Privacy Policy
**ChamberBuilder is a service operated by Abec Enterprises USA (“ChamberBuilder,” “Company,” “we,” “our,” or “us”).
Overview
This Privacy Policy describes how ChamberBuilder ("we", "us", "our") collects, uses, and shares personal information when you use our software-as-a-service platform (the "Service"). It applies to our customers (chambers of commerce and similar organizations), their staff and members, and visitors to our public websites.
This policy does not apply to the relationship between an organization and its own members. When an organization uses our Service to manage its member roster, send communications, or collect dues, the organization is the data controller for that information, and we act as a processor on the organization's behalf. See the Data Processing Agreement at /dpa for details.
What we collect
We collect only what we need to run the Service.
- Account information: name, email, password (hashed), role, and the organization you belong to.
- Billing information: company name, billing contact, and payment card details (payment card data is handled by Stripe; we never see the full card number).
- Usage and device data: IP address, browser type, pages visited, and timestamps. Used for diagnostics, rate-limiting, and fraud prevention.
- Cookies: see our Cookie Policy at
/cookies. - Content you submit: support messages, feedback, and anything else you type into a form.
How we use it
- To deliver, operate, and improve the Service.
- To authenticate you and keep your account secure.
- To bill you and process payments.
- To send transactional messages (receipts, password resets, security alerts).
- To respond to support requests.
- To detect and prevent abuse.
- To comply with legal obligations.
We do not sell personal information, and we do not use it to train AI models that benefit third parties outside the Service.
Third parties
We share personal information with service providers who help us run the Service. These providers are contractually bound to use your data only for the purposes we specify. Our current sub-processors — Stripe, Postmark, Twilio, OpenAI, Cloudflare, Hetzner, and Honeybadger — are listed at /subprocessors with the type of data each one handles.
Retention
We keep your account information while your account is active and for 90 days after cancellation to support recovery. Transactional records (invoices, payments) are retained for seven years to satisfy tax and accounting requirements, in line with U.S. federal and California law.
Content inside an organization's workspace (member records, events, communications) is retained on the organization's instructions. Customers can delete individual records at any time through the admin console and can request full-tenant deletion on termination.
Your rights
Depending on where you live, you may have the following rights with respect to personal information about you:
- Access: obtain a copy of what we hold.
- Correction: fix inaccurate information.
- Deletion: request erasure of your data.
- Portability: receive your data in a machine-readable format.
- Objection and restriction: limit certain processing activities.
To exercise these rights as an organization member, start at /portal/data_export or /portal/data_deletion inside your organization's workspace. For platform-level requests, email [email protected]. We will respond within 30 days (or sooner if required by law).
California residents have additional rights under the CCPA and CPRA, including the right to know what categories of personal information we collect and the right to non-discrimination for exercising these rights. We do not "sell" or "share" personal information as those terms are defined under California law.
International transfers
Our primary application infrastructure is hosted with Hetzner in Germany; some sub-processors are located in the United States. By using the Service you consent to the transfer of your information to these jurisdictions. Where required, transfers are protected by Standard Contractual Clauses or equivalent legal mechanisms.
Children
The Service is not directed to children under 13 and we do not knowingly collect personal information from them.
SMS/Text messaging
When you opt in to receive SMS text messages from ChamberBuilder, you consent to receive messages such as account notifications, two-factor authentication codes, event reminders, and membership updates. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP; reply HELP for assistance. Mobile opt-in information and phone numbers are not shared or sold to third parties or affiliates for their marketing purposes. See our SMS Terms for details.
QuickBooks Online
If your organization chooses to connect QuickBooks Online, ChamberBuilder accesses your QuickBooks company only to do what the integration is built for:
- What we send to QuickBooks: your members as customers (name, email, phone, and billing address), the products/services your organization sells, and the invoices, payments, refunds, and bank deposits recorded in ChamberBuilder.
- What we read from QuickBooks: your chart of accounts, so you can choose where each type of revenue is posted, and existing customers and products/services, so we don't create duplicates.
- How we protect it: the connection is authorized by you through Intuit's own sign-in. We store the access credentials encrypted, and we use them only from our servers, never in your browser.
- Who sees it: QuickBooks information is visible only to your organization's administrators, and to our support staff when you ask for help. We never sell it, share it with other customers, or use it for advertising or to train AI models.
- Disconnecting: you can disconnect at any time from Settings → Integrations in ChamberBuilder, or from within QuickBooks. When you do, we revoke our access and stop sending data. Records already created in QuickBooks stay in your QuickBooks company.
Intuit and QuickBooks are trademarks of Intuit Inc. ChamberBuilder is not affiliated with or endorsed by Intuit.
Changes
We will notify you of material changes to this policy at least 30 days before they take effect. The effective date at the top of the document reflects the current version.
Contact
Privacy questions, requests, and complaints: [email protected].