Privacy Policy

Customers are the roofing companies that sign up for Roofboard, along with the owners, office staff, sales reps and crews they invite. For the account and billing information customers give us, Roofboard decides how it is used.

Homeowners are the people a roofing company works with. A roofing company enters its homeowners’ information into Roofboard and decides what to collect and why. For that information the roofing company is in charge (the “controller” or “business”) and Roofboard handles it on the company’s behalf and under its instructions (the “processor” or “service provider”). If you are a homeowner, the roofing company you worked with is the best first contact for questions about your information. If you write to us, we will pass your request to that company and help it respond.

• Account details: your name, company name, email address and role, and the people you invite. Passwords are handled by our sign in provider and stored only in hashed form. If you sign in with Google, we receive your name and email address from Google.
• Billing: your plan and subscription status. Card numbers are entered on Stripe’s pages and never stored by Roofboard.
• Payout setup: to take homeowner payments online, a roofing company connects its own Stripe account. Stripe collects the business’s identity and bank details directly. We keep the account ID and whether it is ready to take payments. A company that takes payments through Run Payments instead applies on Run’s own pages, which collect the business’s identity and bank details; we keep the merchant ID and its status.
• Leads sent in: a roofing company can send leads to Roofboard from its website form or tools like Zapier, with the name, phone number, email address, address and message the homeowner gave.
• Instant estimates: on a roofing company’s instant estimate page, a homeowner types their address and we measure the roof from Google’s satellite roof data. With the name, phone number or email address, roof type and message they give, the estimate goes to that roofing company as a lead with the measurement. The visitor’s IP address is used only to limit how many roofs one visitor can measure, and is not stored.
• Job records a roofing company enters: homeowner names, property addresses, phone numbers and email addresses, notes, photos, roof measurements and reports, insurance claim details (such as the carrier, claim number, adjuster and amounts, and scope documents), estimates, contracts, forms, invoices, payments recorded, warranties and messages.
• Signatures: when a homeowner signs a proposal or form, we record the name typed, the signature drawn, the time, the IP address, and for proposals the browser’s user agent, so the roofing company has a record of the signing.
• Homeowner pages: when a homeowner opens a project, proposal or invoice link, we note that it was opened and let the roofing company know.
• Email activity: our email provider tells us when an email is delivered, opened, clicked or bounces, and when someone unsubscribes.
• Use of the app: the pages and actions people use in the app, and whether push notifications are turned on on a device.
• Location: if you allow it, your device’s location is used to center the map, add a job where you stand, or work a canvassing area. It is used on the spot and is not tracked in the background.
• Voice: voice updates use your browser’s own speech recognition. Depending on your browser, its maker may process the audio to turn it into text. Roofboard receives the text, not the recording.
• Business contacts: we may email roofing companies at their business addresses about Roofboard. Every such email has a way to unsubscribe.

• To run Roofboard: store and show jobs, send the emails, proposals, invoices, receipts, reminders and work orders a roofing company asks us to send, and take payments for it.
• To run the AI features a customer chooses to use, like drafting a supplement or message, reading a scope or measurement report, or looking at damage photos.
• To look up addresses, maps, roof imagery, weather and hail reports for a job’s location, and to send hail alerts.
• To manage subscriptions and trials, and to send account emails such as trial reminders.
• To give support, keep the service secure, find and fix problems, and improve Roofboard.
• To meet legal duties and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use customer or homeowner information to advertise to anyone.

We use these service providers. Each gets only what it needs to do its job for us.

• Supabase: database, file storage for photos and documents, and sign in.
• Vercel: hosting for the website and app.
• Stripe: Roofboard subscriptions, and homeowner payments made through each roofing company’s own connected Stripe account.
• Run Payments: homeowner payments for roofing companies that choose it, through each company’s own merchant account.
• Intuit QuickBooks: if a roofing company connects its QuickBooks Online, we copy its invoices, the homeowners’ names and email addresses on them, and the payments recorded into that company’s own QuickBooks. We keep the connection’s access tokens on our servers, never in the browser, and delete them when the company disconnects. We read from QuickBooks only to match customers and avoid copying an invoice twice, and do not use QuickBooks data for anything else.
• Postmark: sending email, and reporting delivery, opens, clicks and bounces.
• Google: address search, maps, geocoding and roof imagery (Google Maps Platform, including the Places and Solar APIs), and Google sign in if you use it.
• OpenRouter and Anthropic: the AI features. When you use one, the text, photos or documents you choose are sent through OpenRouter to an AI model, by default one made by Anthropic, to produce the answer.
• Slack: our team gets internal notices about activity on Roofboard, for example a new sign up, a proposal signed or a payment received. These can include company names, account email addresses and homeowner names. They never include passwords, card numbers or access keys.
• OpenStreetMap: map images in the app are loaded from OpenStreetMap’s servers, which see your device’s IP address.
• Public weather and address services: we send job locations or addresses to the National Weather Service, NOAA and the U.S. Census Bureau geocoder to look up weather, hail reports and coordinates.
• Your browser’s push service: if you turn on notifications, they are delivered through the push service run by your browser or device maker.

We may also share information if the law requires it, to protect people or the service, or as part of a merger, sale or similar transaction, in which case this policy continues to apply to it.

Roofboard does not use advertising or analytics cookies, and we do not put third party trackers on our pages. The app uses your browser’s local storage to keep you signed in and to remember settings like the theme, filters and which updates you have seen. One cookie is used to open a private page we share with prospective customers. Stripe’s payment pages and Google’s sign in page set their own cookies under their own policies. Emails we send may include open and click tracking, as described above.

• All traffic to Roofboard is encrypted in transit with HTTPS.
• Each roofing company’s records are kept apart by database row level security, so one company cannot read another’s data. Inside a company, what a person can open depends on the role the company gives them.
• Photos and documents sit in private storage and are shown through links that expire.
• Our database provider encrypts stored data at rest.
• Card and bank details are handled by Stripe, not by Roofboard.
• Service keys stay on our servers and are never sent to browsers.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell the affected customers as the law requires.

We keep a customer’s information while its account is open. A customer can export its jobs to a spreadsheet at any time. When a customer asks us to close its account, we delete its workspace, including jobs, homeowner records, photos and files, within 30 days, except for what we must keep for billing, tax, legal or dispute reasons. Copies in backups are removed as those backups expire.

Homeowner information is kept and deleted on the roofing company’s instructions. A roofing company can edit or remove a homeowner’s records itself, or ask us to.

• You can see and change your account details in the app, and ask us for a copy of your information, to correct it, or to delete it, by writing to support@roofboard.com.
• You can unsubscribe from marketing email using the link in it. Service emails, like billing notices, still arrive while you have an account.
• You can turn push notifications and location access off at any time in your device or browser settings.
• Depending on where you live, you may have more rights under your state’s privacy law, such as the right to know, correct or delete information, and to appeal a decision we make about your request. We will honor these as the law requires and will not treat you differently for using them. We may need to confirm your identity first.

Roofboard is a business tool for adults. It is not meant for children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, write to us and we will delete it.

Roofboard is run from the United States, and our service providers store and process information in the United States.

We may update this policy as Roofboard changes. We will change the date at the top, and for meaningful changes we will tell customers by email or in the app before they take effect.

Questions or requests about privacy: support@roofboard.com. Roofboard Tech LLC.