Privacy Policy

Roofing companies use Roof Replies to answer calls they miss, reply to texts and book inspections. When you call or text a company that uses us, or send its web form or Facebook lead form, we handle your information for that company. The company decides how your information is used, and we act as its service provider.

What we collect:

• Your phone number, the time of your call and whether it was answered. Calls are never recorded.
• The texts you send and the texts sent to you.
• Details you share, such as your name, property address, email address, the roof problem and how urgent it is. The automated assistant picks these out of your texts.
• If you use a web form: what you enter, the consent text you agreed to, the text of the optional box for offers if you ticked it, then or on a later visit, the time, your IP address, your browser type and the page address. If the form is on the company's own website, the wording is what that site sends us, and the IP address, browser type and address come from that site's request to us. If you use a Facebook lead form: your name, phone number, email, address, message, your answers to the form's consent questions and checkboxes, whether they count as consent to texts, and the form's ID.
• Details the company adds, such as notes, or a list of past estimates it uploads with its statement of where your written consent to marketing texts came from.
• Whether your number is a mobile or a landline, from our SMS provider.
• Your inspection time, and your opt-out if you reply STOP.

How it is used:

• To text you for the company: a first text after a missed call or a form, replies, one follow-up if you do not answer, a booking confirmation, a reminder the day before, a review request after a completed job and, if you agreed to the company's marketing texts, a later check-in about an estimate. After a Facebook lead form, you get a first text only if you ticked a consent checkbox or answered yes to a consent question on it. If not, the company is alerted to call you instead.
• To tell the company about your request by text and email, and to put your inspection on its calendar with your name, number, address and roof problem.
• To honor opt-outs, keep a record of your consent and keep the service secure.

The company's team and our administrators can see your conversation. Replies from the automated assistant are written by our AI provider, which receives the conversation but not your phone number.

Your choices: reply STOP to stop texts from that company, START to get them again and HELP for help. To see, correct or delete your information, contact the company, or email us and we will pass your request to the company and help it respond. If you opted out, we keep that record even if your other information is deleted, so you are not texted again. Once the company has your information, for example in an alert email or its calendar, the company's own privacy policy also applies.

• For information about the businesses that use Roof Replies, their team members and visitors to our website, we decide how it is used.
• For information about homeowners and other people who contact a business, we act for that business as its service provider (also called a processor). We follow the business's instructions, given through its settings and our terms, and use the information only to provide, secure and support the service and to meet legal obligations.

• Account details: names, email addresses, mobile numbers for alerts, roles and alert preferences of owners and staff.
• Sign-in and acceptance records: sign-in links and sessions, and the version of our terms and this policy each user accepted, with the time and IP address.
• Business settings: business name, time zone, business hours, quiet hours, service area, services, answers and price ranges for the assistant, extra instructions, contact phone and email, Google review link, the cell number calls forward to, and other settings.
• Carrier registration (10DLC): legal business name, brand type, address, website, and a contact's name, email and mobile number. For a standard brand, also the EIN, the business type and the contact's job title.
• Message templates and approvals: the text of each template and of its last approved version, and who approved it, when and from which IP address.
• Connections: the Google account email and an access token for a connected calendar, and a Facebook Page ID and access token if we set up Facebook Lead Ads for the business.
• Uploads: the file name and who uploaded each list of past estimates, with their confirmation that everyone on it gave written consent to marketing texts and their note on where that consent came from. We do not keep the file itself. Its rows become leads.
• Billing: we invoice outside the app. If online billing is turned on, our payment processor (Stripe) collects payment details, and we keep only the customer and subscription IDs and the subscription status.
• Signup requests, when self-serve signup is open: business name, owner name, email, mobile number, time zone, terms acceptance and IP address.
• Activity log: a record of events such as texts sent and received, each assistant reply and the details it found, bookings, opt-outs with the text that asked for them, alerts, invitations, setting changes, template approvals and errors.

• When you visit our website, our hosting provider processes your IP address and browser details to deliver pages and protect the site, and keeps request logs.
• When you sign in, sign up or send a web form, we use your IP address and the email address or phone number you entered to limit repeated attempts. These rate-limit records are deleted periodically once they are a day old.
• The web form and the signup form use Cloudflare Turnstile to check that a person, not a bot, is submitting. Turnstile runs a script from Cloudflare in your browser, and we send Cloudflare the check token and your IP address to verify it.
• We do not use analytics, advertising or tracking tools on our website or in the app.

• To provide the service: handle calls, send and receive texts, write assistant replies, book inspections, send alerts and reports, and show the dashboard.
• To set up accounts: buy phone numbers, register businesses with carriers, and send sign-in links and invitations.
• To follow texting rules: keep consent records, honor opt-outs, apply quiet hours and daily limits, and keep an activity log.
• To keep the service secure: check for bots, limit repeated attempts, verify incoming requests and look into misuse.
• To give support and fix problems. Our administrators can open a business's account, and they get email alerts about errors that can include details such as phone numbers or message text.
• To bill businesses, enforce our terms and meet legal obligations.
• To improve the service using aggregated information that does not identify anyone, such as delivery rates.

