Privacy Policy

1. Who We Are

Roof Manager ("we", "our", "us") is a roofing measurement and business management platform operated from Alberta, Canada. We provide AI-powered roof measurement reports, CRM tools, and invoicing to roofing professionals. Our website is https://www.roofmanager.ca. For privacy inquiries, contact us at Support@roofmanager.ca.

2. Information We Collect

• Account information: Name, email address, company name, and password (hashed — never stored in plaintext).
• Property addresses: Street addresses and GPS coordinates you submit to generate roof measurement reports.
• Payment information: Processed entirely by Square. We do not store full card numbers. We record transaction IDs and amounts for your billing history.
• Usage data: Pages visited, features used, and report generation history — used to improve the service.
• Google Workspace OAuth token: When you voluntarily connect your Google account (see Section 3), we store your OAuth refresh token, encrypted at rest, so we can send mail on your behalf and sync calendar events for jobs you schedule. We never collect, read, or store the contents of your inbox or unrelated calendar events.

3. Google Workspace API Data — Limited Use

Roof Manager offers optional integrations with Google Gmail and Google Calendar so you can send roof measurement reports, proposals, and invoices from your own Gmail address, and sync scheduled jobs to your Google Calendar. Connecting these is entirely optional — the platform works fully without it.

Scopes requested

• https://www.googleapis.com/auth/gmail.send — to send roof measurement reports, proposals, and invoices from your Gmail address when you explicitly trigger a send action inside Roof Manager. Roof Manager cannot read, list, search, modify, or delete any messages in your inbox with this scope.
• https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/calendar.events — to create, update, and delete calendar events that correspond to roofing jobs you schedule inside Roof Manager. We do not read events you created outside of Roof Manager except to detect duplicates of jobs we created.
• https://www.googleapis.com/auth/userinfo.email — to identify the connected Google account so the correct user receives sent-mail and calendar sync.

How we use Workspace API data

• We use Workspace API data only to provide and improve the user-facing features described above (sending email and syncing job calendar events).
• We do not use Workspace API data — including Gmail content, Calendar event content, or anything derived from them — to develop, train, improve, or evaluate generalized or non-personalized AI/ML models.
• We do not sell Workspace API data, and we do not use it for advertising or any retargeting purpose.
• We do not transfer Workspace API data to third parties except (a) as necessary to provide and improve the user-facing features above, (b) to comply with applicable law, or (c) as part of a merger, acquisition, or sale of assets with notice to users.
• Human review of Workspace API data is performed only (a) with your explicit consent for a specific support request, (b) for security/abuse investigation, or (c) where required by law.

Storage and revocation

• We store only the OAuth refresh token, encrypted at rest. We do not store your Gmail messages, inbox metadata, or calendar events on our servers.
• You may disconnect Roof Manager at any time inside Settings, or revoke access directly at myaccount.google.com/permissions.
• If you delete your Roof Manager account, all stored OAuth tokens are deleted within 30 days.

4. How We Use Your Information

• To generate and deliver roof measurement reports.
• To process payments and maintain billing records.
• To send transactional emails (report delivery, invoices, account notifications).
• To improve roof-measurement accuracy using satellite imagery, geospatial data, and aggregated platform usage metrics. We do not use Google Workspace API data (Gmail or Calendar content) to train, improve, or evaluate AI/ML models. See Section 3 for the full Limited Use disclosure.
• To respond to support requests.

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

5. How We Store Your Data

Your data is stored in Cloudflare D1 (SQLite at the edge), protected by Cloudflare's infrastructure with encryption at rest and in transit. OAuth tokens are stored encrypted. Passwords are hashed using SHA-256 with a unique salt per user — we cannot recover your password.

6. Third-Party Services

• Square: Payment processing. Governed by Square's Privacy Policy.
• Google Solar API & Maps: Property imagery and geospatial data. Governed by Google's Privacy Policy.
• Google Gemini AI: AI analysis used to enhance roof measurement reports, analyze satellite and property imagery, power report search, and draft website-builder copy. Data sent: the property address and measurements of a report, satellite or property images, and the business details you type into the website builder. Governed by Google's Privacy Policy.
• OpenAI: Powers the Rover assistant and proposal drafting on our website, and transcribes voice notes you record. Data sent: your name, email address, company name, account activity (report credit balances, recent property addresses), the homeowner name and property address of a proposal you ask it to draft, and the messages or audio you send. OpenAI does not use data sent through its API to train its models. Inside the Roof Manager iOS app the assistant runs on our own Cloudflare infrastructure and receives no identifying data — no personal data is sent to OpenAI or any other third-party AI service from the app. Governed by OpenAI's Privacy Policy.
• Cloudflare: Hosting, database (D1) and the on-platform AI model that answers the in-app assistant — all processed inside our own Cloudflare account. Governed by Cloudflare's Privacy Policy.
• Replicate and fal.ai: Image and segmentation models behind the roof visualizer and satellite roof outlines. Data sent: the house photos you upload to the visualizer and satellite map tiles of a property. Governed by Replicate's Privacy Policy and fal.ai's Privacy Policy.
• Resend: Transactional email delivery (when Gmail integration is not used).
• Intuit QuickBooks Online: Optional accounting export. If you connect QuickBooks, the invoices, estimates and customer contact details you choose to export are sent to your QuickBooks company. The export runs only when you start it, and we never read data back from QuickBooks. Governed by Intuit's Privacy Statement.

7. Your Rights (PIPEDA — Canada)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and associated data.
• Withdraw consent for data processing (subject to legal and contractual obligations) — including consent for the AI-assisted features listed in Section 6; email us and we will disable them on your account. The iOS app sends no personal data to third-party AI services, so nothing needs withdrawing there.

To exercise any of these rights, email us at Support@roofmanager.ca. We will respond within 30 days.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain records for legal or accounting purposes (typically 7 years for financial records under Canadian tax law).

9. Cookies

We use a single session cookie to keep you logged in. We use Google Analytics (GA4) to understand aggregate traffic patterns. No advertising cookies are used.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users by email of material changes. Continued use of the service after changes constitutes acceptance of the revised policy.

11. Contact

For any privacy-related questions or requests, contact:
Roof Manager
Alberta, Canada
Support@roofmanager.ca