security reports: security@continuumhoa.com
Legal notices: legal@continuumhoa.com