Privacy Policy

Most of the information in BidChex belongs to an Association. We hold and process it on that Association's behalf and under its instructions. The Association decides what records to keep, who may see them, and what to do with them. We provide the tools.

That distinction matters if you are an owner or a tenant. If you want your information corrected, removed, or explained, start with your Association. We will support the Association in responding, but we will not override its decisions about its own records.

For our own website, our billing, our account administration, and for accounts created directly with BidChex rather than through an Association, we act on our own behalf.

Association and board information. Association name and address, board member names, titles, and contact information, the operating account bank name and account title, and the fees and billing history for the Association's BidChex account.

Owner and resident records. Name, unit, mailing address, email address, telephone number, mobile telephone number where you have opted in to SMS, emergency contact information, ownership or tenancy status, lease dates, vehicle information, pet information, and household members, to the extent the Association or the resident provides it.

Direct account information. For accounts created directly with BidChex, the account holder's name, email address, mobile telephone number where provided, company name, job title, profile picture, biography, and preferences.

Project, bid, and vendor information. Project details, scopes of work, requests for proposal, bid documents and pricing, vendor names and contact information, vendor assessment and reputation records, invoices, and related communications.

Payment information. For dues paid by ACH, the resident's bank routing and account numbers and their payment authorization. For dues paid by card, and for direct BidChex subscriptions, the payment is processed by a payment processor; we receive a confirmation and a truncated card reference, not the full card number. We also hold the Association's operating account details needed to deposit dues and debit approved payments. BidChex does not take custody of Association or resident funds. Money moves between the payer's account and an account titled to the Association.

Building access information. When an Association uses the building security module, we hold the resident's name, unit, and access credential, including PIN codes, so that we can provision access. We transmit that information by API to the access control system located at the property.

Our role in building access is to manage who has access and to keep credentials current. We do not operate the access control equipment itself and we do not receive its surveillance records. Camera video, door entry and exit logs, and similar records are created and stored on the Association's own access control equipment, which the Association owns and which sits at the property. Those records are governed by the Association and by that equipment manufacturer's terms, not by this policy. If you want to know what your building's access equipment records and how long it keeps it, ask your Association.

Content submitted through the platform. Maintenance and violation reports, photographs uploaded with them, package photographs taken at the front desk, guest visit requests, messages and announcements, uploaded documents, meeting agendas and minutes, votes, and vendor and invoice records. Photographs of violations and packages may incidentally show people, vehicles, or license plates.

Connected mailbox information. If you connect a third-party email account, the information described in Section 3.

Technical information. IP address, browser and device type, operating system, device identifiers, pages and features used, access times, error and performance logs, and timestamps. We log this to operate the platform, troubleshoot, and detect abuse.

Connecting a mailbox is optional. The platform works without it.

If you choose to connect a third-party email account through the Services, for example through the Mail tab using OAuth, IMAP, or a similar integration, you direct us to access, synchronize, collect, copy, store, and otherwise process information from that mailbox.

That information may include email messages and drafts, headers and metadata such as senders, recipients, timestamps, and routing information, subject lines and bodies, attachments, mailbox folders and labels, and the account identifiers and tokens needed to maintain the connection.

What we do with it. We use mailbox content to provide the connected-mail features: displaying and searching your mail in the platform, categorizing and tagging messages, summarizing them, detecting topics, projects, and bids, associating messages with properties, vendors, or workflows, generating reply suggestions and drafts, and performing security, fraud, and abuse review. Section 7 describes how AI processing is handled and what limits apply to it.

What we do not do with it. We do not sell mailbox content, use it for advertising, or disclose it to anyone other than the service providers listed at bidchex.com/subprocessors. We do not permit our AI providers to use it to train their models.

Your authority to connect. Only connect a mailbox you are entitled to connect. Mail you receive may contain other people's information, and by connecting a mailbox you confirm you have the authority to bring that content into BidChex, including any obligation you owe to your employer or organization.

Storage. Mailbox content is stored on systems we and our subprocessors operate in the United States, for as long as needed to provide the feature, comply with law, and resolve disputes, subject to the retention practices in Section 11.

Disconnecting. You may disconnect a linked mailbox at any time in the platform. Disconnecting stops new syncing immediately and revokes our access tokens. Content already synced is deleted from active systems within 30 days of disconnection, unless you tell us to keep it or we are required to retain it. Backup copies age out on our normal backup cycle.

BidChex offers SMS text message notifications to property managers, board members, residents, unit owners, and prospective renters or buyers in connection with HOA management activities. Opt-in is collected through written application and onboarding forms, such as rental and purchase applications administered by the Association or its management company, using a dedicated, standalone consent checkbox.

Types of messages. SMS messages from BidChex are transactional. They may include account invitations and activation notifications, building access and intercom event alerts, HOA violation and compliance notices, in-app message notifications, and operational alerts related to property management activities. We do not send marketing or promotional text messages.

