1. Who we are
RoofExa is roof measurement and estimating software for roofing and exterior contractors. It is developed and operated by RoofExa LLC, 5139 N 124th St, Butler, WI 53007, United States.
In this policy, "we", "us", and "our" mean RoofExa LLC. "You" means the person using the service: a contractor with an account, someone visiting roofexa.com, or a homeowner who receives an estimate through the service.
For privacy questions, write to [email protected] or call (860) 595-7643.
2. Your data and your customers' data
There are two different kinds of personal information here, and we treat them differently.
Data about you, our customer
When you sign up for RoofExa, we decide what is needed to run the service and we are responsible for that information: your name, your email address, your company details, your billing status, and how you use the product.
Data you put into RoofExa about the homeowners you work with
Names, addresses, phone numbers, email addresses, photos, notes, and documents belonging to your own customers stay yours. You decide what to collect and why. We hold and process it only to run the service for you, on your instructions, and we do not use it for our own purposes, do not sell it, and do not share it between accounts. Each company on RoofExa is a separate tenant and cannot see another company's records.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account information | Name, work email, phone, company name and address, role, password (stored only as a salted hash) | You, at signup and in Settings |
| Billing information | Plan, seats, licensed states, subscription status, invoice history, last four digits and expiry of a card | You and our payment processor. We never receive or store full card numbers |
| Property and measurement data | Addresses you look up, aerial and map imagery for those addresses, roof outlines, areas, pitch, and the estimates built from them | You, plus mapping and imagery providers |
| Your customers' records | Homeowner names, addresses, phone numbers, emails, photos, notes, documents, proposals, invoices, signatures | You, your team, or a homeowner who signs or fills in a form you sent |
| Communications | Emails and text messages sent or received through the service, delivery and open events, call and voicemail records where you use those features | You and the messaging providers you connect |
| Support messages | What you write in the contact form or send to support, and the contact details you leave | You |
| Usage and device data | Pages viewed on roofexa.com, referring page, screen width, IP address, browser user agent, timestamps, error logs | Automatically, when you use the site or app |
We do not ask for and do not want government identifiers, health data, or any other sensitive category of personal information.
4. How we use it
- To run the service: measure roofs, price and generate proposals, send them, take signatures, keep your records, and show them back to you.
- To bill you: start trials, take subscription payments, apply seat and state add-ons, and send receipts.
- To support you: answer your messages and calls, investigate a problem on a specific address or estimate, and restore something that went wrong.
- To keep the service safe: authenticate logins, rate limit abuse, detect fraudulent trial or payment activity, and keep audit trails of important actions such as an electronic signature.
- To improve the product: aggregate, non-identifying usage measurement, so we know which parts are used and which are broken.
- To tell you about the service: operational notices such as billing, trial expiry, security, and material changes. These are not marketing, so they are not opt-out.
We do not use the roofs, measurements, or homeowner records in your account to advertise to anyone, and we do not sell them.
5. Why we are allowed to
Where the law requires a stated basis, we rely on: performing the contract we have with you (running your account), our legitimate interests (keeping the service secure, preventing abuse, improving it), your consent where we ask for it (such as marketing you opt into), and compliance with legal obligations (tax and accounting records).
6. Who we share it with
We share personal information only with the service providers that make RoofExa work, and only with what they need. They act on our instructions and may not use your data for their own purposes.
| Provider | What it does | What it sees |
|---|---|---|
| Cloud hosting and storage DigitalOcean, Amazon S3 | Runs the application, database, and file storage in United States data centers | Everything you store, at rest and in transit |
| Mapping and imagery Google Maps Platform, Google Solar API, Esri | Geocoding, aerial and satellite imagery, roof surface data used for measurement, map tiles | The property addresses and coordinates you look up |
| Payment processing Stripe | Subscription billing, and, if you enable it, taking payment from your own customers | Billing contact and payment details. Card numbers go to them, never to us |
| Email delivery Mailgun, and the mail server you connect | Delivering the mail you send from the service, and our own notifications | Recipient address, subject, message content, delivery events |
| Telephony Telnyx, Twilio | Text messages, calls, and voicemail where you use those features | Phone numbers, message content, call metadata |
| Printing and direct mail PostGrid | Printing and posting the physical mail pieces you choose to send | The recipient name and postal address on the piece, and its contents |
| AI features OpenAI | The optional assistant features that draft an estimate or read a document | Only the text or document you submit to that feature |
| Integrations you switch on JobNimbus, Google Business Profile, social accounts | Only what you connect yourself, and only while it stays connected | The records you choose to send to that service |
Providers are named as they stand today. If we replace one with an equivalent provider we update this page; if a change would materially affect your rights we give notice as described in section 16.
