1. Two kinds of data, and why the difference matters
BookRoofs handles two very different things, and your rights differ between them.
- Your data. Information about you and your business — your name, email, company details, billing records. For this we are the controller.
- Your customers’ data. The homeowner records, phone numbers, addresses, call recordings and transcripts you put into the Service. For this you are the controller and we are a processor: we hold it on your instructions and act on them.
If you are a homeowner who was called or whose details are in a contractor’s account, the contractor decides what happens to your data. Contact them first; we will help them respond.
2. What we collect
Account and billing
- Name, email address, telephone number, company name and business address.
- Authentication data. We never see your password — it is hashed by our authentication provider.
- Subscription status and payment history. We never receive or store full card numbers; card details go directly to Stripe.
Content you put in
- Contacts, opportunities, appointments, jobs, invoices, documents and photographs.
- Field reports, daily logs and inspection media.
AI Caller
- Numbers called, call times, durations and outcomes.
- Call audio and transcripts, where calls are recorded, together with summaries written back onto the contact record.
Technical
- IP address, browser and device information, pages viewed, and error diagnostics.
- Cookies strictly necessary for signing in and keeping you signed in.
3. Why we have it
- To provide the Service — performance of our contract with you.
- To bill you — performance of our contract and our legal obligations.
- To keep the Service secure and working — our legitimate interest in preventing abuse and diagnosing faults.
- To support you — responding when you contact us.
- To meet legal obligations — tax, accounting and lawful requests.
We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use your data, or your customers’ data, to train machine-learning models.
4. Who processes it
We use the providers below to run the Service. Each is bound to process data only on our instructions. Naming them individually is deliberate: a policy that will not say who handles the data is not a disclosure.
| Provider | What they do | Location |
|---|---|---|
| GoHighLevel (HighLevel Inc.) | CRM records, contacts, calendars and messaging | United States |
| Supabase | Application database, authentication and file storage | United States |
| Vercel | Application hosting and delivery | United States |
| Telnyx | Telephone numbers, call carriage and AI voice for the AI Caller | United States |
| Anthropic | The language model that conducts AI Caller conversations | United States |
| Stripe | Subscription billing and payment processing | United States |
| Resend | Transactional email such as sign-in and password reset | United States |
We also disclose information where the law requires it, to protect rights and safety, and to a buyer in connection with a merger or sale — in which case this policy continues to apply to the data transferred.
5. Call recordings and transcripts
Where the AI Caller records a call, the recording and its transcript are stored so a summary can be written onto the contact and so the call can be reviewed.
Recording-consent law varies by state, and some states require every party to consent.As the caller, ensuring the required disclosure is made is the account holder’s responsibility, not ours. See section 5 of the Terms of Service.
6. How long we keep it
- Account data — while your account is open, then up to 90 days.
- Customer Data — while your account is open. After termination you may export it for 30 days, after which we may delete it.
- Call recordings and transcripts — as configured for your account, and deleted on request unless we must keep them.
- Billing and tax records — as long as the law requires, typically seven years.
- Backups — deleted data may persist in backups for a limited period before being overwritten.
7. Security
- Encryption in transit (TLS) and at rest.
- Row-level tenant isolation in the database, so one account cannot read another’s data.
- Third-party access tokens are encrypted before storage.
- Role-based access, so people see only what their role needs.
- Signed, verified webhooks, so an outside party cannot write into your account.
No system is perfectly secure. If a breach affects your personal information we will notify you and any regulator as the law requires.
8. Your rights
Depending on where you live you may have the right to access, correct, delete, port or restrict your personal information, to object to certain processing, and to withdraw consent. Californian residents additionally have the right to know what is collected and to be free from discrimination for exercising these rights.
Email privacy@bookroofs.com. We respond within 30 days and will verify your identity first. Requests are free unless plainly excessive.
For data belonging to a contractor’s customers, we will refer the request to that contractor, who is the controller.
9. International transfers
We and our providers operate in the United States. If you access the Service from elsewhere your information will be transferred there, under appropriate safeguards where the law requires them.
10. Cookies
We use cookies that are strictly necessary to sign you in and keep your session. We do not use advertising cookies within the application. Blocking necessary cookies will stop you signing in.
11. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect their information; tell us if you believe we have and we will delete it.
12. Changes
We may update this policy. Material changes will be notified by email or in the Service before they take effect, and the date at the top always reflects the current version.
13. Contact
BookRoofs, United States
Privacy: privacy@bookroofs.com
General: support@bookroofs.com