1. Introduction

RoofLeadHQ ("we," "us," or "our"), operated by RoofLeadHQ LLC, provides AI-powered lead qualification, appointment booking, and reporting services for roofing companies ("Customers" or "you"). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website and services.

RoofLeadHQ also offers Revenue Recovery, through which a roofing company may request that RoofLeadHQ review the company's own prior roofing opportunity records. If a company is accepted into Revenue Recovery, it becomes a Customer for purposes of this Policy, and RoofLeadHQ processes that Customer's prior-opportunity records to help re-engage approved opportunities on the Customer's behalf. Requesting a Revenue Recovery review does not, by itself, begin any outreach to homeowners or property owners. This Policy explains how we collect, use, disclose, and protect personal information in connection with the Revenue Recovery application and, for accepted Revenue Recovery Customers, the prior-opportunity records processed on their behalf.

We act as a service provider that processes personal information on behalf of our Customers. This policy applies to information we collect and process while providing the RoofLeadHQ services. For Revenue Recovery specifically, RoofLeadHQ processes a Customer's prior-opportunity records as a service provider acting on that Customer's documented instructions; Section 5 explains this and the other roles RoofLeadHQ occupies in more detail.

2. Information We Collect

We collect the following categories of personal information:

A. From Our Customers (Roofing Companies)

• Business contact information, such as name, email, phone number, and company name.

• Account and billing information, including billing contacts and payment-method information used to process subscription and overage charges.

• Calendar and appointment-scheduling data the Customer provides.

• Plan, allowance, pricing, service-area, and crew or internal-number settings used to configure service and billing.

B. From Leads and End Consumers (provided by a Customer or captured through the Services)

• Contact information, such as name, phone number, email address, and mailing or property address.

• Project details, such as roof type, urgency, job description, stated need, and photos.

• Insurance information.

• Appointment and scheduling preferences.

• Call duration and interaction metadata associated with calls, forms, texts, scheduling flows, or other lead interactions.

• Audio recordings of inbound and outbound calls; written transcripts of those calls; AI-generated call summaries; and associated call logs and interaction records.

• Billing and usage determinations for each lead, including whether the lead counted toward the Customer's plan or overage and the reason for that determination.

This includes homeowner or property-owner contact and project information contained within an accepted Revenue Recovery Customer's own prior-opportunity records, provided by that Customer — see subsection D below.

C. From Revenue Recovery Applicants

When a roofing company submits a Revenue Recovery application, we collect:

• Applicant contact information: first name, last name, business email address, and direct phone number.

• Company information: company name, city, state, and, if provided, company website.

• Descriptive information about the applicant's own prior roofing opportunity records: an approximate count of those opportunities, an approximate age range of the records, and where the records are stored (for example, the name of the applicant's CRM or spreadsheet). This is information about the records, not the underlying homeowner records themselves.

• Optional additional context the applicant chooses to provide about their company or records.

• Acknowledgment of the applicable Revenue Recovery terms.

• A separate, optional, unchecked-by-default opt-in to receive SMS messages about the applicant's own Revenue Recovery application (see Section 6).

The Revenue Recovery application does not collect homeowner or property-owner records, and does not ask for homeowner names, phone numbers, email addresses, or addresses. The optional free-text field is validated to reject homeowner-level personal information if submitted in error.

D. Prior-Opportunity Records We Process for Revenue Recovery Customers

If a Customer's Revenue Recovery application is accepted, RoofLeadHQ processes the prior roofing opportunity records that Customer supplies, in order to carry out the approved Revenue Recovery outreach. Those records — which the Customer already holds and controls — may include homeowner or property-owner contact information (such as name, phone number, email address, or property address) along with prior project, estimate, or job details. RoofLeadHQ processes this information only on the Customer's documented instructions and only for the approved opportunities. Section 5 explains how responsibility for this information is allocated between RoofLeadHQ and the Customer.

E. Automatically Collected Information

• Usage and interaction data with our AI agent and platform.

• Device information, IP address, browser type, and access logs collected through cookies and similar technologies.

• For Revenue Recovery applications submitted through our website: a hashed version of the submitting IP address (stored only when a server-side hashing key is configured; otherwise no IP address is stored for that submission), a truncated browser/device identifier (user-agent string), and internal version identifiers recording which version of the application form, Terms of Service, and Privacy Policy the applicant acknowledged.

