Privacy Policy

Privacy Policy for Pony Express HQ and PonyHOA Pony Express HQ and PonyHOA are owned and operated by Pony Express HQ, INC

Last updated: September 17, 2026

1. Who we are and what this covers

This Privacy Policy explains how Pony Express HQ, INC. (“Pony Express,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with our websites and services.

It covers every product we operate, including:

• Pony Express HQ, our SMS outreach and business texting platform; and
• PonyHOA, our community communication and management product for homeowners associations, condo associations, and similar organizations.

PonyHOA is a product of Pony Express HQ, INC., not a separate company.

This Policy applies to the collection and use of Personal Information and other information gathered on websites we own and operate, or that authorized third parties operate on our behalf (the “Sites”), and through the services offered on them (the “Service”). It does not apply to any website owned or operated by a third party, even where we link to it, and it does not cover information we collect by means other than the Sites and the Service.

Capitalized terms used without definition have the meanings given in our Terms of Service.

Two roles. For information about your own account, we are the controller. For the contact directories, member records, and message content our customers load into the Service, we act as a service provider, processing that data on the customer’s behalf and under their instructions. If you are a contact or a member of a community that uses our Service, please direct privacy requests to that organization first; they control the data, and we will assist them in fulfilling your request.

Use of the Service is limited to persons who are of legal age in the jurisdiction in which they reside. You must be at least 18 years old.

2. Information we collect

Account information. Your name, email address, phone number, password hash, role, and the organization you belong to. We also collect account creation dates and the number of times you have signed in. We may collect postal address, billing address, and financial information such as payment card details, which are processed by our payments provider.

Customer Data. The contact or member directory, unit records, messages, campaigns, polls, violations, documents, and other data our customers load into the Service. We process this on the customer’s behalf as a service provider.

Usage, device, and log data. Browser type and name, computer and operating system type, internet service provider, pages viewed, referring and exit pages, platform type, date and time stamps, number of clicks, and IP address. We or our hosting providers use this to analyze trends, administer the Sites, diagnose problems, and understand product usage in aggregate.

Anonymous and aggregated information. Information that does not directly or indirectly identify a particular individual and cannot reasonably be used to do so, including aggregated or de-identified data and clickstream data.

Location information. Certain mobile applications may transmit information about your location when you request services that depend on it. You can control what your mobile device sends by changing its settings.

AI prompts. When you use our AI-assisted composition features, we collect and store the text prompts you provide, for compliance purposes.

Spreadsheet statistics. We may collect anonymous statistics from user spreadsheets. None of the statistics collected contain any information about the contacts in the spreadsheet. This is used strictly to improve our service offering and internal processes.

3. How we collect information

Information you provide. We collect Personal Information when you provide it directly, for example when you request information, products, or services, register an account, complete a form or survey, contact us, or transact with us.

Cookies. We may use cookies, which are small pieces of data stored by your browser, for record-keeping, to save you time, to keep you signed in, to understand how the Sites are used, and to improve our content and offerings. Cookies we use are not linked to Personal Information unless you have given us permission to link them, which you do when you register, transact, or identify yourself through a Site.

Most browsers let you disable or reject cookies through your preferences. If you set your browser to reject cookies, you may not be able to access the Sites or use their full functionality, and you may need to sign in again on each visit. Companies that advertise on our Sites, and organizations we link to, may use their own cookies, which this Policy does not cover.

We do not track our customers over time and across third-party websites to provide targeted advertising, and therefore we do not respond to “Do Not Track” signals. Your selection of the “Do Not Track” option in your browser may not have any effect on our analytics or tracking tools.

Other technologies. We may use local shared objects (sometimes known as Flash cookies) to store preferences and assist with authentication, and pixel tags, web beacons, and similar technologies embedded in images on the Sites or in email communications, which may transmit information to us or to another party on our behalf.

Other websites. Our Sites may link to websites operated by others whose practices differ from ours. We do not control those websites or their business practices, and this Policy does not apply to them. We encourage you to review their privacy policies.

4. How we use information

We use information to:

• provide and maintain the Service, including authentication, message delivery, and billing;
• respond to your questions and requests, and provide customer service;
• send you service-related communications about your account, security, and billing;
• send you email updates, notifications, and information about our products and services, where you have chosen to receive them, with an opt-out in every commercial email;
• monitor for abuse, debug issues, improve product quality, and improve the functionality of the Sites;
• calculate and collect applicable sales, use, or similar taxes based on your account’s billing address, where we are required or authorized to do so; and
• comply with legal obligations, including TCPA consent recordkeeping and tax-related retention.

Financial information. By engaging in activity that uses financial information, you consent to our using it, and to providing it to our service providers and to third parties such as banking institutions, as necessary to process your transactions. Those third parties are authorized to use your financial information in accordance with our contractual arrangements with them and their own privacy policies.

Demographic information. We may use demographic information to tailor the Sites and our communications. We may share anonymous, aggregated demographic information with third parties.

AI prompts. Prompts collected through our AI composition features are used solely for compliance purposes. We do not share these prompts, or the responses generated by our AI provider, with any third party unless required by law.

5. Subprocessors and sharing

We share information only with vetted subprocessors that help us deliver the Service. As of the “Last updated” date above, these include:

• Supabase — managed Postgres, authentication, storage, realtime.
• Twilio — SMS infrastructure and dedicated phone numbers.
• Stripe — payment processing for subscriptions, credits, and dues collection.
• Mailjet — transactional email delivery.
• Mailshake — outbound and welcome email sequences.
• Trigger.dev — background job processing, including message queues and scheduled reminders.
• Cloudflare — DNS, bot protection for public opt-in forms.
• OpenAI — AI-assisted composition and related features, where offered.
• Render and Vercel — application and website hosting.
• PostHog — product analytics.

