Privacy Policy

This notice summarizes what RoofKit collects at the moment of collection, as required by California law. The full detail follows in the sections below.

• We collect identifiers, commercial information, internet activity, geolocation derived from a property address, and visual content that you upload.
• We use that information to deliver the roof visualization, measurement, and estimate that you requested, and to connect you with the roofing contractor whose page you used.
• On our marketing website, optional advertising tools may share identifiers and internet activity with advertising partners. You can opt out at /do-not-sell. Roofer lead data is processed under the DPA.
• We do not sell personal information for money.
• We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.
• Retention periods appear in the categories table below.

You can exercise your rights at any time by writing to privacy@roofkit.ai, or by using the opt-out link at /do-not-sell for advertising choices.

Verve AI LLC (713 NE Dixie Hwy Unit D, Jensen Beach, FL 34957) operates RoofKit, an AI-first SaaS platform for roofing contractors. For privacy questions, contact us at privacy@roofkit.ai.

RoofKit acts in two different roles, and your rights depend on which role applies to the data in question.

When you submit a form on a roofer-branded page, the roofing contractor decides why your information is collected and who else receives it. RoofKit processes that information on the contractor's documented instructions under a written data processing addendum available at /dpa.

The table below lists each category of personal information that RoofKit collects, where it comes from, why we process it, how long we keep it, and who receives it. Categories use the names given in the California Consumer Privacy Act.

RoofKit does not use personal information for any purpose that is incompatible with the purpose stated above without giving you notice first.

RoofKit does not sell personal information for money. On its own marketing website, RoofKit may share browser activity with Meta for advertising measurement until you opt out. RoofKit does not share homeowner or lead data for cross-context behavioral advertising under its Data Processing Addendum.

The marketing website can send browser identifiers, page views, and campaign parameters to Meta unless you opt out of sharing. Roofer lead email addresses and telephone numbers are not included in that permission. Outbound lead conversion passback to Meta, Google, or Microsoft requires a separate lawful arrangement and is not enabled by these policies.

The RoofKit pixel on a roofer website records page views, phone clicks, and form submissions for that roofer. RoofKit keeps that record as a service provider and does not send it to an advertising network.

• RoofKit has not sold or shared the personal information of consumers under 16 years of age.
• Advertising recipients process marketing website data under their own policies. Roofer lead data remains subject to the service provider restrictions in the DPA.
• You can opt out of this sharing at /do-not-sell, without creating an account and without verifying your identity.

RoofKit honors the Global Privacy Control browser signal as a valid opt-out of sharing. When your browser sends that signal, RoofKit applies the opt-out automatically and does not ask you to confirm it.

Property addresses and roof coordinates can identify a precise property location. RoofKit uses this information to provide requested property services. We do not request government identifiers, racial or ethnic origin, religious beliefs, union membership, genetic data, biometric identifiers, or health information.

RoofKit does not use sensitive personal information to infer characteristics about you. You may contact us to exercise applicable rights concerning sensitive information, including limits on its use where required by law.

Roofer payment details are handled directly by our payment processor. RoofKit does not store full payment card numbers.

Residents of states with a comprehensive privacy law have the rights listed below. Those states include California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, and Rhode Island. The exact rights vary by state.

• Right to know what personal information we collect, use, disclose, and share.
• Right to access a copy of your personal information in a portable format.
• Right to correct inaccurate personal information.
• Right to delete personal information, subject to the exceptions described below.
• Right to opt out of sale and of sharing for cross-context behavioral advertising.
• Right to opt out of profiling that produces legal or similarly significant effects. RoofKit does not perform that profiling.
• Right to non-discrimination for exercising any of these rights.
• Right to appeal a denied request.

To exercise a right, write to privacy@roofkit.ai. RoofKit responds within 45 days and may extend that period once by a further 45 days when the request is complex. RoofKit tells you before it extends.

Where RoofKit acts as a service provider for a roofing contractor, RoofKit does not answer the request on the merits. RoofKit forwards the request to that contractor without undue delay, tells you that it did so, and gives the contractor export and deletion tools for each lead.

If RoofKit denies your request, the response states the reason for the denial and explains how to appeal. You can appeal by replying to that response, or by writing to privacy@roofkit.ai with the word APPEAL in the subject line.

RoofKit reviews an appeal and answers in writing within 45 days of receipt, and within 60 days where state law permits an extension. The answer explains the reason for the decision.

If RoofKit denies your appeal, you may contact your state attorney general to submit a complaint.

Every state privacy law permits a business to keep the records that a legal obligation or a legal claim requires. RoofKit keeps the following records after it deletes the rest of your personal information.

RoofKit strips the identifying columns from these records where the record still serves its purpose without them.

You can use an authorized agent to submit a request on your behalf. Send the request to privacy@roofkit.ai together with written permission signed by you.

For a request to know, correct, or delete, RoofKit may also contact you to confirm the permission and to verify your identity. RoofKit does not require verification for an opt-out of sale or sharing.

RoofKit does not deny goods or services, charge a different price, provide a different level of quality, or suggest that you will receive a different price or quality because you exercised a privacy right.

