Effective date: October 20, 2026 · habitatHQ by Fullstakrs LLC / Commonweal
habitatHQ is a wildlife and animal care management platform operated by Fullstakrs LLC d/b/a Commonweal ("we," "us," or "our"), based in Connecticut, USA. Each instance of habitatHQ is deployed by and for an independent organization ("Organization"). Your relationship is both with habitatHQ and with the Organization that manages your account.
This policy applies to personal data collected through the habitatHQ web application, including all subdomains (e.g., yourorg.habitathq.org). It does not apply to third-party services linked from the platform.
Account data: name, email address, role, phone number, and a hashed password. Passwords are never stored in plaintext and are validated against the HaveIBeenPwned breach database at creation time using k-anonymity (only the first 5 characters of a SHA-1 hash are transmitted).
Animal care records: animal profiles, medical records, medications, lab results, feeding schedules, care logs, checklists, tasks, and shift records entered by your Organization's staff. This data belongs to your Organization.
Usage data: an audit log of actions taken within the platform (who did what and when), used for compliance and accountability purposes.
Technical data: IP addresses and browser information captured in standard server access logs, retained for up to 90 days.
Uploaded files: photos, videos, and documents attached to animal records. These are stored on the server hosting your Organization's deployment.
Where applicable, we process personal data under the following lawful bases:
We do not sell your personal data. We share data only with:
habitatHQ is hosted in the United States. If you are located in the European Economic Area, United Kingdom, or other jurisdictions with data transfer restrictions, your data is transferred to the US under applicable legal mechanisms. Where third-party processors (Anthropic, Google, SignalWire) are involved, those transfers are subject to their respective data processing agreements and standard contractual clauses.
Account and animal care data is retained for as long as your Organization's deployment is active. When an Organization's deployment is decommissioned, data is deleted within 30 days unless a longer retention period is required by law or requested by the Organization for archival purposes.
Audit logs are retained for a minimum of 12 months. Server access logs are retained for 90 days.
Depending on your jurisdiction, you may have the right to:
To exercise these rights, contact your Organization's administrator or contact us directly at the address below. We will respond within 30 days.
We implement reasonable technical and organizational measures to protect your data, including hashed passwords, TLS encryption in transit, access controls, and audit logging. No system is completely secure; we will notify affected Organizations of any confirmed data breach without undue delay and in accordance with applicable law.
habitatHQ is not directed at children under 13 (or 16 where applicable under GDPR). We do not knowingly collect personal data from children. If you believe a child's data has been submitted, please contact us for immediate removal.
California residents may request disclosure of the categories and specific pieces of personal information we have collected, the sources of that information, the business purpose for collection, and any third parties with whom we share it. We do not sell or share personal information for cross-context behavioral advertising. To submit a request, contact us at the address below.
We may update this policy from time to time. Material changes will be communicated to Organization administrators with at least 30 days' notice before taking effect. Continued use of the platform after the effective date constitutes acceptance.
Fullstakrs LLC d/b/a Commonweal
Connecticut, USA
privacy@habitathq.org