We may also provide information to other companies (“Agents”) that provide services to help us with our business activities, such as hosting or maintaining the Sites, data processing, website or data security, operational, analytical, or reporting services, or technical support. An Agent may have access to Personal Information in connection with providing those services. Such information is treated as private and confidential by the Agent, will not be used for any purpose other than as we authorize, and will not be disclosed by the Agent to any third party.

We do not sell personal information. We do not share Customer Data with third parties for advertising purposes.

Mobile information. No mobile information, including SMS opt-in data and consent, will be shared with third parties or affiliates for marketing or promotional purposes.

Legal disclosure. We may disclose Personal Information when required by subpoena, court order, or other legal process, or where we have a good-faith belief that disclosure is necessary to comply with applicable law, assist government enforcement agencies, investigate or prevent suspected or actual illegal activity, investigate suspected violations of our rights, protect the rights, property, or safety of Pony Express and its customers or employees or others, defend against third-party claims, or protect the security and integrity of our Sites.

Business transfers. We consider the information you provide to be a business asset. We may disclose Personal Information and other information to a third party in connection with the sale, assignment, or transfer of some or all of our assets, or as the result of a change in control, in which case we will require that third party to treat the information in accordance with this Policy.

We reserve the right to use and disclose anonymized information, aggregated information, or publicly available information that has not been combined with nonpublic Personal Information, including for internal use and research.

6. Storage, security, and location

Customer Data is stored in managed Postgres with encryption in transit (TLS) and at rest (AES-256). Passwords are hashed and salted; we never store plaintext passwords. Our infrastructure is hosted in the United States.

We take reasonable precautions to protect Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, and we have put in place reasonable and appropriate physical, electronic, and managerial procedures to do so. Our security and privacy practices are reviewed periodically. No security measure guarantees the security of all Personal Information, and we cannot guarantee that information will be protected in all circumstances, including those beyond our reasonable control.

Your information may be transferred to and maintained on computer networks located outside the state, province, or country in which you reside, and that jurisdiction may not have privacy laws as protective as those in your own. International transfers from outside the United States are subject to applicable safeguards.

Account and password security. It is your responsibility to safeguard your Credentials and monitor their use. You agree to notify us immediately of any unauthorized use or other breach of security, to exit your account completely at the end of each session, and to notify us if you lose your Credentials or wish to terminate your access.

Breach notification. For the purposes of any applicable law regarding notification of persons whose Personal Information was, or is reasonably believed to have been, acquired by an unauthorized person, any required notification may, where permitted by law, be made by email, telephone, fax, or mail, including a notice printed in an available area of a bill or statement, or by posting a notice on the Site. The specific means used are up to us, based on the circumstances, and we will use the latest address in our records.

7. Retention

• Financial records (assessments, payments, invoices): retained for 7 years to meet IRS requirements.
• SMS consent records: retained for at least 5 years for TCPA recordkeeping.
• Active account and member data: retained while the subscription is active.
• After cancellation: Customer Data is purged 30 days after the subscription ends, except where retention is required by law or covered by an active audit hold.
• Departed members in PonyHOA: never hard-deleted; anonymized after the retention window.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing.

If your Personal Information changes, or you believe our records are incorrect and you cannot correct them by signing into your account, contact us at support@ponyexpresshq.com and we will attempt to accommodate all reasonable requests.

Marketing choices. If you no longer wish to receive promotional materials, sign in and modify your account settings, or use the opt-out instructions in any email you receive from us. If you are still receiving promotional materials 30 days after modifying your settings, contact us directly. Our compliance may involve batch processing that takes 30 days or longer. Note that you may not opt out of service communications necessary to the operation of your account, and that changing or deleting your information will not change or delete information collected under a Customer Agreement or already recorded in our transactions database.

Your rights under the GDPR. We collect the minimum amount of information needed to provide the products and services requested, on the basis of our legitimate interest. You may: be informed whether we store your data; be granted access to it (see GDPR Article 15); correct errors in our records; request erasure; restrict our processing, meaning we continue to store your data but do not use it; object to our use of it; request that the data we hold be provided to you or another service (see GDPR Article 20); and not be subject to decisions based entirely on automated processing.

Exercising some of these rights may interfere with our ability to provide the Service. For instance, if you request erasure, information about your purchase history will also be removed.

Your rights under the CCPA. For California residents, in addition to the rights above, you have the right to request information about how we collect, store, and share your Personal Information with third parties. You may submit a request to receive: the categories of information, and your specific Personal Information, that we have collected and stored; the categories of information, and specific Personal Information, disclosed to third parties for their direct marketing purposes during the preceding calendar year; the name and address of third parties that may have received your information; whether the nature of a third party’s business can be determined from its name or from examples of what it markets; and a copy of this information in a standardized format.

Upon request, we will delete your Personal Information unless there is a legitimate business purpose for which we are required to retain it. If you exercise any of these rights, you will still receive the same service and pricing as consumers who do not.

To exercise any right, write to support@ponyexpresshq.com. You can update your email address and change your password directly from the Service without sending an email.

9. Children

The Service is not directed to children under 13, or under 16 in some jurisdictions. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes to this Policy

We may change, modify, or update this Privacy Policy at any time. The “Last updated” date above indicates when it was last revised. For material changes, we will notify customers by email or in-product notice. Continued use of the Sites or the Service after a revision constitutes acceptance of the revised Policy.

11. Contact

Questions or concerns about this Privacy Policy, the practices of the Sites, or your dealings with us can be sent to support@ponyexpresshq.com, or through our contact page.

Pony Express HQ, INC. San Mateo, California