SHELTER CLUBHome

Shelter Club Privacy Policy

Effective date: [DATE]

Shelter Club (“Shelter Club,” “we,” “us,” or “our”) provides tools that help homeowners better understand the visible condition of their homes, review home-related information, compare their home within the Shelter Club community, and request help from home-service professionals.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, how long we retain it, and the choices and rights available to you.

Shelter Club is operated by [LEGAL COMPANY NAME].

1. Information We Collect

The information we collect depends on how you use Shelter Club.

Account information

When you create an account, we may collect:

Authentication is provided through our authentication infrastructure. Shelter Club does not receive or store your password in plaintext.

Home and property information

When you add a home or use a Home Health Check, we may collect:

Please only upload photographs and information that you have the right to provide. Where possible, avoid intentionally including people, neighboring private areas, vehicle license plates, or other unnecessary personal information in your photographs.

Health Check information

When you submit a Home Health Check, we process your photographs and related information to identify and assess visible exterior conditions.

This may produce information such as:

Health Checks may involve automated analysis followed by human review.

Find a Professional information

If you use Find a Professional, we may collect information such as:

Submitting a request does not itself publicly disclose your home information.

If Shelter Club facilitates an introduction to a professional, additional information may be shared as reasonably necessary to facilitate the introduction. We will not sell placement in your recommended matches based on a contractor's willingness to pay for ranking.

Technical and analytics information

When you use Shelter Club, we and our service providers may automatically process limited technical information such as:

We use PostHog for limited product analytics.

For the current version of Shelter Club, our custom analytics are limited to events such as starting or submitting a Health Check, viewing a report or ranking, and submitting a Professional Request. We have disabled PostHog session replay and broad autocapture.

We do not intentionally send names, email addresses, street addresses, home photographs, homeowner concern descriptions, detailed Health Check findings, Professional Request details, or AI prompts and responses as custom PostHog event properties.

Information stored on your device

Shelter Club uses browser storage, including local storage, to support functionality and continuity between sessions.

This may temporarily include account, home, Health Check, report, photograph, and application-state information on the device or browser you use.

Shelter Club clears its locally cached application state when you log out and after successful permanent account deletion. Certain limited preferences, such as whether a ranking reveal has previously been shown, may also be stored locally.

2. How We Use Information

We use personal information to:

We limit our collection and use of personal information to purposes we reasonably consider necessary and appropriate for operating Shelter Club.

3. Artificial Intelligence Processing

Shelter Club uses artificial intelligence to assist with Home Health Checks.

To perform this analysis, Shelter Club may send OpenAI:

Shelter Club currently uses OpenAI's API and configures Health Check requests with storage disabled for Responses API application state.

OpenAI states that API inputs and outputs are not used to train or improve its models by default unless the API customer affirmatively opts into data sharing. OpenAI may nevertheless temporarily retain API content for safety, abuse-monitoring, security, or legal purposes in accordance with its applicable API data practices.

AI-generated information can be incomplete or incorrect. Shelter Club uses human review for Home Health Check results before publishing homeowner-facing results, but human review does not guarantee that every condition will be identified or described correctly.

4. Human Review

Authorized Shelter Club personnel may access submitted photographs, AI-generated observations, assessments, and related information when necessary to:

Access is limited to people who require the information for legitimate Shelter Club purposes.

5. Rankings and Community Features

Shelter Club may compare eligible Home Health Checks to generate city and overall Shelter Club rankings.

The ranking experience may display information such as:

Shelter Club does not use the ranking experience as a public directory of homeowners or properties.

Other users are not provided your name, email address, street address, photographs, or individual Health Check report merely because your home participates in rankings.

Sharing rankings

You may voluntarily create and share a ranking card.

Depending on what you choose to share, the card may contain:

Ranking sharing is initiated by you. Once you share information through another service or publicly, the recipient or third-party service may use that information according to its own practices.

6. Service Providers and Disclosures

We use service providers to operate Shelter Club. These providers may process information on our behalf only for relevant business and operational purposes.

Our current providers include:

Supabase

Provides database, authentication, and file-storage infrastructure. Shelter Club's primary Supabase database is currently hosted in the United States.

Vercel

Hosts and executes portions of the Shelter Club application and server-side functionality in the United States.

OpenAI

Processes photographs, homeowner-provided context, and related information to perform AI-assisted Home Health Checks.

PostHog

Provides limited product analytics and performance measurement. Shelter Club currently uses PostHog's U.S. infrastructure.

Cloudflare

Provides Turnstile bot-detection and security functionality. Cloudflare may process browser, device, network, and security signals necessary to distinguish legitimate users from automated or abusive traffic.

Email service providers

Shelter Club may use a transactional email provider to deliver operational or administrative messages. Shelter Club does not currently send homeowners an email merely because a Home Health Check report has become ready.

We may also disclose personal information:

7. Sale of Personal Information and Advertising

Shelter Club does not currently sell personal information for money.

Shelter Club does not currently use personal information for third-party targeted advertising or cross-context behavioral advertising.

We do not provide home photographs, street addresses, Health Check findings, homeowner concerns, or Professional Request information to data brokers for their independent marketing purposes.

