Back to Home

Privacy Policy

Effective Date: August 26, 2026

1. Introduction

RoofHQ ("we," "our," or "us") respects your privacy. This policy explains what we collect, why, how it is protected, and the rights you have under applicable laws such as CCPA/CPRA (California), PIPEDA (Canada), and GDPR (EU/UK).

2. Information We Collect

  • Account data: name, business email, phone number, company name, logo.
  • Business profile: specialty, crew size, volume, region, and other onboarding answers you provide.
  • Job & estimate data: property addresses you submit for measurement, resulting roof metrics and estimates, notes, and proposal documents.
  • Technical data: IP address, browser/device characteristics, session cookies (essential for login security), and trial-limit enforcement counters.
  • Billing metadata: subscription status and transaction records via Stripe. We never store full card numbers — Stripe does.

3. How We Use Information

  • Provide, maintain, and improve the Service;
  • Generate measurements, estimates, and proposals;
  • Send transactional emails (estimates, receipts, review requests) via Resend;
  • Process subscriptions and homeowner deposits via Stripe;
  • Monitor errors and performance via Sentry;
  • Detect abuse (rate limits, disposable-email and trial-farming checks).

We do not sell personal information, and we do not use customer job data to train AI models.

4. Third-Party Processors

We rely on vetted sub-processors to operate the Service. Each receives only the data necessary for its function:

  • Supabase — hosting, authentication, database (TLS + row-level security);
  • Stripe — payment processing and subscription billing;
  • Google — Geocoding & Solar APIs for address lookup and satellite roof analysis;
  • Resend — transactional email delivery;
  • Sentry — error monitoring and diagnostics;
  • PostHog — product analytics (first-party, opt-in only);
  • Vercel — application hosting and infrastructure.

5. Cookies & Tracking

We use essential cookies for login sessions, security, and trial-limit enforcement. We also run Sentry for error monitoring (no advertising, no cross-site tracking) and PostHog for first-party product analytics. PostHog analytics are off by default — you can opt in or out via the cookie consent banner shown on your first visit, and your choice is stored in a 12-month consent cookie you can change at any time by clearing your cookies for this site.

6. Data Security

Security measures include PostgreSQL Row-Level Security (per-tenant isolation), TLS 1.3 in transit, encryption at rest managed by our infrastructure providers, least-privilege service keys, and rate limiting/abuse controls on sensitive endpoints.

7. Retention & Deletion

You can delete your entire account self-service at any time from Settings → Danger Zone. This removes your profile, jobs, estimates, and billing linkage immediately (cancelling any live subscription first). Some minimal records may be retained where legally required.

8. Your Rights

Depending on your jurisdiction you may request access, correction, export, deletion, or restriction of your personal data. Submit a request via the contact below; we verify identity before acting and respond within statutory timelines.

9. Contact

Privacy questions: support@tryroofhq.com