PRIVACY POLICY

Last updated October 1, 2025

This Privacy Notice for RoofEra LLC (" we," " us," or " our"), describes how and why we might access, collect, store, use, and/or share (" process") your personal information when you use our services (" Services"), including when you:

Visit our website at https://roofera.ai, or any website of ours that links to this Privacy Notice
Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at ryan@roofera.ai.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.

Do we collect any information from third parties? We collect limited information from third-party services, such as calendar providers and social login providers, but only when you choose to connect those accounts, as explained in Sections 1, 6, and 7.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

How do we use calendar and Google user data? For details about how we handle Google Calendar data and Google user data, including what we collect, how we use it, and how you can control it, see Sections 6 and 7 of this Privacy Notice.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

6. HOW DO WE USE CALENDAR INTEGRATION SERVICES?

7. GOOGLE USER DATA DISCLOSURE

8. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

9. HOW LONG DO WE KEEP YOUR INFORMATION?

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

11. DO WE COLLECT INFORMATION FROM MINORS?

12. WHAT ARE YOUR PRIVACY RIGHTS?

13. CONTROLS FOR DO-NOT-TRACK FEATURES

14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

15. DO WE MAKE UPDATES TO THIS NOTICE?

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Optional Features and Data Collection. Some features of our Services require additional data access. For example, our Sales Agent feature offers calendar integration to enable automated appointment scheduling. Connecting your Google Calendar or Microsoft Calendar is entirely optional—you can use other RoofEra features (such as our website chatbot) without providing calendar access. Calendar data is only collected and processed if you explicitly choose to connect your calendar for the Sales Agent scheduling functionality.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

names
email addresses
business names
business websites
contact preferences
contact or authentication data
job titles
passwords
usernames
calendar information (only when you choose to connect Google Calendar or Microsoft Calendar for Sales Agent scheduling features)

Sensitive Information. We do not process sensitive information.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is handled and stored byStripe. You may find their privacy notice link(s) here: https://stripe.com/privacy.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Google API

Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
To enable appointment scheduling features. We may process your calendar information to provide scheduling functionality through our Sales Agent feature, including checking availability and creating appointments.
To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see " WHAT ARE YOUR PRIVACY RIGHTS?" below.
To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We do not sell, rent, or trade your personal information (including Google user data) to third parties. We do not share your personal information with advertising platforms, data brokers, or information resellers.

We may need to share your personal information in the following situations:

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, only where the recipient agrees to protections at least as strong as those in this Privacy Policy and where explicit user consent is obtained when required.
Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Notice. Affiliates include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
Service Providers. We share personal information with trusted service providers who process data on our behalf solely to operate, maintain, and support RoofEra's user-facing features, under strict confidentiality and data protection obligations. These service providers include:
- Nylas (calendar integration provider) - Facilitates secure connections to Google Calendar and Microsoft Calendar for appointment scheduling
- OpenAI (AI service provider) - When you use our Sales Agent feature with calendar integration enabled, we share calendar availability information (dates and available time slots) with OpenAI to enable the AI voice assistant to schedule appointments in real-time during phone calls. OpenAI does not receive full calendar event details, only free/busy availability data needed for scheduling
- Infrastructure and hosting providers
All service providers are contractually obligated to use your data only for providing our Services and are prohibited from using your data for their own purposes, including AI model training.
Legal and Security Purposes. We may disclose your information when reasonably necessary to investigate suspected abuse, fraud, or security incidents, or to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.

To the extent these online tracking technologies are deemed to be a "sale"/"sharing" (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of these online tracking technologies by submitting a request as described below under section "DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?"

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: http://roofera.ai/cookie-policy.

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Notice govern your use of the AI Products within our Services.

Use of AI Technologies

We provide the AI Products through third-party service providers ("AI Service Providers"), including Deepgram, OpenAI, Google Gemini and ElevenLabs. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in " WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" When you use the Sales Agent with calendar integration, calendar availability data (dates and open time slots) is shared with OpenAI to enable real-time appointment scheduling. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products

Our AI Products are designed for the following functions:

AI applications
AI automation
AI bots
AI insights
Text analysis

How We Process Your Data Using AI

All personal information processed using our AI Products is handled in line with our Privacy Notice and our agreement with third parties. This ensures high security and safeguards your personal information throughout the process, giving you peace of mind about your data's safety.

