Privacy policy

1. Information We Collect

Amenity Reserve™ is a VendoRFP product, not a separate company. This policy is published by VendoRFP Inc., a Delaware corporation. It covers amenityreserve.com and app.amenityreserve.com.

From residents. Your community gives us your name, email address and street address when it adds you to its resident list, or you give us your name and address when you ask to join. We keep which household you belong to (one address, however many people live there), whether you own or rent, and your standing with the community.

When you book, we keep the space, the date and time, how many guests are coming, your answers to the questions your community asks, and where the booking stands: requested, confirmed, declined, cancelled or completed.

When you agree to a space’s house rules, we keep a record of it: which version of the rules you agreed to, a SHA-256 fingerprint of the exact rule text you were shown, and the time you agreed. With it we store the first part of your IP address (the first three numbers of an IPv4 address, the first 48 bits of an IPv6 address, never the whole address) and the first 200 characters of your browser’s user-agent string. Where your community asks for a signature, the record also holds the name you typed and the initials you entered beside each rule. Nobody can edit or delete this record afterwards, including us.

From community admins. When you set up a community we keep its name, street address, the kind of community it is, its time zone and your role, and the spaces, rules, fees and approval settings you publish. If you name an attendant company for a space, we keep the email address its notices go to. When you connect Stripe to collect payments, Stripe collects your organization’s business and bank details on its own pages. We keep only the reference of the Stripe account that is connected.

From everyone. You sign in with a one-time link sent to your email address, so we keep the email address on your account. Your sign-in is the same VendoRFP account that HOAcrew uses. If you write to us through the contact form, your name, email address, your community’s name and kind, and your message reach us by email. The form does not store them in our database.

2. How We Use Your Information

We use this information to run your community’s bookings. That means checking each request against the rules, keeping the calendar, sending the emails a booking needs, collecting fees where your community charges them and keeping the record of what was agreed. We do not sell personal information.

The emails we send are about your own sign-ins and bookings: sign-in links, requests and decisions, cancellations, and payment notices. Amenity Reserve sends no marketing email.

3. Cookies and Browser Storage

We set three first-party cookies and no advertising cookies. There are no advertising trackers and no data brokers anywhere in this product, and nothing we set follows you to another site. Each one is kept for app.amenityreserve.com, where you sign in. The marketing pages at amenityreserve.com set none.

• Your sign-in session. sb-…-auth-token

  Set when you open your sign-in link, so the app knows who you are on each page. It holds your session and nothing else, and a long session may be split across a few numbered cookies with the same name. Strictly necessary. The app cannot work without it.

  How long: Up to 400 days, or until you sign out, which deletes it.

• A one-time security code while you open another VendoRFP app. __Host-vfp-handoff

  Set for at most five minutes when you move from one of our apps to another, so the app you are opening signs in only the browser that asked. Scripts on our pages cannot read it, and it is deleted the moment you arrive. Strictly necessary for that one step. It is first-party and is never used for tracking.

  How long: About five minutes at most, and deleted on arrival.

• Which community the console shows. ar_c

  Set only for admins who run more than one community, when they pick one in the console. It holds that community’s reference and is sent only to console pages. It is a convenience: your permission for that community is checked again on every request.

  How long: One year from the last time you picked a community.

We keep nothing else on your device. Amenity Reserve uses no local storage, session storage or other browser database. When you pay a fee, you enter your card on Stripe’s own checkout page, and anything Stripe stores there is covered by Stripe’s privacy policy.

We run no traffic analytics. That is why you are not being asked to dismiss a cookie banner on this site. See section 4.

4. Traffic and Performance Analytics

Amenity Reserve does not run traffic or performance analytics. No analytics script loads on amenityreserve.com or app.amenityreserve.com, so no page view, device detail or identifier is sent to an analytics provider.

When a link on one of our pages leads to another site, your browser sends that site only our site’s name and never the rest of the address, because every page tells your browser to send no more than that. Very old or unusual browsers that ignore that instruction could send more.

If we add analytics, this section changes in the same release, before it runs.

5. Error Monitoring and Server Logs

Amenity Reserve does not use an error-monitoring service. When something fails on our servers, our software writes a line about the failure to our hosting provider’s logs, and the hosting provider keeps its own record of the requests it served. Those logs stay with Vercel, our hosting provider, and are not forwarded to any other service.

The lines our software writes are meant to name the failure, such as an error code or a booking reference, and not what you typed. That describes how the code is written. We have not built a check that proves no line ever carries more, so we state it here as observed rather than enforced.

If we add error monitoring, this section changes in the same release, before it runs.

6. Who Sees Your Information

Your community’s admins see their own community’s resident list, every booking and every signed agreement. Admins are the community’s main contact, board members or managers who have been given permission to run reservations, and managers at the management company that runs the community when that company allows it. VendoRFP’s own platform administrators can also see these records to support the service.

You see your own entry on the list, your own bookings and your own signed agreements.

Other residents never see who booked. When a resident looks for a free time, they see which times are taken, never by whom.

An attendant company, if your community names one for a space, is emailed when a booking that needs an attendant is confirmed or cancelled. It gets the date, the space, the number of guests and a booking name made of your first name and the first letter of your last name. It never gets your address or email address.

Community admins see your name and address in the emails about your requests.

7. Service Providers

We share a resident’s information with that resident’s own community, as section 6 describes. Beyond that, these are every third party that processes data on our behalf, and what each one is for:

• Supabase. The database and authentication behind the platform.
• Vercel. Hosting, and the server logs described in section 5.
• Stripe. Payments. Card details go to Stripe directly and are never stored on our servers.
• Resend. Sending transactional email such as sign-in links, booking notices and payment notices.
• Upstash. Short-lived rate limiting, counted against your network address or a one-way fingerprint of your email address.

Card payments. Where your community charges a fee for a booking, Stripe processes the card payment. You enter your card on Stripe’s hosted checkout page, so card numbers never reach Amenity Reserve’s servers. Residents pay through VendoRFP, which processes each payment with Stripe and transfers it to your community’s own Stripe account. To collect it, Stripe keeps a customer record for you with your email address and saves your card for that booking, so a fee can be charged when the community approves your request.

We do not sell personal information to third parties and we do not share it with advertisers. Aggregate, non-identifying figures may be used to describe platform activity.

8. Data Security

We encrypt data in transit and at rest, and the rules deciding who may read a row are enforced in the database itself rather than in the page that renders it. The same rules keep each community’s records apart from every other community’s. Signed agreements and published versions of the rules are append-only: the database refuses to edit or delete them for every caller, our own servers included.

9. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting us at admin@vendorfp.com. You may opt out of non-essential communications at any time. Some jurisdictions give you additional rights, including the EU, the UK and US states with a comprehensive privacy law. Write to the same address and we will act on the request.

How long we keep it. There is no automatic deletion schedule. Your entry on a community’s list and your bookings are kept while your community uses Amenity Reserve. A signed agreement cannot be deleted by anyone, including us, because it is your community’s record of what was agreed. When you ask us to delete your data, we tell you what we deleted and what we could not.

10. Changes to This Policy

This page is rewritten as one current statement rather than added to, so what you are reading is what the product does today. When we add a tool that receives data, this page changes in the same release. A policy that is out of date the moment we deploy is not a policy. The same rule applies in the other direction: when we stop doing something, this page says so rather than quietly dropping the paragraph.

11. Contact

For privacy-related inquiries, contact us at admin@vendorfp.com.