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use homeowners' information for our own marketing.

Where a law requires a legal basis for using personal information, we rely on performing our contract with a business; our legitimate interests in running, securing and improving the service and in helping businesses answer their customers; consent, such as consent to receive texts or to connect a calendar; and our legal obligations, such as keeping opt-out records.

When someone texts a business, the assistant writes the reply with an AI model. For each reply, we send our AI provider:

• the business's name, services, service area, hours, answers, price ranges and instructions;
• up to the 40 most recent messages in the conversation, including replies from the business's team;
• the details collected so far, such as name, property address, roof problem, urgency and status;
• open inspection times and any booked time.

We do not include the person's phone number, though anything they write in a text is included. The AI provider returns the reply and the details it found, such as name, address, email, roof problem and urgency. We save those details to the lead and keep a record of each reply in the activity log.

Our AI provider is Anthropic (the Claude API). We may instead use Claude through Amazon Bedrock, run by Amazon Web Services. Under the commercial terms that apply to our use, these providers do not use this content to train their models by default. They may keep it for a limited time under their own policies, for example to detect misuse.

Automated checks replace a reply with a fixed, safe reply when it quotes a price outside the business's ranges, claims to be a person, or promises outcomes or insurance coverage. The assistant does not make decisions that have legal or similarly significant effects on anyone, and anyone can ask for a person at any time.

• With the business you contacted. A homeowner's information is available to that business's owners and staff in the dashboard, in text and email alerts, in its calendar and in its data exports.
• With service providers that run the service for us, listed below. They process it to provide their services, under their own terms and privacy policies.
• With carriers and The Campaign Registry, through our SMS provider, to deliver texts and to register businesses for texting.
• For legal reasons: to comply with the law or legal process, to protect the rights, safety and property of people and of Roof Replies, and to look into fraud or misuse.
• In a business transfer: if Roof Replies is sold, merged or reorganized, information may move to the new owner under this policy.
• With your permission or at your direction.

• We do not sell or rent mobile phone numbers. No mobile information is shared with third parties or affiliates for their marketing or promotional purposes.
• Text messaging originator opt-in data and consent are not shared with any third parties, except the aggregators and providers that host the service and deliver the messages, such as our SMS provider and the mobile carriers.
• Businesses text people who contacted them. Marketing texts, such as a check-in about an old estimate, go only to people who ticked a box agreeing to them or who the business confirms gave it written consent. Message frequency varies. Message and data rates may apply.
• Reply STOP to opt out at any time and HELP for help. An opt-out applies to the business you sent it to.

Always used:

• Vercel hosts the website and app. All information passes through it, and it keeps request and error logs.
• Neon hosts our database, in the United States (AWS us-east-1).
• Twilio provides business numbers, calls, texts, line type checks and carrier registration. It receives phone numbers, message text, call details and registration details, including the EIN of a standard brand.
• Anthropic writes assistant replies, as described above.
• Resend sends our emails, such as sign-in links, invitations, alerts and reports. Alert emails include lead details.
• Cloudflare runs our domain's DNS and the Turnstile bot check.
• Google hosts our contact mailbox (Gmail).

Used only when a business turns on the feature or we enable it:

• Google Calendar, when a business connects its calendar.
• Meta, when we set up Facebook Lead Ads for a business.
• Stripe, if we turn on online billing.
• Amazon Web Services (Amazon Bedrock), if we switch our AI provider to it.
• Inngest, if we use it to time background tasks. It would receive only internal task IDs and times, not messages or contact details.

GitHub Actions starts our scheduled background tasks every few minutes. It receives no personal information.

The service is for US businesses, and we store information in the United States. Some providers may process it in other countries under their own safeguards. If you contact us from outside the United States, your information is processed in the United States.

When a business connects Google Calendar, we ask Google for permission to see the account's email address, see when its calendar is busy and create calendar events. We use this access only to:

• show which Google account is connected;
• find open inspection times from the busy times on the primary calendar, over the next 15 days;
• create an event for each booked inspection, with the homeowner's name, phone number, address, roof problem and a link to the conversation.

We do not read the titles or details of existing events. We store the Google account email and an encrypted access token. Open times are included in what we send our AI provider, so the assistant can offer them. We do not use Google user data for advertising, do not sell it and do not use it to train AI models.

Roof Replies' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A business can disconnect the calendar in Settings, which deletes the stored token, and can remove our access in its Google account settings.

• Leads, conversations, call records, appointments, consent records, templates and the activity log are kept while the business's account exists. We do not delete them on a schedule. They are deleted when the business deletes a lead or when the account is deleted.
• Opt-outs are kept while the account exists, even if the lead is deleted. When an account is deleted, its opted-out numbers move to a permanent archive with the business name, its number and the opt-out date, as proof that the requests were honored. The archive is not used to send texts.
• User records (email, name, role and terms acceptance) are kept until you ask us to delete them. They are not removed automatically when a business is deleted.
• Sign-in links and sessions: a sign-in link stops working after 15 minutes (72 hours for an invitation), and a session lasts 30 days or until you sign out. We keep these records, with the links and session keys stored only as hashes.
• Signup requests are deleted periodically once their link has been expired for 30 days.
• Rate-limit records are deleted periodically once they are a day old.
• Background task records are kept while the account exists. Most hold only internal IDs. A retried alert text keeps a copy of the alert, which includes lead details.
• Activity records not tied to a business, such as terms acceptances and records of deleted accounts, are kept without a set end date.
• Copies held by providers, such as Twilio's message logs, sent emails, Google Calendar events and hosting logs, are kept under those providers' policies. Deleted data can also remain in database backups for a limited time.
• Emails you send us are kept as long as we need them to respond and to keep a record.