If our practices materially change, we will update this Privacy Policy and provide any choices or notices required by applicable law.

8. International and Cross-Border Processing

Shelter Club serves users in the United States and Canada.

Our infrastructure and service providers operate in the United States and potentially other jurisdictions. In particular, Shelter Club currently uses U.S.-based infrastructure for its primary database, application hosting, analytics, and AI processing.

As a result, personal information belonging to Canadian users may be transferred to, stored in, or processed in the United States or another jurisdiction outside their province or Canada.

When information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement authorities, or governmental authorities in accordance with applicable law.

Where required, Shelter Club uses contractual, technical, organizational, and other measures intended to protect information transferred to service providers.

9. Data Retention

We retain personal information for as long as reasonably necessary to provide Shelter Club, maintain your account, fulfill the purposes described in this Privacy Policy, protect the service, comply with legal obligations, and resolve disputes.

Different categories of information may have different retention periods.

When you permanently delete your Shelter Club account, Shelter Club's deletion process is designed to delete your account and associated private relational data and remove Health Check photographs from Shelter Club's active photo storage.

Some limited information may remain where necessary for legitimate security, fraud-prevention, abuse-prevention, capacity-control, legal, or technical purposes, or temporarily in service-provider backups and logs.

Health Check usage ledger

Shelter Club maintains a minimal internal Health Check usage record used to enforce service limits and prevent abuse.

This record may remain after account deletion and currently contains limited technical identifiers associated with a home and assessment and the date/time analysis was authorized.

It is intentionally designed not to contain your name, email address, street address, user ID, photographs, homeowner concerns, findings, or Home Health Score.

During Shelter Club's beta period, this minimal record may be retained for the duration necessary to preserve beta-wide capacity and anti-abuse controls. We may revise this retention period as those controls change.

10. Account Deletion

You may permanently delete your Shelter Club account through the account settings available in Shelter Club.

For security, we may require authentication or reauthentication before processing deletion.

Following successful permanent account deletion, Shelter Club is designed to:

Certain limited records may remain as described in the Data Retention section.

Deletion from active systems may not result in immediate deletion from all service-provider backups, security logs, or records that must be retained for legitimate legal or security purposes.

11. Security

We use administrative, technical, and organizational safeguards intended to protect personal information.

These include measures such as authentication controls, private file storage, access controls, signed upload mechanisms, bot protection, database access policies, usage controls, and restrictions on administrative access.

No internet service, transmission method, or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

If we become aware of a privacy or security incident involving personal information, we will investigate and provide notifications where required by applicable law.

12. Your Privacy Rights

Depending on where you live and which laws apply, you may have rights regarding your personal information.

These may include rights to:

We will not discriminate against you for exercising privacy rights provided by applicable law.

To make a privacy request, contact us using the information in the Contact Us section.

We may need to verify your identity before fulfilling a request.

13. Canadian Users

If you are in Canada, Shelter Club handles personal information in accordance with applicable Canadian privacy laws, which may include the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector privacy legislation.

Shelter Club is responsible for personal information under its control, including information transferred to service providers for processing.

Where consent is required, we seek to provide information that allows you to understand the nature, purpose, and reasonably foreseeable consequences of the collection, use, or disclosure.

You may contact our Privacy Officer to request access to personal information, challenge its accuracy, ask questions about our practices, withdraw consent where legally available, or make a complaint.

Because Shelter Club uses service providers outside Canada, Canadian personal information may be processed outside Canada as explained in Section 8.

Residents of Quebec, Alberta, British Columbia, and other provinces may have additional rights under applicable provincial privacy legislation.

Nothing in this Privacy Policy limits rights that cannot lawfully be limited.

14. United States Users

Residents of certain U.S. states may have additional rights under state privacy laws where those laws apply to Shelter Club.

Depending on the applicable law, these may include rights to access, correct, delete, or obtain a copy of personal information, and rights relating to certain sales, targeted advertising, profiling, or disclosures.

Shelter Club does not claim that every state privacy statute applies to Shelter Club merely because a user resides in that state. Where a law applies, we will provide the rights required by that law.

Shelter Club does not currently sell personal information for money or use personal information for third-party targeted advertising.

15. Children's Privacy

Shelter Club is intended for adults and is not directed to children under 13.

We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without legally valid authorization, we will take appropriate steps to delete it.

16. Changes to This Privacy Policy

We may update this Privacy Policy as Shelter Club evolves or as legal requirements change.

When we make changes, we will update the effective date at the top of the policy. If a change materially affects how we collect, use, or disclose personal information, we will provide additional notice or obtain consent where required by applicable law.

17. Contact Us

Shelter Club has designated a person responsible for our privacy practices.

Privacy Officer

[LEGAL COMPANY NAME / SHELTER CLUB]

Email: [PRIVACY@SHELTERCLUB DOMAIN]

Mailing address: [BUSINESS MAILING ADDRESS, IF USED]

You may contact our Privacy Officer with:

If we cannot resolve a privacy concern, you may also have the right to contact the privacy or data-protection regulator responsible for your jurisdiction.