We do not use a third-party analytics or advertising service on this site. Traffic measurement is our own, first-party, aggregated, and honours Do Not Track: see section 8.
We also disclose information when the law requires it (a valid subpoena, court order, or lawful request), to protect our rights or someone's safety, or as part of a merger or sale of the business, in which case the buyer is bound by this policy or gives you notice.
7. We do not sell your data
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California and other US state privacy laws. We have not done so in the past twelve months.
8. Cookies and tracking
The application sets a small number of strictly necessary cookies, chiefly the one that keeps you logged in. Without it you cannot use your account.
On the public website we count pageviews with our own first-party measurement: path, referring page, screen width, IP address, and browser user agent. There are no third-party advertising cookies, no ad networks, and no cross-site trackers anywhere on roofexa.com.
If your browser sends a "Do Not Track" or "Global Privacy Control" signal, our website measurement does not run at all.
9. Email and text messages
Mail you send to your own customers through RoofExa goes out from the mailbox you connect, under your identity, and is subject to the CAN-SPAM Act. Marketing email we send you always carries an unsubscribe link and we act on it.
Where the service sends text messages, message and data rates may apply, frequency varies, and a recipient can reply STOP to opt out or HELP for help. Opt-outs are recorded and enforced automatically across the service. You are responsible for having the consent required by the Telephone Consumer Protection Act before you message anyone.
10. How long we keep it
- While your account is open: your records stay available to you.
- After you close the account: we delete the account and its data within 30 days of a verified request, or within 90 days of the account being closed, whichever comes first.
- Invoices, payment records, and consent evidence: kept up to seven years, because tax, accounting, and electronic signature law requires it.
- Security and audit logs: kept up to 24 months.
- Website measurement: kept in an aggregated form; raw rows are pruned periodically.
11. How we protect it
Traffic between your browser and the service is encrypted with TLS. Passwords are stored only as salted hashes and can never be read back, including by us. Credentials you save for a connected mailbox or messaging provider are encrypted before they are written to the database. Access to production systems is limited to the people who operate the service, data is separated per company at the query level, and important actions such as signatures and consent are written to an audit trail.
No system is perfect. If a breach affects your personal information we will notify you and, where required, the relevant authority, without undue delay.
12. Your rights and choices
Whoever you are, you can ask us to:
- tell you what personal information we hold about you,
- give you a copy in a portable format,
- correct anything that is wrong,
- delete your account and its data,
- stop sending you marketing.
Deleting your account does not require asking us. Sign in, open Profile from the menu with your name on it, and use Delete my account. Your access ends immediately, any subscription is cancelled at that moment, and the data is erased 30 days later. We keep the erasure itself on record, and a signed payment authorization where one exists, because we are required to. During those 30 days the deletion can still be reversed if it was a mistake, so contact us quickly if it was. The full walkthrough, including what to do if you cannot sign in, is on Account & Data Deletion.
For anything else on that list, write to [email protected] from the address on the account, or use the contact form and pick "Privacy or data request". We verify who you are before we act, and we answer within 30 days. Exercising these rights costs nothing and we will not treat you differently for it.
If you are a homeowner and a contractor holds your details in their RoofExa account, ask that contractor first: the records are theirs, not ours. Tell us and we will pass your request on and help them carry it out.
13. US state privacy rights
Residents of California, Colorado, Connecticut, Utah, Virginia, and other states with comprehensive privacy laws have the rights listed above, including the right to know, the right to delete, the right to correct, the right to a copy, and the right to opt out of sale or targeted advertising. As set out in section 7, we do not sell personal information and we do not run targeted advertising, so there is nothing to opt out of. An authorised agent may make a request on your behalf with written proof.
California residents may also ask, once a year, for the categories of personal information disclosed to third parties for their direct marketing purposes. Our answer is: none.
14. Children
RoofExa is a tool for businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us, tell us and we will delete it.
15. Where data is processed
RoofExa is operated from the United States and all data is stored and processed there. If you use the service from outside the United States, you understand that your information is transferred to and processed in the United States, where privacy law may differ from your own.
16. Changes to this policy
When this policy changes we update the date at the top of the page. For a change that materially affects your rights we also give notice in the application or by email before it takes effect. Continuing to use RoofExa after that means the updated policy applies.
17. How to contact us
Privacy questions, requests, and complaints go to a real person here:
RoofExa LLC
5139 N 124th St
Butler, WI 53007, United States
Email: [email protected]
Phone: (860) 595-7643
Web: roofexa.com/contact
If you are not satisfied with our answer, you may complain to your state attorney general or, in the case of California, to the California Privacy Protection Agency.