F. From Visibility Assessment Requesters and Visibility and Content Customers

When a roofing or restoration company requests a complimentary visibility assessment, we collect:

• Requester contact information: contact name, business email address, and business phone number.
• Company information: business name, primary service area, company website, and, if provided, state and the roofing or restoration services the company wants to be known for.
• The business’s own public profile and listing addresses, where the requester chooses to provide them, such as a Facebook page, an Instagram profile, a LinkedIn company page, a Google Business Profile or Maps listing, or another business listing. Each of these is optional, and leaving one blank means only that no link was provided.
• Optional additional context the requester chooses to provide about their company, services, or priorities.

In preparing an assessment we also review publicly available business information about the company — for example its public website pages, public social profiles, public business listings, and publicly displayed business name, address, and phone number. We review that information as it is publicly displayed. We do not access any account, sign in to any platform, or change any property in order to prepare an assessment, and we record which findings we could verify from public information and which we could not.

We create assessment findings, category scoring, and a written report from that review. A completed report may be hosted on a private, unlisted page on a RoofLeadHQ domain, reached through a link we provide. The link is not indexed and is not published, but anyone holding it can open the report.

A visibility assessment request does not collect homeowner or property-owner records, and does not ask for homeowner names, phone numbers, email addresses, or property addresses.

The Onboarding Submission

If a company selects a paid visibility or content service, it becomes a Customer under subsection A and completes a secure onboarding form reached through a private link. Through that form we collect:

• Confirmed identity and contact details: the business name the Customer wants published, the contact name, the business email address, the primary business phone number, and an optional emergency phone number.
• Business facts the Customer approves for publication: the website address to publish, whether the street address may be published and the address itself where it may, service areas, roofing services, restoration services, confirmed capabilities, approved calls to action, and each factual claim the Customer wants stated together with what supports that claim.
• Publishing preferences: the writing tone, the time zone, and the requested service start date.
• Platform links and access states: the address of each Facebook, Instagram, LinkedIn, or Google Business Profile page in scope, and the Customer’s own statement of the access state of each — requested, access pending, authorized, or unavailable. An access state is a record that the Customer granted permission inside the platform’s own sharing tools. It is not a credential, and only an authorized channel may be published to.
• Imagery: links to images the Customer wants used, what each image shows, and the Customer’s confirmation that it has the permission needed for us to publish them.
• Acknowledgment of the Visibility and Content Services Agreement: the name of the person acknowledging it and the date and time of that acknowledgment.

What the onboarding form does not collect. It does not ask for, and will not accept, a password, login, access code, security question or answer, recovery code, API key, or token for any platform. A submission containing one is rejected in full, and nothing in that submission is stored, summarized, or returned. Publishing access is granted by the Customer inside each platform’s own sharing tools; we record only that it was granted. The form also does not collect payment card details or any other payment instrument, because fees for this offering are invoiced manually and payment is confirmed by RoofLeadHQ after it is received. The form does not collect homeowner or property-owner records.

Why we collect it. We collect this information so that we publish only what the Customer approved, so that we publish only where the Customer has authorized us to publish, so that a claim we print is one the Customer supported, and so that we can invoice the engagement and record its progress. For each engagement we also keep our own commercial record: the service selected, the invoice reference and amounts, the fact of a confirmed payment, its reference, and who confirmed it. We store no card number or payment token.

We additionally handle the materials the Customer supplies or authorizes us to use, such as logos, photographs, and testimonials; the content we prepare for the Customer and its platform adaptations; and the account access the Customer authorizes us to use on its own websites and business profiles. We use authorized access only to perform the agreed services, only on the properties the Customer identifies, and the Customer may withdraw that access at any time.

3. How We Use Your Information

• To provide the Visibility and Content services: to prepare a complimentary visibility assessment from publicly available business information, to host and deliver that assessment to the requesting company on a private page, to record a company’s service selection, to carry its confirmed onboarding answers into the work, to prepare and adapt content for a Customer’s authorized channels, to publish or schedule that content using access the Customer has authorized, and to issue and reconcile the manual invoice for that engagement.

