Privacy Policy

Candoa LLC ("Candoa", "we") runs software that union locals use to keep their records. This page explains what we keep and what we do with it.

Two kinds of information

Records a local keeps in Candoa. Members, employers, contracts, grievances, dues, messages and documents belong to the local. We hold them on the local's behalf and use them only to run the service for that local. We do not sell them, share them with employers or other locals, or use them for advertising.

Information about the people who use Candoa. Staff names, email addresses, sign-in activity (including the approximate location of a sign-in, so you can spot one that isn't yours), and the settings they choose. We use it to sign people in, keep accounts secure, and send the emails the service needs.

Payments

Card payments are handled by Stripe. Candoa never sees or stores card numbers.

Eli

When someone asks Eli a question, the question and the records Eli needs to answer it are sent to the AI model that writes the reply. The providers we use do not train their models on this data. Eli's use is counted so the local can see it against its plan.

Calls and texts

Texts are sent through Telnyx from the local's own number. When a local records a call so Eli can write notes, the recording is turned into text and the audio is not kept by Candoa. A local that keeps Eli away from member details has its calls left unrecorded.

Who helps us run Candoa

• Vercel — hosting, file storage and anonymous page analytics
• Neon — the database, in the United States
• Stripe — payments
• Resend — email
• Telnyx — texts and calls
• Anthropic and OpenAI, through Vercel's AI Gateway — Eli's replies, search and call transcripts
• Google — address suggestions while typing an address

Each receives only what it needs for its part.

Where data is kept

Records are stored in the United States and travel over encrypted connections.

How long we keep it

We keep a local's records while its account is open. After a local cancels, we keep them for 90 days so it can come back or export them, then delete them. A local can ask us to delete them sooner at support@candoa.app.

Your choices

• A local can export its roster, employers and reports at any time.
• A member who wants to see, correct or remove what their local holds about them should ask their local, which controls those records. We will help the local answer.
• A staff member can ask us about their own account at support@candoa.app.
• Anyone texted by a local can reply STOP to stop receiving texts.

Security

Every person signs in as themselves, can turn on two-step sign-in, and sees only what their permissions allow. Changes to a member's record are logged with who made them and when.

Children

Candoa is for union locals and their staff, and is not meant for children under 13.

Changes

We will post changes here and email the owner of each local about material ones.

Contact

Candoa LLC, 1730 Windsor Avenue, Lancaster, PA 17601 · support@candoa.app