Privacy Policy

Account information. Your name, email address, company name, role, and password (stored as a hash, never in plain text) when you create an account.

Business records you enter. Jobs, customers, contacts, estimates, invoices, claims, notes, photos, and documents your team adds to run your business. Homeowner information inside those records belongs to your business; we process it on your behalf to provide the service and do not use it for anything else.

Billing information. Payments are processed by Stripe. Your card number goes directly to Stripe and never touches our servers; we store only the subscription status, plan, and billing history Stripe reports back.

Connected integrations. If you connect Gmail, Google Calendar, QuickBooks, a supplier account, or another integration, we store the tokens needed to keep the connection alive (encrypted at rest) and only the data the integration needs to do its job.

Usage and device data. Standard logs (IP address, browser, pages visited), error reports (Sentry), and aggregate analytics (Vercel Analytics). Our marketing site uses the Meta Pixel to measure advertising; the signed-in app does not.

If you choose to connect Gmail, RoofGrid requests read-only access so it can find claim- and job-related email (adjuster replies, carrier letters, customer messages) and file it against the right record. Supplier and legal email is filtered out before any automated processing. RoofGrid never sends email from your account without an explicit click from you.

RoofGrid’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the email-filing features you see in the product, is never sold, is never used for advertising, and is never used to train generalized AI models.

Some features use AI providers (Anthropic, Google) to classify email, draft documents, read roof photos, and suggest next steps. Drafts are always reviewed and sent by a human on your team; nothing goes out automatically. We do not allow these providers to train their models on your data.

We share data only with the service providers that run the platform: Supabase (database, authentication, file storage), Vercel (hosting and analytics), Stripe (payments), Resend (transactional email), Google (maps, aerial imagery, connected integrations), Twilio (phone), Sentry (error monitoring), and Cloudflare (DNS). Each processes data only to provide their service to us.

We do not sell your data. We do not share it with advertisers. We disclose data only if the law requires it, and we will tell you when we legally can.

Every connection is encrypted in transit (TLS) and stored data is encrypted at rest. Access inside your workspace is role-based, every table is protected by row-level security, and every change to a job or contact is written to an audit log. No system is perfect, but if we learn of a breach affecting your data we will notify you without undue delay.

Your records stay as long as your account is active. Deleted jobs and contacts are soft-deleted so your audit trail stays intact. You can export every job, note, document, and photo on request, anytime. To delete your account and its data, email support@roofgrid.io and we will complete the deletion within 30 days, except records we must keep for legal or billing reasons.

You can access, correct, export, or delete your information by emailing support@roofgrid.io. You can disconnect any integration at any time from Settings, which revokes our access. You can opt out of marketing email with one click; transactional email (invoices, signature requests you initiate) is part of the service.

RoofGrid is a business tool for roofing contractors and is not directed to anyone under 18.

If we change this policy in a way that matters, we will post the new version here and update the date at the top. Questions go to support@roofgrid.io.