RoofKit does not operate a financial incentive program and does not offer payment or a discount in exchange for personal information. If RoofKit introduces one, this policy will publish the terms, the estimated value of the data, and the method used to calculate that value before the program starts.

RoofKit uses AI models to generate roof visualizations, measurements, estimates, and written summaries. Those outputs can be incomplete or inaccurate, and a person should review them before relying on them.

RoofKit improves its platform and its models using service data, aggregated data, and de-identified content. De-identified content includes roof geometry, measurements, line proposals and the corrections an operator made to them, report structure, and imagery, only when the material cannot reasonably identify, reveal information about, or be linked to a consumer or household.

When RoofKit prepares a measurement example for training, it uses the property address and roof coordinates only to validate the stored image. The example keeps local geometry and the operator correction. It omits the street address, lead contact details, absolute coordinates, and any zoom level. A larger roof keeps a larger local shape. Linked source records remain personal information.

• RoofKit does not use identifiable homeowner or lead personal information to train general-purpose models.
• RoofKit does not combine personal information received from one roofer workspace with personal information from another source to build a consumer profile.
• RoofKit takes reasonable measures to prevent association with a consumer or household, maintains the de-identification of this content, does not attempt to re-identify it, and requires the same by contract of anyone who receives it.
• Trained reviewers may read de-identified content for quality review, model evaluation, and operator training.

The contractual terms for this use appear in the Terms of Use at /terms and in the data processing addendum at /dpa.

RoofKit uses cookies and similar storage for essential platform operation, session continuity, analytics, and advertising measurement. See the Cookie Policy at /cookies for the category detail and the current first-party cookies.

Roofer-hosted pages set the persistent first-party visitor cookie cv_visitor from the first visit for visit and quiz measurement. Onsite Pixel uses implicit first-party measurement unless a supported analytics choice or required-mode setting applies. Required mode waits for an explicit analytics grant. A supported analytics refusal stops page views, phone clicks, identify events, custom events, and persistent attribution, and expires cv_visitor.

After an analytics refusal, an intentional form with a valid email or phone can still create or update a roofer lead and an internal conversion record. RoofKit retains the operational quiz session ID and landing snapshot needed to provide quiz, lead capture, and result services. The form creates no analytics event and does not link a persistent analytics visitor ID, campaign attribution, or referrer to the lead. RoofKit sends no lead conversion to Google Analytics 4.

On RoofKit-hosted roofer pages, Global Privacy Control and sharing opt-outs do not stop first-party measurement or lead capture and do not delete cv_visitor. On external roofer websites, these signals block Onsite Pixel sends and clear its tracking identifiers. PostHog product analytics on RoofKit's marketing site and app starts only after you accept analytics. Advertising measurement on the marketing website runs until you opt out of sharing. Reject and accept have the same prominence. You can change your choice from the cookie preferences link in the site footer.

RoofKit uses the service providers below to host, secure, and deliver the platform. Each one processes personal information on RoofKit instructions and only as needed to perform its service.

• Convex — backend database and application infrastructure.
• Vercel — application hosting and delivery.
• Stripe — subscription billing and payment processing.
• Brevo — transactional email and SMS delivery.
• Sentry — error monitoring and observability.
• PostHog — product analytics after analytics cookie consent.
• Google — maps, geocoding, aerial imagery, and related visualization APIs.
• OpenRouter and AI model providers — AI-assisted processing.
• Telnyx — call and SMS infrastructure where enabled.
• CRM and integration partners such as JobNimbus when a workspace connects those services.

Meta receives marketing website activity as an advertising recipient until you opt out. The sharing described above is subject to the opt-out at /do-not-sell. Connected Google and Microsoft advertising accounts do not authorize outbound lead passback.

Roofing contractors also receive the lead information submitted through their branded pages. Each contractor is responsible for its own use of that information.

RoofKit uses administrative, technical, and organizational measures designed to protect personal information, including encrypted transport, encryption at rest, tenant isolation, access controls, and monitoring. Integration credentials and webhook signing secrets are encrypted with a versioned key.

No online service can guarantee absolute security. If a security incident affects your personal information, RoofKit notifies affected consumers and regulators within the deadline that your state requires.

RoofKit is intended for business use by roofing teams and for homeowners who request a roofing estimate. RoofKit does not knowingly collect personal information from anyone under 16 years of age, and does not sell or share the personal information of consumers under 16.

If you believe a child gave us personal information, write to privacy@roofkit.ai and RoofKit will delete it.

RoofKit reviews this policy at least once every 12 months, as California law requires. RoofKit revises the last updated date when it publishes a material change, and gives notice before a change that applies retroactively to information already collected.

Questions about this Privacy Policy can be sent to privacy@roofkit.ai, or by mail to Verve AI LLC, 713 NE Dixie Hwy Unit D, Jensen Beach, FL 34957.

Related documents: Terms of Use at /terms, Cookie Policy at /cookies, data processing addendum at /dpa, and the advertising opt-out at /do-not-sell.