Message frequency. Message frequency varies based on property activity and user role.

Message and data rates. Message and data rates may apply. BidChex does not charge for SMS messages, but your mobile carrier may charge for messages sent to or from your device.

No sharing of mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors supporting BidChex services, such as our SMS delivery provider, is permitted only as necessary to deliver the messages you have requested. Mobile opt-in data and consent are not shared with any third parties for any purpose.

Opt-out. You may opt out of SMS messages at any time by replying STOP to any message from BidChex. You may also opt out by disabling SMS notifications in your BidChex account settings or by contacting support@bidchex.com. After you opt out, you will receive a one-time confirmation message and no further SMS messages from BidChex.

Help. For help with SMS messages, reply HELP to any message from BidChex, contact support@bidchex.com, or visit https://bidchex.com.

Consent is not required. Consent to receive SMS messages from BidChex is not a condition of using BidChex services, applying for a rental or purchase, or any other transaction. You may use BidChex with in-app notifications only.

We use the information to:

• run the platform and the features the Association or the account holder has enabled
• authenticate users and control who can see what
• collect dues and route approved payments to and from the Association's account
• provision and update building access credentials
• generate, circulate, and analyze requests for proposal, bids, and vendor records
• provide the connected-mail features described in Section 3
• send platform, transactional, and Association communications, including SMS where you have opted in
• provide support, investigate problems, and prevent fraud and abuse
• bill the Association or the account holder and keep our own business records
• comply with law and respond to lawful requests

We do not use resident information to make automated decisions that produce legal or similarly significant effects about a person.

BidChex does not sell personal information. We do not rent, trade, or otherwise disclose it for money or other valuable consideration. We do not share it for targeted or cross-context behavioral advertising. We do not allow third-party advertising trackers on the platform. We do not use resident information to market unrelated products.

Some platform features use artificial intelligence, for example drafting meeting minutes, summarizing maintenance and violation reports, analyzing bids and project documents, helping residents find documents, and the connected-mail features described in Section 3.

To provide those features today, we send the relevant content to a third-party AI provider. We use those providers under commercial API terms that:

• prohibit the provider from using our customers' content to train its models
• permit the provider to process the content only to return a result to us
• limit how long the provider may retain the content

We send only what the feature needs. We do not send bank account numbers, card numbers, or access PINs to AI providers.

AI output can be incomplete or wrong. Classifications, summaries, suggestions, and drafts produced by these features are not legal, financial, or professional advice, and should be reviewed before you rely on them.

BidChex plans to move this processing onto infrastructure it operates itself. We will update this policy when that happens.

The Association and its agents. Board members, committee members, and the property manager the Association authorizes, according to the permissions the Association sets.

Service providers we use to run the platform. These fall into the following categories: cloud hosting and infrastructure, banking and payment processing, email and SMS delivery, artificial intelligence processing, error monitoring and analytics, and customer support tooling. A current list of named service providers is published at bidchex.com/subprocessors. Each is bound by contract to protect the information and to use it only to provide services to us.

The Association's access control system, for the access credential information described in Section 2.

When the law requires it. In response to a subpoena, court order, or other lawful request, or where necessary to protect the rights, safety, or property of BidChex, an Association, or any person. Where we are legally permitted, we will tell the affected Association before we respond.

In a business transfer. If BidChex is acquired or merges, information may transfer as part of that transaction, subject to this policy.

If you are an owner in a Florida condominium association, Florida law gives you the right to inspect many of your association's official records. See Section 718.111(12), Florida Statutes. An association generally must make those records available within 10 working days after a written request.

Nothing in this policy overrides that right. We do not promise an Association or any individual that information stored in BidChex will be kept confidential from owners who are entitled to inspect it. Where records must be produced, they must be produced.

Florida law also excludes specific categories from owner inspection, including:

• records protected by lawyer-client privilege and attorney work product
• personnel records of association or management company employees
• medical records of unit owners
• social security numbers, driver license numbers, and credit card numbers
• emergency contact information, and email addresses, telephone numbers, facsimile numbers, and addresses of an owner other than those the owner provided to the association to fulfill its notice requirements
• information the association obtained in connection with approving the lease, sale, or other transfer of a unit
• the electronic security measures the association uses to safeguard data, including passwords
• the software and operating system that allow the manipulation of data

An owner's name, unit designation, mailing address, property address, and any address, email address, or fax number the owner gave the association for notice purposes are not excluded. They remain accessible to owners.

The statute also states that the data held in an association's software is itself part of the association's official records. Storing a record in BidChex does not put it beyond inspection.

The Association decides what is an official record, what must be produced, and what must be redacted. BidChex does not make those determinations and does not respond to records demands on an Association's behalf. If we receive one, we forward it to the Association.