5.1 Data Shared with AI Models

In order to provide our AI-powered Sales Agent (for handling incoming phone calls) and Website Agent (for website chat support), our Services employ machine learning models using third-party AI models. We require our AI service providers to use your information only for the purpose of providing our Services. We do not allow those providers to train their AI models using your data.

The following data types may be shared with these AI models:

Sales Agent (Voice Call Handling):

Audio recordings of phone conversations between homeowners/customers and the AI assistant
Call metadata including dates, times, duration, and phone numbers
Homeowner information such as names, phone numbers, addresses, and appointment preferences
Roofing contractor business data including company name, services offered, pricing information, and availability
Calendar availability data (dates and open time slots) shared with OpenAI to enable real-time appointment scheduling during calls

Website Agent (AI Chatbot):

Chat conversation content between website visitors and the AI chatbot
Homeowner/visitor contact information including names, email addresses, and phone numbers
Property addresses provided for roof estimate calculations
Uploaded documents or website content used to train the chatbot on the contractor's business
Roofing contractor business data including services, FAQs, policies, and pricing

This data is processed for the sole purpose of delivering the AI-powered services described above and is not used for any other functions within the AI models. Our agreements with AI service providers contractually prohibit them from using your data to train or improve their own AI models.

Important clarification about calendar data: When the Sales Agent schedules appointments during phone calls, it shares only calendar availability information (which dates and times are free) with OpenAI. The AI agent then generates the appointment details (event title, description, location) during the call, which are created as calendar events through our calendar integration provider (Nylas) and stored in our database for dashboard and reporting purposes.

Google Calendar data is never used for AI model training: To be absolutely clear, your Google Calendar data (including availability information shared with OpenAI for real-time scheduling) is never used to train, improve, or develop any AI models. OpenAI processes availability data only to enable the Sales Agent to schedule appointments during phone calls and does not retain this data for training purposes. This prohibition extends to all calendar data we collect from Google Calendar.

5.2 User Consent and Opt-Out

AI processing is fundamental to RoofEra's core services—both the Sales Agent and Website Agent are AI-powered products. By signing up for RoofEra and enabling these features, you consent to the AI processing described in this section.

Because AI is essential to how these services function, opting out of AI processing means you would need to discontinue use of the AI-powered features (Sales Agent and/or Website Agent) or close your account entirely. If you wish to stop using AI-powered features or have questions about your data, you can contact us using the contact information provided in this Privacy Notice.

6. HOW DO WE USE CALENDAR INTEGRATION SERVICES?

In Short: Calendar integration is optional and only used for appointment scheduling. We access your calendar data solely to provide user-facing scheduling features.

RoofEra supports calendar integration to enable appointment scheduling features within the RoofEra platform. You can connect either your Google Calendar or Microsoft Calendar (via Microsoft 365/Outlook) to enable automated scheduling for our Sales Agent feature. Calendar integration is entirely optional and is only used when you explicitly choose to connect your calendar.

When you connect your Google account, you authorize RoofEra to access and use certain Google Calendar data solely to provide the appointment scheduling functionality described in this section. RoofEra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft Calendar connections use similar OAuth-based authentication and are processed through our calendar integration provider (Nylas) to provide the same scheduling functionality.

The detailed disclosures below apply to both Google Calendar and Microsoft Calendar integrations, with specific Google Calendar requirements noted where applicable.

What calendar data we collect

When you choose to connect your calendar (Google Calendar or Microsoft Calendar) to RoofEra, we collect the following types of calendar data:

Primary calendar access – We access your primary calendar only (not additional calendars you may have)
Event metadata – Event IDs, titles, start and end times, dates, time zones, and attendee email addresses for events on your primary calendar
Event location and reminder settings – Basic location information and reminder preferences for calendar events
Availability information (free/busy) – Your calendar availability status to prevent double-booking when scheduling appointments

We collect this data only when you explicitly choose to connect your calendar for the Sales Agent scheduling feature. This data is essential for providing the core appointment scheduling functionality of our Sales Agent product.