We use the information we collect solely to provide and improve our services, including:

• Qualifying leads and booking appointments using our AI system.

• Sending confirmations, reminders, and notifications.

• Logging data to a Customer's designated system, such as Google

Sheets or another configured reporting system.

• Providing customer support and account management.

• Recording, transcribing, and summarizing calls to qualify leads, schedule appointments, support homeowner follow-up, maintain lead-interaction records, provide quality assurance, secure the Services, and resolve account or billing questions.

• Calculating plan usage and overage, presenting usage information to the Customer, and resolving billing questions.

• Analyzing service performance and improving our workflows using aggregated or de-identified information, with reasonable measures designed to prevent re-identification. We do not use Customer Homeowner Records to train a general-purpose AI model for unrelated customers.

• Reviewing and administering Revenue Recovery applications, including evaluating whether a company's prior-opportunity records appear workable for Revenue Recovery and corresponding with the applicant about the request.

• For accepted Revenue Recovery Customers, using the same AI-assisted qualification and appointment-booking process described above to re-engage approved opportunities drawn from the Customer's prior-opportunity records, book appointments arising from that outreach, and track and report outcomes back to the Customer.

We do not sell personal information to third parties for monetary or other valuable consideration, and we do not share business contact information held for outreach with anyone else for their own marketing. We do not use personal information for any purpose not described in this Policy.

4. How We Share Your Information

We share personal information only as necessary to operate the services and with appropriate safeguards, including with:

• Trusted service providers and vendors under appropriate data-processing terms, including providers of voice orchestration and automated-call services; telephony and SMS delivery; speech-to-text transcription; AI-model processing; cloud hosting, databases, and file storage; calendar, spreadsheet, and reporting integrations; payment processing; analytics; security; customer support; business email hosting and delivery; outbound email campaign administration; reply and delivery-status processing; and opt-out, bounce, complaint, and suppression management. RoofLeadHQ uses or may use service providers to perform the functions described in this Policy, and only those functions. These providers support Revenue Recovery outreach and booking in the same manner they support other lead qualification and booking activity.

• The applicable Customer through its dashboard, reports, configured systems, and service workflows, including lead-level usage and billing determinations. For an accepted Revenue Recovery Customer, this includes outcome reporting on the Customer's own prior-opportunity records processed through Revenue Recovery.

For the Visibility and Content offering, the only providers involved are our cloud hosting and database provider and our transactional email provider. Those providers receive business contact and business profile information for that offering. They do not receive homeowner call audio, transcripts, or summaries, because the Visibility and Content services do not process any. Fees for that offering are invoiced manually and confirmed by RoofLeadHQ, so no payment processor receives information for it and no card or payment instrument is stored. We do not currently use an automated content-generation model or a social-platform publishing integration for that offering; content is prepared from a library of copy written in advance and rendered against the business information a Customer has approved, and publishing happens through the access a Customer has authorized rather than through a platform integration. If we adopt an automated content-generation model, a payment processor for this offering, or a platform publishing integration, we will update this Policy before doing so. The voice, telephony, transcription, and AI-model providers named above support the lead-response and Revenue Recovery services, and may process call audio, transcripts, summaries, contact and project information, appointment data, usage determinations, and other information only as necessary to perform their contracted services. Service providers are required to maintain the confidentiality and security of personal information and to use it only for authorized purposes. We may also disclose information if required by law, to protect legal rights, to prevent fraud, or in connection with a business transfer such as a merger or acquisition.

5. Revenue Recovery: Our Roles

Revenue Recovery involves three distinct roles, described here so it is clear who is responsible for what:

• The Customer controls its own prior-opportunity records. The Customer supplies its own prior roofing opportunity records for Revenue Recovery and controls what those records contain and which opportunities are re-engaged. The Customer is responsible for the accuracy of those records and for having the lawful basis, consent, or other permission needed to have RoofLeadHQ contact the homeowners or property owners in those records on the Customer's behalf, including under the SMS and call practices described in Section 6.

• RoofLeadHQ acts as a service provider for the Customer's prior-opportunity records.