We use administrative, technical, and physical safeguards designed to protect the information we hold, including encryption of data in transit and at rest, role-based access controls, and logging of access to sensitive records. Access to production data by BidChex personnel is limited to those who need it.

No system is completely secure. Protect your own account: use a unique password, do not share credentials, and tell us at legal@bidchex.com if you believe your account has been compromised.

If we determine that a breach of security has occurred, or have reason to believe one has occurred, affecting personal information we hold for an Association, we will notify that Association as expeditiously as practicable and no later than 10 days after that determination or that belief, consistent with Section 501.171(6), Florida Statutes. The Association is responsible for notifying its residents and any required state authority, and we will give it the information it needs to do so. For accounts held directly with BidChex, we will notify the account holder on the same timeline.

We keep Association records, including violation and package photographs, for at least 7 years, which matches the minimum retention period Florida law sets for most condominium official records.

Some records must be kept permanently under Florida law, including the declaration, articles of incorporation, bylaws, current rules, the minute books, and developer plans, permits, and warranties. We retain those records for as long as the Association uses BidChex and do not delete them at 7 years. An Association may instruct us to keep any record longer.

Connected mailbox content is retained as described in Section 3.

If an Association or a direct account holder stops using BidChex, it may export its data for 30 days after termination. We delete it from active systems within 60 days after that window closes. Backup copies age out on our normal backup cycle.

We keep our own billing and business records for as long as we need them for tax, accounting, and legal purposes.

Depending on where you live, you may have the right to request access to your personal information, correction of inaccurate information, deletion, a portable copy, restriction of processing, or to object to processing. The paragraphs below explain how those rights work on this platform.

Access and correction. You can view and update much of your own profile in the platform. For records held by your Association, ask your Association. We will help it respond.

Deletion. Your Association controls its records and has legal obligations to keep many of them. We will not delete Association records at an individual's request without the Association's instruction, and neither we nor the Association can delete records that Florida law requires be retained. For direct accounts, you may request deletion of your account and its data at bidchex.com/account-deletion-request.

Portability. Associations and direct account holders may export their data in a common machine-readable format.

Payments. You may withdraw an ACH authorization for your own dues by notifying your Association and us in writing. Withdrawing an authorization does not cancel what you owe.

Communications. You can opt out of non-essential emails using the unsubscribe link, and out of SMS as described in Section 4. You cannot opt out of transactional messages such as payment confirmations, security notices, or notices your Association is required to send under its governing documents or Florida law.

Connected mailboxes. You can disconnect a mailbox at any time, as described in Section 3.

Cookies. We use cookies and similar technologies that are necessary to sign you in and keep the platform secure, to remember your preferences and settings, and limited analytics to understand how the platform is used. We do not use advertising cookies. You can control cookies through your browser settings, though disabling them may limit your ability to use some features.

To make a request, contact your Association or email us at legal@bidchex.com. We may need to verify your identity and your relationship to the Association before we act.

BidChex accounts are for adults. You must be at least 18 years old to create a BidChex account, and the platform is not directed to children.

An Association or a resident may list a household member who is a minor as part of a unit record, and may request a building access credential for one. We hold that information because the Association's records require it. We do not collect anything else from or about children, we do not let children create accounts, and we do not use children's information for any purpose beyond the unit record and building access.

If you believe a child's information has been submitted improperly, contact your Association or email us at legal@bidchex.com.

BidChex processes and stores information in the United States. Our subprocessors, listed at bidchex.com/subprocessors, also process and store it in the United States.

If you access the platform from outside the United States, your information will be transferred to and processed in the United States, where data protection law may differ from the law where you live. Where a transfer of personal data out of the European Economic Area, the United Kingdom, or Brazil requires a lawful transfer mechanism, we rely on the European Commission's standard contractual clauses and equivalent mechanisms, together with the safeguards described in Section 10.

We are committed to complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) in the European Union and the United Kingdom, and the Brazilian General Data Protection Law (LGPD).

Where the GDPR or the LGPD applies, an Association is generally the controller of its own records and BidChex is its processor, acting on the Association's documented instructions. For our website, our billing, and accounts held directly with BidChex, we act as controller.

Where we process personal data as a controller, we rely on the following legal bases: performance of a contract, for operating an account and providing the Services; legitimate interests, for security, fraud prevention, support, and improving the platform; consent, for SMS messaging and for connecting a mailbox; and compliance with a legal obligation, where the law requires us to retain or disclose information.

To exercise your data protection rights, or to ask how we handle your personal information, email legal@bidchex.com. We will respond within the timeframe applicable law requires. You also have the right to complain to your local supervisory authority.

We may update this policy. If we make a change that materially affects how we handle personal information, we will post the updated policy with a new effective date and notify Associations and direct account holders at least 30 days in advance. Continued use after the effective date is acceptance.

BidChex, Inc.
1 Century Lane, Apt 602
Miami Beach, FL 33139
legal@bidchex.com