Privacy Policy

Last updated: April 10, 2026

This Privacy Policy explains how Roof Roof Solutions ("we", "us", "our") collects, uses, and shares information about you when you use our lead marketplace platform at roofroof.solutions and our lead-capture landing pages (collectively, the "Service"). This policy applies to two distinct groups: contractors who buy leads and homeowners who submit their information through a landing page. Different data is collected for each.

Short version: We collect the minimum we need to run the marketplace. Contractor accounts store your business details + billing info. Homeowner submissions store what you type into the landing page form, your phone for OTP verification, and standard web analytics (IP, user agent, referrer). We share data with the processors we need to run the service (Stripe, Twilio, Resend, Meta) and nobody else.

1. Information We Collect

If you are a contractor (buyer):

Account details: full name, email address, company name, phone number, hashed password
Billing: Stripe customer ID and payment method (we never see or store your raw card number — Stripe handles that end-to-end)
Order data: lead type, geography, quantity, max budget, and the leads delivered to your account
Usage data: when you log in, which pages you view, API calls you make

If you are a homeowner (lead):

Contact details: name, phone number, email (if provided)
Property address: street, city, state, zip
Qualification details: whether you own the property, the roof issue you described, optional appointment time
Verification: your phone number is used to send a one-time passcode to confirm you're a real person; we store that you verified but not the code itself
Web analytics: IP address, user agent, referrer, UTM parameters from the ad that brought you to the landing page
Meta browser cookies (_fbc, _fbp) — only if you clicked on one of our Meta ads and accepted cookies in that session

2. How We Use Your Information

For contractors: to authenticate you, fulfill your orders, deliver leads, bill you, issue invoices, pay media buyer commissions, send you transactional notifications about your orders, and comply with tax and legal obligations.

For homeowners: to match your inquiry with a licensed roofing contractor in your area so they can contact you about your roof issue. We also use your contact details to confirm your submission via SMS/email and, if you booked an appointment, to coordinate that appointment. Meta browser cookies and hashed contact details are forwarded to Meta for ad attribution and improved ad targeting on future campaigns.

3. How We Share Your Information

We share your information only with the following categories of recipients:

Contractors who purchased your lead (homeowners only). When your submission matches an active order, we deliver your name, phone, email, address, and roof issue to the contractor who bought that lead. Contractors are contractually prohibited from reselling your information and from using it for any purpose other than contacting you about your roofing inquiry.
Service providers (processors). We use Stripe (payments), Twilio (SMS + OTP verification), Resend (email), Cloudflare (DDoS protection and the Turnstile captcha used on our contact form), Supabase (database hosting), and Netlify (web hosting). Each of these processes data on our behalf under their own privacy terms.
Meta (Facebook). We send hashed contact details and event data to Meta via the Conversions API (through a Stape gateway) so we can measure ad performance and optimize campaigns. Hashing is one-way SHA256 — Meta cannot recover your raw email or phone from the hash; they can only check whether you're already in their audience.
Google Tag Manager and RetargetIQ. We use these tools to coordinate analytics and retargeting on our marketing pages.
Legal compliance. We will disclose information if required by a valid subpoena, court order, or other legal process, or to protect our rights, property, or safety.

We do not sell your personal information and we do not share it with any party outside the categories above.

4. Cookies & Tracking Technologies

Our marketing and lead-capture pages use the following tracking technologies:

Meta Pixel — for measuring ad conversions and retargeting. Drops _fbp (first-party) and reads _fbc (set by Meta when you click a sponsored ad).
Google Tag Manager — a container that loads other tags based on our configuration.
RetargetIQ — audience segmentation for ad retargeting.
Cloudflare Turnstile — a privacy-friendly, non-tracking bot check used on our contact form. It does not fingerprint you and does not store cookies outside the form submission flow.

You can opt out of Meta's ads-based profiling in your Facebook settings. You can block third-party scripts generally using browser privacy extensions. Our core service (placing orders, submitting leads, logging in) does not require any of these trackers to function.

5. Data Retention

Contractor accounts: retained for as long as your account is active plus 7 years after closure (for tax and legal reasons).
Homeowner leads: retained for 24 months from submission. After that, personally identifying fields (name, phone, email, address) are purged; anonymized aggregate data may be retained for analytics.
Billing records: retained for 7 years to comply with accounting and tax law.
Server logs (IP, user agent, request paths): retained for 30 days.

6. Your Rights

Regardless of where you live, you may contact us to:

Request a copy of the personal information we hold about you
Request correction of inaccurate information
Request deletion of your information (subject to the legal retention periods above)
Opt out of marketing communications (we don't currently send marketing email to contractors beyond order notifications, and homeowners only receive transactional confirmations)
Object to or restrict certain processing

If you are a California, Colorado, Connecticut, Utah, or Virginia resident, you have additional rights under your state's privacy laws (CCPA/CPRA, CPA, CTDPA, UCPA, VCDPA) including the right to know, the right to delete, the right to correct, and the right to opt out of "sale" or "sharing" of personal information. We do not sell personal information as defined by these laws.

To exercise any of these rights, contact us at info@roofroof.solutions with "Privacy request" in the subject. We will respond within 30 days.

7. Security

We use industry-standard encryption in transit (TLS 1.2+) and at rest for all database storage. Passwords are stored as bcrypt hashes. Payment cards are handled exclusively by Stripe and never touch our servers. Access to production systems is limited to a small number of authorized personnel and protected by two-factor authentication.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you within 72 hours of discovery as required by applicable law.

8. Children's Privacy

Our Service is not directed at children under 16 and we do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will delete it.

9. International Users

Our Service is operated from the United States and is intended for users located in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have data protection laws that differ from those in your jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be announced via email to contractors and a notice on the landing page for homeowners. Continued use of the Service after changes constitutes acceptance.

11. Contact Us

For privacy questions, data requests, or any concerns about how we handle your information, contact us at info@roofroof.solutions or through the contact form on our Support page.