RoofLeadHQ processes a Customer's prior-opportunity records — including any homeowner or property-owner contact information those records contain — only as a service provider acting on the Customer's documented instructions, and only for the approved outreach, booking, and outcome-reporting purposes described in Section 3. RoofLeadHQ does not independently decide to contact a homeowner or property owner outside the scope of an approved Customer request.

• RoofLeadHQ determines its own purposes for other information. For information

RoofLeadHQ collects about a Revenue Recovery applicant (Section 2C), and for account, billing, website, and platform-administration information generally (Sections 2A and 2E), RoofLeadHQ determines its own purposes and means for collecting and using that information, as described in Section 3, and is not acting merely on a Customer's instructions with respect to that information.

6. SMS Communications and Mobile Opt-In

This section applies both to leads a Customer provides or that are captured through the Services in the ordinary course, and, for an accepted Revenue Recovery Customer, to homeowners or property owners identified within that Customer's approved prior-opportunity records.

Leads may provide contact information directly through calls, forms, messages, scheduling flows, or other interactions, or a Customer may provide or forward lead contact information to RoofLeadHQ for follow-up. The Customer represents that it has the necessary rights, consent, or lawful basis to provide such information and request follow-up communications. Where consent is obtained, recipients may receive SMS appointment confirmations, reminders, and follow-up messages and may opt out at any time by replying STOP.

The first SMS sent to the recipient includes explicit consent language: "By texting back, you agree to receive SMS appointment confirmations, reminders, and follow-up messages from the applicable roofing contractor. Msg & data rates may apply. Reply STOP to unsubscribe or HELP for support."

Mobile phone numbers and SMS opt-in consent information collected through this process will not be sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. This does not restrict RoofLeadHQ from using service providers solely to deliver, secure, or support SMS communications on behalf of Customers. Recipients may opt out at any time by replying STOP.

G. How a Request Reached Us (Source Attribution)

When a company submits a visibility assessment request, we record a small, fixed set of information about how that request reached our website, so that we can tell which of our own communications or pages a request came from. We record only:

• the campaign tags carried in the link that was used — specifically the utm_source, utm_medium, utm_campaign, utm_content, and utm_term values;
• the path of the page the form was completed on, with any query string and any fragment removed; and
• where the visit came from another website, the host name of that website only — for example example.com.

We do not record the full address of the referring page, its query string, or its fragment. We do not record browsing history, pages viewed elsewhere, search terms, or any account credential. Each stored value is length-limited, and anything not in the list above is discarded rather than stored.

This information is stored with the assessment request it belongs to, so it is associated with that request and with the company that submitted it. We therefore do not describe it as anonymous. A request that carries no campaign tags is simply recorded as having none. This information is never used to decide whether to accept, delay, or refuse a request.

H. Business Contact Information for Roofing-Industry Outreach

Separately from the information above, we maintain business and professional contact information for roofing and restoration companies we have not yet worked with, so that we can introduce RoofLeadHQ and offer a complimentary visibility assessment. A business email address or direct phone number can identify an individual, so we treat this information as personal information even though it concerns a business.

For each company we may hold: the company name; a business email address; a business phone number; the company website; the city, metropolitan area, and region we have associated with the company; whether the company appears to operate from more than one location, the number of locations, and its headquarters city; the public source from which the information was obtained; an internal record identifier; and the date the record was added.

We obtain this information from publicly available business sources and from our own business records. We record the source for each record where one applies.

We use it to identify roofing and restoration businesses that our services may be relevant to; to organize and administer outreach by region; to send business communications about RoofLeadHQ’s services and to respond when a company replies; to measure at a campaign or aggregate level how many assessment requests a campaign produced; and to maintain list quality and to administer suppression, bounces, complaints, and our compliance obligations. We do not sell this information, and we do not share it for anyone else’s marketing.

A company or business contact may tell us to stop at any time, by using the unsubscribe link in any message, by replying to ask us to stop, or by contacting us using the details in Section 14. We honor that promptly.

On request from the company or business contact, we will delete the underlying outreach record. We will, however, keep a minimum suppression record — the email address and the reason it was suppressed — because that record is the only thing that prevents the same address from being contacted again in a later campaign. A suppression record is never used to contact the company, and it is not used for any other purpose.

