Privacy Policy

Draft for attorney review. Not legal advice.

1. Scope

This policy explains how Data Insights Consulting LLC ("we") collects, uses, shares, and protects personal information when you visit roofalong.com, create an account, or use the Roof Along service (together, the "Service"). It also explains how we handle information about people who are not our users but who appear in the data our Service compiles (see Section 4). Our business customers ("Customers") control the data they enter about their own leads; where we process that data on a Customer's behalf we act as a service provider/processor, and the Customer's privacy practices govern.

2. Information we collect from users

• Account information: name, work email, company, role, organization membership, password (hashed by our authentication provider), and profile settings including accessibility preferences.
• Customer content you enter: leads (names, addresses, ZIP codes, estimated values, notes, contact details), contacts your team records for contractors and properties (a person's name, role, phone, email, and notes about your interactions with them), bids and price books, saved territories and map views, uploaded documents and marketing materials, message templates, campaign recipients and content, and signature request documents.
• Usage and device information: pages and features used, actions taken in the Service, timestamps, IP address, browser and device type, approximate location derived from IP, error reports when the app fails, and the identifiers described in our Cookie Policy. We do not currently use third-party advertising or analytics trackers.
• Communications: support requests, accessibility barrier reports, and feedback.
• Connected services: if you connect a CRM (such as Salesforce), we receive the account identifiers and records needed to sync leads you choose to send.

3. Information we compile from other sources ("Platform Data")

To provide territory, property, market and contractor intelligence, we collect and combine data from: public government records and open data (county and state property assessor rolls including owner names and mailing addresses, building permits including contractor names, contractor licensing rosters obtained through public-records requests, U.S. Census Bureau statistics, NOAA storm event records, SBA Paycheck Protection Program loan records); publicly available manufacturer contractor directories and trade association member lists; and licensed business-data providers (currently People Data Labs) that supply business firmographics and the names, titles, business email addresses, business phone numbers and public professional profile links of contractor company owners and leadership. We also generate derived data such as territory scores, likely roof age and replacement estimates.

4. If you are not a user but appear in our data

If you own property in a covered area, hold a contractor license, appear on a building permit, or are an owner or leader of a roofing business, our Service may display information about you to our Customers — for example your name as the recorded owner of a parcel, or your business contact details. This information comes from public records and the licensed providers described above. We use it to help roofing businesses identify properties and contractors to serve. We do not use it to make eligibility decisions and we prohibit our Customers from using it for purposes regulated by the Fair Credit Reporting Act. You may ask us to delete or restrict your information using the rights process in Section 9; we will honor requests as required by law and, where a request concerns data we license from a provider, pass the request to that provider.

5. How we use information

To provide, secure, and support the Service; to authenticate users and enforce roles and territories; to compute scores and estimates; to send transactional messages (invitations, password resets, acceptance notices); to send our Customers' marketing and program communications on their instruction (Customers are the senders); to investigate misuse and enforce our Terms; to comply with law; and to improve the Service using aggregated or de-identified information. We do not sell personal information and we do not share it for cross-context behavioral advertising.

6. How we share information

With service providers acting on our behalf under contract: hosting and database (Supabase, Cloudflare, Lovable); authentication and sign-in, including optional Microsoft and Google sign-in (Lovable Cloud auth, built on Supabase Auth); mapping and geocoding (Google Maps Platform); business-data enrichment (People Data Labs — we send business name and address to obtain company information); email delivery for the Communication tool (Resend); and error monitoring. Where a Customer connects their own CRM, we also transmit that Customer's lead data to their chosen provider (for example Salesforce) at their direction.

With Customers and their users: Platform Data and the Customer's own content are visible to the authorized users of that Customer, scoped to their territory.

With your connected CRM when you initiate a sync; with authorities when required by law or to protect rights and safety; and with successors in a merger, acquisition, or asset sale, subject to this policy. We do not share Customer content with other Customers, with one narrow exception: business contact details you record for a roofing company (a person's business role, work phone, and work email) may, after we verify them, be added to that company's shared record as Platform Data available to all Customers. Homeowner and other property-occupant contact details you record are never shared with other Customers; only non-identifying facts (for example, "contact on file" or "owner-occupied") may be added to a shared property record.

7. Cookies and similar technologies

See our Cookie Policy for the categories we use, how to change your choices, and how we honor Global Privacy Control signals.

8. Retention

Account information is kept while your account is active and for up to [24] months after closure for legal and operational purposes; Customer content is kept for the life of the Customer's subscription and 30 days after termination for export, then deleted from active systems within [90] days (backups roll off within [35] days); acceptance and consent records are kept for [5] years; message engagement events for [24] months; Platform Data is refreshed and retained as long as it is useful for the Service. We may keep de-identified or aggregated data indefinitely.

9. Your privacy rights

Depending on your state of residence (including California, Colorado, Connecticut, Delaware, Iowa, Montana, New Jersey, New Hampshire, Oregon, Texas, Utah, Virginia and others), you may have the right to know or access the personal information we hold about you, to correct it, to delete it, to obtain a portable copy, to opt out of sale, sharing, targeted advertising, or certain profiling, and not to be discriminated against for exercising rights. We do not sell or share personal information for targeted advertising.

To exercise rights, email info@datainsightsconsulting.co or use the "Do Not Sell or Share My Personal Information" link in our footer. We will verify your request (for users, by your signed-in account; for non-users, by matching the details you provide to the record) and respond within the time required by law (generally 45 days). You may use an authorized agent where the law allows. If we deny a request, you may appeal by replying to our decision email; California residents may also contact the California Privacy Protection Agency.

Notice at collection (California): the categories collected are identifiers, commercial information, professional information, internet activity, geolocation (approximate), and inferences (scores); sources, purposes, and recipients are described above; retention is described in Section 8; we do not sell or share personal information and have not done so in the preceding 12 months.

10. Security

We use industry-standard safeguards including encryption in transit, encrypted storage, row-level access controls that scope data to each Customer, role-based permissions, service-side enforcement of territory limits, and logging. No system is perfectly secure; notify us at info@datainsightsconsulting.co of any suspected incident.

11. Children

The Service is for business users 18 and older. We do not knowingly collect information from children under 16.

12. International users

The Service is operated from the United States and intended for U.S. users. If you access it from elsewhere, your information will be processed in the United States.

13. Changes

We will post updates here with a new version and effective date and notify users of material changes in the Service or by email.

Contact

Data Insights Consulting LLC, 6311 W Higgins Lake Dr #640, Higgins Lake, MI 48627 · info@datainsightsconsulting.co · (989) 312-3447.