Back to Home

Privacy Policy

Effective Date: October 13, 2026

1. Introduction

RoofHQ ("we," "our," or "us") respects your privacy. This policy explains what we collect, why, how it is protected, and the rights you have under applicable laws such as CCPA/CPRA (California), PIPEDA (Canada), and GDPR (EU/UK).

2. Information We Collect

  • Account data: name, business email, phone number, company name, logo.
  • Inquiry data: contact details, estimate volume, selected workflow goals, messages, and campaign attribution you provide when requesting a walkthrough or contacting us.
  • Business profile: specialty, crew size, volume, region, and other onboarding answers you provide.
  • Job & estimate data: property addresses you submit for measurement, resulting roof metrics and estimates, notes, and proposal documents.
  • Technical data: IP address, browser/device characteristics, session cookies (essential for login security), and trial-limit enforcement counters.
  • Billing metadata: subscription status and transaction records via Stripe. We never store full card numbers — Stripe does.

3. How We Use Information

  • Provide, maintain, and improve the Service;
  • Generate measurements, estimates, and proposals;
  • Send transactional emails (estimates, receipts, review requests) via Resend;
  • Process subscriptions and homeowner deposits via Stripe;
  • Monitor errors and performance via Sentry;
  • Detect abuse (rate limits, disposable-email and trial-farming checks).

We do not sell personal information, and we do not use customer job data to train AI models.

4. Third-Party Processors

We rely on vetted sub-processors to operate the Service. Each receives only the data necessary for its function:

  • Supabase — hosting, authentication, database (TLS + row-level security);
  • Stripe — payment processing and subscription billing;
  • Google — Geocoding & Solar APIs for address lookup and satellite roof analysis;
  • Resend — transactional email delivery;
  • Sentry — error monitoring and diagnostics;
  • PostHog — product analytics (first-party, opt-in only);
  • Google Analytics and Google Ads — opt-in traffic and conversion measurement for our advertising campaigns;
  • Meta — opt-in Pixel and Conversions API measurement for Meta advertising;
  • LinkedIn — opt-in Insight Tag and Conversions API measurement for LinkedIn advertising;
  • Vercel — application hosting and infrastructure.

5. Cookies & Tracking

We use essential cookies for login sessions, security, and trial-limit enforcement. We also run Sentry for error monitoring, PostHog for first-party product analytics, and Google Analytics, Google Ads, Meta, and LinkedIn to measure whether an ad led to a completed lead form, trial signup, or subscription. For consented subscription measurement, we may send campaign identifiers, transaction value, and a normalized SHA-256 hash of an account email; we do not send raw email, phone, property, or job data in conversion events. Signed-in customers are excluded from browser retargeting tags. Optional analytics and conversion measurement are off by default — you can opt in or out via the cookie consent banner shown on your first visit, and your choice is stored in a 12-month consent cookie you can change at any time by clearing your cookies for this site.

6. Data Security

Security measures include PostgreSQL Row-Level Security (per-tenant isolation), TLS 1.3 in transit, encryption at rest managed by our infrastructure providers, least-privilege service keys, and rate limiting/abuse controls on sensitive endpoints.

7. Retention & Deletion

You can delete your entire account self-service at any time from Settings → Danger Zone. After cancelling any live subscription, the workflow removes tenant application data and stored account files. Payment processors and infrastructure providers may retain limited transaction, security, legal, or backup records under their own obligations and retention schedules. Where required, we complete provider-side follow-up and backups age out rather than being edited in place. Some records may be retained under a documented legal hold.

8. Your Rights

Depending on your jurisdiction you may request access, correction, export, deletion, or restriction of your personal data. Submit a request via the contact below; we verify identity before acting and respond within statutory timelines.

9. Contact

RoofHQ's privacy contact can be reached at support@tryroofhq.com. Contact us there for access, correction, deletion, consent, or security questions.