I. Email Operations for Business Outreach

Business outreach email is sent from RoofLeadHQ-controlled domains other than roofleadhq.com, which is reserved for service and account messages. Mail for those domains is handled by our business email hosting and delivery provider, and outbound campaigns are administered using an outbound email platform. These are service providers of the kinds described in Section 4.

We use these records to send the message, to see whether it was delivered, to recognize a reply so that a person can respond, to record a bounce or a complaint, to add an address to suppression, and to keep the records needed to show that opt-outs were honored.

We do not use open tracking or click tracking in business outreach email. Our messages contain no tracking pixel, and we do not rewrite links to measure who clicked them.

Our messages contain two kinds of link, and they are different:

The assessment-request link is not rewritten for click measurement. It carries only the approved campaign tags described in subsection G, which identify the campaign and which message in the sequence it came from. It contains no identifier for the individual recipient.

The unsubscribe link is the required opt-out mechanism. It may contain a token specific to the recipient, because the request has to be matched to the right address in order to be honored and recorded. That token is used only to process and record the opt-out. It is not used to measure opens, clicks, or any other engagement.

If we later enable open or click tracking, we will update this Policy before doing so.

Revenue Recovery Applicant SMS Opt-In

Separately, a Revenue Recovery applicant may choose to check an unchecked, optional box on the application to receive SMS messages about their own Revenue Recovery application. Message and data rates may apply, and the applicant may reply STOP at any time to opt out. This applicant-level opt-in is stored separately from the lead and homeowner SMS consent described above, applies only to messages about the applicant's own application, and is not and does not substitute for consent from any homeowner or property owner.

Call Recording, Transcription, and Automated Processing

Calls handled through the Services may use an automated scheduling assistant. Recording, transcription, and automated summarization are enabled only when the configured notice and consent procedure has been approved for the called person's jurisdiction. Where recording is enabled, the call begins with the required notice. If the applicable procedure cannot be determined or delivered, recording and transcription remain disabled for that interaction.

We use recordings, transcripts, summaries, and related call records to qualify leads, schedule appointments, support homeowner follow-up, maintain records of lead interactions, provide and improve the Services, perform quality assurance, maintain security, support Customer accounts, calculate usage when relevant, and resolve billing questions or disputes. We disclose these materials only to the applicable Customer, to service providers that need them to perform the Services, or as otherwise permitted or required by law.

7. Cookies and Tracking Technologies

We use cookies, pixels, and similar tracking technologies to operate the service, understand usage patterns, and improve user experience. You may manage cookie preferences through your browser settings. For more information, contact us.

8. Data Retention

We retain personal information only as long as necessary to provide the services, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type and applicable law. When we no longer need the information, we delete or de-identify it.

Raw call audio, full call transcripts, and AI-generated call summaries are retained for up to 90 days after the call and are then deleted or de-identified, unless a longer period is reasonably necessary to comply with law, preserve evidence for a pending dispute or legal claim, investigate fraud or a security incident, or enforce our agreements. This 90-day period applies to calls made in connection with Revenue Recovery outreach in the same way it applies to other calls handled through the Services.

Billing and usage records are kept for the life of the Customer's account and, after account closure, only for the period required or reasonably necessary for billing, tax, accounting, dispute resolution, fraud prevention, and legal compliance. These records may include, for each lead, the date received, contact number, information captured such as name, property address, or stated need, call duration, whether the lead counted toward plan usage or overage, and the plain-language reason for that determination.

The 90-day call-content period is separate from the billing-record period. After raw call content is deleted or de-identified, RoofLeadHQ may retain the narrower structured lead, qualification, appointment, usage, and billing records described above without retaining the complete audio, transcript, or summary.

Revenue Recovery application information (Section 2C) is ordinarily retained for 24 months after the final accept/decline decision or last related correspondence, whichever is later, after which it is deleted or de-identified unless a narrower record is required for dispute, fraud, security, or legal compliance. The automatically collected application-intake metadata described in Section 2E (hashed IP, if stored; truncated user-agent; version identifiers) is retained together with the associated application record and follows the same retention treatment.

