Effective date:  September 8, 2026

Adopted by: Board of Directors of St. Francis Homes Association on September 8, 2026

Posted at: https://www.stfranciswood.org/alpr-policy

 

St. Francis Homes Association (the “Association”) has operated and used an automated license plate recognition (“ALPR”) system on public rights of way within the St. Francis Wood neighborhood of San Francisco. The Association adopts and publishes this policy under California Civil Code sections 1798.90.5 through 1798.90.55 to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individual privacy and civil liberties. The Association posts this policy conspicuously on its website so that members of the public can review it. The policy represents the Association’s judgment about the necessary balance between privacy, transparency, and security.

​

1. Definitions

The terms “ALPR system,” “ALPR information,” “Operator,” and “End-user” have the meanings given in California Civil Code section 1798.90.5. “ALPR information” includes license plate numbers, vehicle characteristics, time-stamped records, and location data captured by the ALPR system. The ALPR systems used do not capture live video or audio or engage in facial recognition or biometric identification. The ALPR systems are designed solely to identify vehicles.

​

2. Authorized purposes for collecting, using, and sharing ALPR information

The Association operates the ALPR system, and collects and makes ALPR information available, only for the following purposes:

• As a service to the community, to protect the safety, security, and property of all who live in or pass through the St. Francis Wood neighborhood by capturing reliable information about vehicle movements that law enforcement may obtain upon lawful request.

• As a service to capture information to assist law enforcement in investigating incidents of suspected criminal activity (including in recovering stolen vehicles, identifying vehicles suspected of involvement in criminal activity, allowing more efficient responses, and locating missing or at-risk individuals).

• As a service to capture information in order to respond to a valid warrant, subpoena, court order, or other lawful process.

The Association does not collect or make available ALPR information for any other purpose.

The Association does not use any ALPR information for any non-public purpose. The Association will not use ALPR information to harass, intimidate, or track any individual; to interfere with the exercise of rights protected by the First Amendment; or for any personal, private, or commercial use. The ALPR system is not capable of generalized or continuous monitoring of an individual’s movements.

The Association does not have any memorandum of understanding or sharing relationships with any particular law enforcement or other agencies.

​

3. Authorized personnel and training

Access to ALPR information is limited to the following, each individually authorized in writing:

• The Chair of the Board’s Security Committee or any Board member the Board designates for this purpose as a Custodian (as defined in Section 6 below).

Before receiving access, and at least annually thereafter, each authorized person must complete training on this policy and on the requirements of California’s ALPR law, and must sign an acknowledgment that access is limited to the authorized purposes in Section 2. The Association will maintain records of who is authorized and of training completed.

​

4. Monitoring, security compliance, and audits

The Association maintains reasonable security procedures and practices to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. Flock, as the provider of the ALPR system, maintains the operational, administrative, technical, and physical safeguards that secure ALPR information, including access controls, individual credentials, protection against unauthorized access, and enforcement of the retention period. The Association’s role is oversight. The ALPR Data Custodian monitors compliance with this policy and with applicable privacy laws by reviewing the records of access and sharing described in Section 9, verifying that Flock’s configuration settings remain consistent with this policy, and promptly investigating any access or sharing that appears inconsistent with it. The Association conducts this review, and audits ALPR access and sharing, periodically and at least annually.

​

5. Sale, sharing, and transfer of ALPR information

The Association does not sell ALPR information under any circumstances. The Association does not share or transfer ALPR information except as follows, and it logs every instance of sharing:

• To law enforcement, which may access ALPR information through the system, or receive it from the Association, in response to a reasonable request, valid warrant, court order, or other legally binding process, or as otherwise required by law.

• To Flock as necessary to operate the system, subject to contractual restrictions consistent with this policy. The Association neither grants nor permits access to its ALPR information by any other non-law enforcement third party.

​

6. Custodian of ALPR information

The ALPR Data Custodian, a position held by the Chair of the Board’s Security Committee, is the official Custodian and owner of the Association’s ALPR information and is responsible for implementing this policy. The Custodian implements the Association’s role-based access controls, individual credentials, restrictions on downloading or copying records, and periodic review of Flock’s security configuration.

​

7. Accuracy of ALPR information and correction of errors

The Association relies on Flock to ensure the accuracy of ALPR information. Nevertheless, any person who believes that ALPR information about their vehicle is inaccurate may contact the ALPR Data Custodian at the address in Section 10 to request review and correction.

​

8. Retention and destruction

The Association will designate that ALPR information be retained for 30 days. Retention protocols and parameters are enforced through the Flock system configuration and data is automatically deleted upon expiration of the retention period unless preserved pursuant to policy, a legal preservation obligation, or as evidence in an active criminal investigation. Flock is responsible for implementing the retention and deletion protocols chosen by the Association.

​

9. Record of access

When ALPR information is accessed, or access is provided to it, the Association maintains a record of that access. Each record includes, at a minimum, the date and time the information was accessed, the license plate number or other data elements used to query the system, the username of the person who accessed the information and, where applicable, the organization or entity with which that person is affiliated, and the purpose for the access. Flock’s portal logs access made through the system, and the Association records access made directly to it. ALPR information may be used only for the authorized purposes described in Section 2. The Association retains these access records for one year and reviews them as part of the audits described in Section 4.

​

10. Public availability and contact

This policy is posted conspicuously on the Association’s website. Questions about this policy, or requests relating to ALPR information, may be directed to the ALPR Data Custodian at security@stfranciswood.org.

​

11. Review

The Board reviews this policy at least annually and updates it as needed to remain consistent with applicable law and the Association’s practices.