Important note about AI and training: Your calendar data is never used to train AI models. When we share availability information with OpenAI for real-time scheduling during phone calls, this data is processed immediately for scheduling purposes only and is not retained by OpenAI or used for any AI model training.

Note for Google Calendar users: This section describes the Google user data we collect when you connect your Google Calendar. The same types of data are collected when you connect Microsoft Calendar.

What data we access and how we access it

When you choose to connect your Google Calendar to RoofEra, we request the following scopes:

https://www.googleapis.com/auth/calendar.readonly – to view calendar metadata and event information.
https://www.googleapis.com/auth/calendar.events – to create, read, update, and delete calendar events on calendars you grant access to.

Using these scopes, RoofEra may access:

Your primary calendar (we do not access additional calendars you may have)
Event metadata such as event IDs, titles, start and end times, dates, time zones, and attendee email addresses
Basic event location and reminder settings
Availability information (free/busy) needed to avoid double-booking

We do not access Gmail, Drive, Contacts, or any other Google product unless you separately authorize additional scopes in the future (and this Privacy Policy is updated accordingly).

All access to your Google Calendar data occurs via a secure OAuth 2.0 flow. RoofEra never sees your Google password.

Why we request this data (how we use it)

RoofEra accesses Google Calendar data only to provide user-facing features that are visible and prominent in our product, including:

Allowing the AI Sales Agent to check your availability in real time during calls or web chats
Scheduling roof inspections and other appointments directly onto your calendar
Sending you and your customers relevant booking details (such as appointment time and location)
Sharing calendar availability information (free/busy status and open time slots) with our AI service provider (OpenAI) so the AI Sales Agent can schedule appointments during phone calls in real-time

These calendar scheduling features are core to the Sales Agent product and are prominently displayed in the RoofEra dashboard interface where users explicitly enable and configure calendar scheduling.

We do not use your Google Calendar data for advertising, retargeting, interest-based profiling, credit-worthiness assessments, or any other purposes prohibited by the Google API Services User Data Policy.

How we store and protect this data

RoofEra follows data-minimization and security best practices:

We store calendar event metadata (event titles, descriptions, appointment times, and customer contact details) for events created through RoofEra for as long as you maintain an account with us. This enables appointment history viewing in your dashboard and supports reporting features.
Calendar data is accessed in real time as much as possible and not retained beyond what is required to provide and maintain scheduling functionality, logs, and audit trails.
All data is encrypted in transit (TLS/HTTPS) and protected using industry-standard security controls.

We do not intentionally store sensitive event content or attachments from your Google Calendar that are not required for scheduling, and we do not build advertising profiles from your calendar data.

Security measures for Google Calendar data:

We implement multiple layers of security to protect your Google Calendar data:

Encryption in transit: All data transmitted between your device, our servers, and Google's servers uses TLS/HTTPS encryption to prevent interception
Encryption at rest: Calendar data stored in our databases is encrypted at rest using industry-standard encryption protocols
OAuth 2.0 authentication: All access to your Google Calendar occurs via secure OAuth 2.0 authentication flow; we never see or store your Google password
Access controls: Strict role-based access controls limit which systems and personnel can access calendar data
Secure credential management: Authentication tokens and API credentials are securely managed by our calendar integration provider (Nylas) and are not directly accessible to RoofEra application code
Audit logging: All access to calendar data is logged and monitored for security purposes

Third-party service provider (Nylas)

RoofEra uses Nylas, Inc. ("Nylas") as our calendar integration service provider. Nylas facilitates connections to both Google Calendar and Microsoft Calendar. When you connect your calendar:

You authenticate through Nylas's secure OAuth flow (you will see nylas.com on the consent screen).
Nylas acts as our authorized data processor to facilitate the secure connection between RoofEra and your calendar (Google Calendar or Microsoft Calendar).
Nylas processes calendar data on our behalf solely to provide the scheduling functionality described above.
Authentication credentials (such as refresh tokens and access tokens) are securely managed by Nylas using their hosted authentication service and are not directly accessible to RoofEra.
Nylas is contractually obligated to protect your data and comply with applicable data protection policies, including the Google API Services User Data Policy and Limited Use requirements for Google Calendar connections.
Nylas does not use your calendar data for its own advertising, data resale, or unrelated purposes.