Visibility assessment request information (Section 2F) is retained while it is needed for the assessment, any follow-up correspondence, and our ordinary business records. We review this information periodically and delete or de-identify it when it is no longer needed, unless a narrower record is required for dispute, fraud, security, or legal compliance. We do not operate an automated deletion timer for this category, so we do not state a fixed deletion date we could not reliably meet. A requester may ask us to delete their request information at any time using the contact details in Section 14. A hosted assessment report may be updated or removed at any time.

Source attribution recorded with a request (Section 2G) is retained with that request and follows the same treatment.

Business and professional contact information held for outreach (Section 2H) is retained only while it is reasonably needed for the outreach and compliance purposes described in that subsection. We review these records periodically and delete or de-identify those we no longer need. A company or business contact may ask us to delete the outreach record at any time using the contact details in Section 14, and we will do so.

One narrow exception, stated plainly so that the deletion commitment above is not contradicted: when an address has been suppressed, we keep a minimum suppression record consisting of the address and the reason it was suppressed, for as long as we operate outreach. Deleting that record would remove the only thing preventing the address from being contacted again in a later campaign. It is retained solely to prevent future contact and is never used to contact anyone.

Visibility and Content onboarding and engagement information (Section 2F) is retained for the life of the engagement, because it is the record of what the Customer approved us to publish and where we were authorized to publish it. That includes the confirmed business facts, the approved claims and what supports them, the channel links and access states, the imagery links and the permission given for them, the acknowledgment of the Services Agreement, and our own invoice and payment-confirmation record. After the engagement ends, we keep it only for the period reasonably necessary for billing, tax, accounting, dispute resolution, and legal compliance, and then delete or de-identify it. A Customer may ask us to delete or return its onboarding information and supplied materials using the contact details in Section 14, subject to those narrower records. No platform password or credential is retained, because none is ever accepted, and no payment card or payment instrument is retained, because none is ever collected. Prepared content is retained for the life of the engagement and thereafter under the account-record period described above.

An accepted Revenue Recovery Customer's prior-opportunity records are retained during the engagement and ordinarily returned or deleted within 30 days after closeout and the Customer's election. Narrower telemarketing, consent, suppression, authorization, call-detail, and compliance records are retained for at least five years where required; attribution, billing, payment, tax, and accounting records are ordinarily retained for seven years. Minimal suppression records may be retained longer to continue honoring a person's request. Raw call audio, full transcripts, and AI summaries follow the 90-day period above. Additional detail appears in the applicable Customer agreement and retention schedule.

9. Data Security

We implement reasonable administrative, technical, and physical security measures to protect personal information. However, no security system is completely infallible, and we cannot guarantee the absolute security of information.

10. Your Privacy Rights

Depending on location and applicable law, including the California Consumer Privacy Act and California Privacy Rights Act and the Colorado Privacy Act where they apply, a Customer, lead, or Revenue Recovery applicant may have the right to:

• Access personal information we hold.

• Request correction of inaccurate information.

• Request deletion of personal information.

• Opt out of the sale or sharing of personal information; we do not sell personal information.

• Receive a portable copy, restrict or object to certain processing, opt out of covered targeted advertising or profiling, or appeal a denied request where applicable. We do not use Revenue Recovery Homeowner Records for cross-context behavioral advertising or make decisions producing legal or similarly significant effects through solely automated profiling.

A privacy-rights request may include personal information contained in a call recording, transcript, or automated summary. To exercise these rights, email support@roofleadhq.com. We may verify identity and authority before responding. An authorized agent may submit a request where applicable. If we deny a request, the response will explain any available appeal process. We will respond in accordance with applicable law and within the required timeframe. Some information may be retained when permitted or required for billing, tax, security, dispute-resolution, or other legal purposes.

For a request concerning homeowner or property-owner information contained in an accepted Revenue Recovery Customer's prior-opportunity records, we may direct the request to, or coordinate the response with, the applicable Customer, consistent with the roles described in Section 5.

11. Children's Privacy

Our services are not directed to children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we collected information from a child, we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy with a new effective date. Material changes affecting active Customers will be communicated as required by applicable law.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Colorado and applicable U.S. federal laws, without regard to conflict-of-laws principles.

14. Contact Us

Questions, concerns, or privacy-rights requests may be sent to support@roofleadhq.com. Other legal notices may be sent to support@roofleadhq.com.

RoofLeadHQ LLC, P.O. Box 591, Como, CO 80432