• Owners can download their business's settings, leads, messages, call records, appointments, opt-outs, templates, uploads and activity log as a JSON file from Settings. We can also provide one person's data on request.
• Owners can delete a lead. That deletes the lead, its messages, appointments, calls from its number, its activity log entries and its pending texts. If the person opted out, the opt-out stays.
• A business can ask us to delete its account. We cancel it, which stops all texting, and then delete the business and its data, except opt-outs, which move to the archive.
• Deleting a lead does not remove copies of its details held elsewhere: events in the business's Google Calendar, texts and emails already delivered, exported files, records of retried alert texts, and records our providers keep.

• Row-level security in the database keeps each business's records separate.
• Connections to the app and to our providers are encrypted (HTTPS).
• EINs, Facebook Page tokens and Google Calendar tokens are encrypted by the app (AES-256-GCM). An EIN is shown only by its last 4 digits, and each time an administrator views a full EIN, the view is logged.
• Sign-in links and session keys are stored only as hashes. There are no passwords.
• Incoming webhooks must carry valid signatures, and public forms and sign-in have bot checks and rate limits.

The app does not separately encrypt other information, such as names, phone numbers and messages. No system is fully secure. If we learn of a security incident that affects your information, we will notify you as the law requires.

• Texts: reply STOP to stop texts from a business, START to get them again and HELP for help.
• Business users: owners update business details in Settings, and each team member sets their own alert preferences. Ask us to stop monthly report emails, to remove a team member, or to delete your account or user record.
• Access, correction, deletion and copies: email roofrepliesconnect@gmail.com. For information we hold for a roofing company, we will pass your request to that company and help it respond, or you can contact the company directly.
• Verification: we confirm your identity before acting, usually by checking that you control the email address or phone number involved. You can use an authorized agent with your written permission, and we may ask you to confirm it.
• Timing and appeals: we respond within 45 days. If we need more time where the law allows it, we will tell you why. If we decline your request, you can appeal by replying to our decision. If your appeal is denied, you can contact your state attorney general.
• No discrimination: we do not treat you differently for using your rights.

Residents of some states, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, have rights to access, correct, delete and get a copy of their personal information, and to opt out of targeted advertising, sales and certain profiling. We do not sell personal information, use it for targeted advertising or use it for profiling that has legal or similarly significant effects. Because we do not sell or share personal information, a Global Privacy Control or Do Not Track signal does not change how we handle it.

This section is the notice that the California Consumer Privacy Act requires.

• Categories we collect: identifiers (name, phone number, email address, postal address and IP address); customer records (such as name, address and phone number); commercial information (services requested, inspections, outcomes and subscription status); internet or network activity (browser type, form submissions and sign-in records); professional information (business name, job title and a standard brand's EIN); and inferences the assistant draws about a request, such as how urgent it is.
• Sensitive personal information: we do not ask for it and do not use it to infer characteristics about anyone.
• Sources: you; the businesses that use the service; caller ID from your phone carrier; Facebook, for Lead Ads; our SMS provider, for line type; Google, for calendar connections; and your browser.
• Purposes: those in the section on how we use information.
• Disclosures: we disclose each category for business purposes to the service providers listed above, and homeowner information to the business it was collected for. We have not sold or shared personal information in the past 12 months.
• Retention: as described in the section on how long we keep information.
• Your rights: to know and access, delete and correct your personal information, and not to be discriminated against for using these rights. Make a request as described in the section on your choices and rights.

We do not share personal information with third parties for their own direct marketing.

The service is for businesses, and business users must be at least 18. It is not directed to children under 13, and we do not knowingly collect their information. If you believe a child under 13 has given us information, for example by texting a roofing company, email us and we will work with the business to delete it.

We use only the cookies the app needs to work:

• sid keeps you signed in for up to 30 days and is removed when you sign out.
• tid remembers which business you are working in, for up to 30 days, and is removed when you sign out.
• gcal_state protects the Google Calendar connection step and lasts 10 minutes.

Our public pages set none of these cookies, and we do not use analytics or advertising cookies. On the web form and the signup form, Cloudflare's Turnstile check runs in your browser and may use its own technologies to tell people from bots. Cloudflare's privacy policy covers that.

When we change this policy, we post the new version here with a new version label. Business users must accept the new version before they keep using the app. If a change affects how we use information we already hold, we will ask for consent where the law requires it.

Email roofrepliesconnect@gmail.com with privacy questions or requests. Mail: [Operator legal name], [Mailing address]. If you are a homeowner, you can also contact the roofing company you dealt with.