Privacy Policy
Revision: 2026.09.14
Last updated: 14 September 2026
This Privacy Policy (“Policy”) describes how Hearth and Hall, LLC collects, uses, and shares personal information in connection with Hearth & Hall.
Related: Terms of Service | Platform Pricing
1. Who we are
Hearth and Hall, LLC (“Hearth & Hall,” “we,” “us,” or “our”) operates the Hearth & Hall multi-tenant software-as-a-service platform for member organizations (private clubs, lodges, associations, and similar groups), including the public marketing site and the authenticated product application (the “Service”).
Contact for privacy questions: legal@hearthandhall.app.
Privacy / legal notices: legal@hearthandhall.app.
2. Scope
This Policy describes how we collect, use, disclose, and retain personal information in connection with:
| Surface | Examples |
|---|---|
Marketing site (www.) |
Browsing, contact form inquiries (when enabled). |
Product app (members.) |
Accounts, organization membership, roster, forums, events, reservations, documents, billing. |
| APIs and email | Authentication, transactional and organization-initiated email. |
| Payments | Platform fees owed to us; member dues collected for Organizations via Stripe Connect. |
This Policy does not cover:
- An Organization’s own websites, offline practices, or third-party tools it chooses outside the Service.
- How an Organization uses member data under its bylaws or internal policies (Organizations are responsible for their own notices to members where required).
- Stripe’s processing of payment data under Stripe’s own terms and privacy notices.
3. Roles: Organizations and Hearth & Hall
Hearth & Hall is a multi-tenant platform. Personal information is typically associated with an Organization (tenant).
| Role | Description |
|---|---|
| Organization as controller | The club or association decides why membership, billing, documents, and communications data are processed for its members, guests, and staff. |
| Hearth & Hall as service provider | We process Organization-related personal data to provide, secure, and support the Service under our Terms and any DPA. |
| Hearth & Hall as controller for platform data | Account credentials we manage, platform billing contacts, marketing-site inquiries, security logs, and similar data we collect for our own operations. |
Where required, we will make available a data processing addendum (DPA) or similar terms.
4. Personal information we collect
4.1 Information you or your Organization provide
| Category | Examples |
|---|---|
| Account & identity | Name, email address, password (hashed), profile fields the product supports. |
| Organization & membership | Organization name, membership type, household / bill-to relationships, roles, Admin flag, invite status. |
| Communications | Forum posts, announcements, mailing-list messages, contact-form contents, support correspondence. |
| Events & reservations | Event registration, booking details, guest information entered by authorized users. |
| Documents | Files and metadata uploaded to the document library (may include personal data in the file contents). |
| Billing (org -> platform) | Billing contact, invoices for platform fees, fee-exemption flags, payment status. |
| Billing (member -> org) | Invoice and estimate line items, amounts, payment status; payment method tokens (not full card PANs) when members pay through Stripe-powered flows. |
4.2 Information collected automatically
| Category | Examples |
|---|---|
| Technical | IP address, browser/user-agent, and device type (we log IP addresses; we do not derive approximate location from IP today). |
| Usage | Pages and features used, timestamps, referrers on the marketing site. |
| Security & audit | Sign-in success/failure/lockout, password reset events, role and membership changes, invoice void/refund, document upload/delete, Terms acceptance - stored as durable audit events where the product records them. |
| Cookies / similar | Session and authentication cookies for the product application; marketing and analytics cookies may be used on the public marketing site only (not on the members / platform application). |
4.3 Information from service providers
We receive limited information from providers that help us operate the Service (for example, payment confirmation and Connect onboarding status from Stripe; email delivery events from our transactional email provider; bot-check results from Cloudflare Turnstile on the contact form).
4.4 Sensitive / regulated data
The Service is designed for ordinary club membership, operations, and billing records. Do not use it to store categories of data we have not agreed in writing to support (for example, certain health records or raw payment card data). Organizations are responsible for not uploading prohibited data.
5. How we use personal information
We use personal information to:
- Provide the Service - authenticate users, enforce organization tenancy and permissions, run membership, reservations, events, documents, forums, and billing features.
- Process payments - platform fees owed to Hearth & Hall; facilitate Organization member payments through Stripe (including Connect payouts to Organizations where enabled).
- Communicate - transactional email (invites, password reset, invoice notices); organization-initiated mailing lists and announcements; replies to marketing contact inquiries.
- Secure and operate - prevent abuse, enforce rate limits, investigate incidents, maintain audit trails, back up systems.
- Improve - understand feature usage in aggregate; fix bugs; develop new capabilities.
- Comply with law - respond to lawful requests; meet tax and accounting obligations.
- Enforce agreements - Terms of Service, acceptable use, and related policies.
We do not sell or share personal information.
6. How we disclose personal information
We may disclose personal information to:
| Recipient | Purpose |
|---|---|
| Your Organization’s authorized users | Roster, forums, documents, billing, and other features according to roles and ACLs the Organization configures. |
| Service providers (subprocessors) | Hosting, email delivery, error/ops monitoring, payment processing, bot protection - under contracts that restrict use to providing services to us. |
| Stripe | Payment processing and Connect; card and bank details are handled by Stripe under Stripe’s terms. |
| Professional advisors | Lawyers, accountants, insurers, as needed. |
| Authorities | When required by law, legal process, or to protect rights, safety, and security. |
| Business transfers | In connection with a merger, acquisition, or sale of assets, subject to appropriate protections. |
We do not disclose one Organization’s member data to another Organization except as directed by authorized users or required by law.
Subprocessors. A current list of material subprocessors is available on request to legal@hearthandhall.app.
7. International transfers
We may process and store personal information in the United States and other countries where we or our providers operate. Where required, we will use appropriate transfer mechanisms.
8. Retention
| Data class. | Retention approach. |
|---|---|
| Active account & membership | For the life of the account / membership, plus a thirty (30) day wind-down period after deactivation. |
| Billing & payment records | As needed for tax, accounting, and dispute resolution for seven (7) years. |
| Documents | Per Organization retention / legal-hold settings and product behavior; backups may persist for a limited period after deletion. |
| Audit events | Retained as operational security and compliance aids for seven (7) years. |
| Marketing contact inquiries | Retained for seven (7) years. |
| Backups | Rolling backup cycles; deletion from the live Service does not guarantee immediate erasure from all backup media. |
Organizations are responsible for choosing document retention that meets their legal and governance obligations.
9. Security
We implement administrative, technical, and organizational measures appropriate to the nature of the Service, including authentication, organization-scoped authorization, encrypted transport (TLS), and infrastructure controls. No method of transmission or storage is perfectly secure.
Cardholder data and Organization bank details collected through Stripe-hosted or embedded flows are handled by Stripe; the Service stores payment method tokens, not full PANs or bank account numbers entered in those flows.
10. Your choices and rights
10.1 Account and Organization controls
- Update profile and password through the product (where available).
- Organization Admins (and users with relevant permissions) manage roster, roles, invites, document ACLs, and billing settings for their tenant.
- You may request closure of your account by contacting us or your Organization Admin, as applicable.
10.2 Marketing contact
When the public contact form is enabled, you choose what to submit. We use that information to respond to your inquiry.
10.3 Privacy rights (jurisdiction-dependent)
Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to certain processing, or to opt out of certain “sales” / targeted advertising.
- For data your Organization controls (roster, documents, club billing), contact your Organization first; we will assist the Organization as service provider where appropriate.
- For data we control as platform operator (for example, your login account with us, or a marketing inquiry), contact legal@hearthandhall.app.
We will not discriminate against you for exercising privacy rights. We may need to verify your request and may retain certain records as required by law or our Terms (for example, Terms acceptance history, invoices).
11. Children
The Service is intended for organizational and adult use. Organizations may authorize family or minor-related sub-accounts where the product supports them; Organizations are responsible for compliance with laws governing children’s data. We do not knowingly collect personal information directly from children under sixteen (16) for our own marketing purposes. If you believe we have collected such information improperly, contact us and we will take appropriate steps.
12. Cookies and similar technologies
| Type | Purpose |
|---|---|
| Essential | Sign-in session, security, load balancing, CSRF / similar protections in the members / platform application. |
| Analytics | Marketing and analytics cookies on the public marketing site only; not used in the members / platform application. |
| Advertising | None. |
You can control cookies through your browser settings; blocking essential cookies may prevent the product from working.
Turnstile (Cloudflare) may set or read cookies / local storage as part of bot protection on the contact form when that form is enabled.
13. Third-party links and services
The Service may link to third-party sites or embed third-party flows (for example, Stripe). Their privacy practices are governed by their own policies.
14. Changes to this Policy
We may update this Policy from time to time. Material changes will be indicated by updating the revision and Last updated date on this page and, where appropriate, by notice to Organization contacts or in-product notice. Continued use after the effective date may constitute acceptance where permitted by law; material changes that accompany a Terms revision are accepted through the product Terms acceptance flow described in the Terms of Service.
15. Contact
Privacy questions or requests: legal@hearthandhall.app
Hearth and Hall, LLC