Additional AI Service Provider (OpenAI):
To enable the Sales Agent's real-time appointment scheduling feature during phone calls, we share calendar availability data (dates and available time slots) with OpenAI. OpenAI receives only free/busy information needed for scheduling and does not receive full calendar event details. OpenAI is contractually prohibited from using this data for training AI models or for any purpose other than providing our Services. The availability data is processed in real-time for scheduling purposes only and is not retained by OpenAI for training, model improvement, or any other purpose.

How we share calendar data

RoofEra does not sell or transfer your calendar data (Google Calendar or Microsoft Calendar) to advertising platforms, data brokers, or information resellers.

We may share or transfer calendar data only in the following limited circumstances:

Service providers:
With trusted vendors (such as Nylas and our hosting/infrastructure providers) who process data on our behalf solely to operate, maintain, and support RoofEra’s user-facing features, under strict confidentiality and data protection obligations.
Security and legal compliance:
When reasonably necessary to investigate suspected abuse, fraud, or security incidents, or to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
Corporate transactions:
In connection with a merger, acquisition, or sale of assets, only where the recipient agrees to protections at least as strong as those in this Privacy Policy and where explicit user consent is obtained when required.

We do not use or share your calendar data for advertising, retargeting, or credit-related decisions.

Human access to calendar data

RoofEra does not allow humans to read your calendar data on a routine basis. Human access is strictly limited to:

Situations where you explicitly request or consent to support or troubleshooting that requires viewing specific calendar-related logs or data;
Investigating potential security incidents, abuse, or technical issues; or
Complying with applicable law, regulation, or legal process; or
Using aggregated, de-identified data for internal operations where individual users and events cannot be identified.

All employees and contractors who may access such data are bound by confidentiality obligations and must follow this Privacy Policy and applicable data protection policies.

Your control and revocation

You retain full control over your calendar connections:

You can disconnect the integration in your RoofEra account settings (where available).
For Google Calendar: You can revoke RoofEra's and Nylas's access at any time via your Google Account permissions page.
For Microsoft Calendar: You can revoke access through your Microsoft account permissions page.

Revoking access will stop RoofEra from accessing your calendar and may disable related scheduling features, but will not affect other parts of RoofEra that do not rely on calendar integration.

You may also request deletion of stored calendar data associated with your account by contacting us at ryan@roofera.ai. Subject to our legal obligations, we will delete or de-identify stored calendar data within 30 days of your request.

Changes to calendar data usage

If we change how we access, use, store, or share your calendar data, we will update this Privacy Policy and, where required, notify you and obtain your consent before applying those changes to existing data. For Google Calendar specifically, we will limit our use of Google user data to the practices explicitly disclosed in the then-current version of this Privacy Policy.

7. GOOGLE USER DATA DISCLOSURE

In Short: This section provides a comprehensive disclosure of how we collect, use, store, share, and protect Google user data in compliance with Google API Services User Data Policy.

This section specifically addresses Google user data to ensure full transparency and compliance with Google's requirements. If you connect your Google Calendar to RoofEra, the following disclosures apply:

What Google User Data We Collect

When you choose to connect your Google Calendar to enable Sales Agent scheduling features, we collect the following Google user data:

Google Calendar event metadata: Event IDs, titles, descriptions, start and end times, dates, time zones, event locations, attendee email addresses, and reminder settings from your primary calendar
Google Calendar availability information: Free/busy status to prevent double-booking when scheduling appointments
Google account profile information: Your name and email address associated with your Google account (collected during OAuth authentication)

We collect this data only when you explicitly authorize RoofEra to access your Google Calendar. We do not access Gmail, Google Drive, Google Contacts, or any other Google services.

How We Use Google User Data

We use Google user data solely to provide the following user-facing features that are prominent in the RoofEra Sales Agent interface:

Real-time availability checking: The AI Sales Agent checks your Google Calendar availability during phone calls to find open appointment slots
Appointment scheduling: The Sales Agent creates calendar events for roof inspections and appointments directly on your Google Calendar
Appointment notifications: We send appointment confirmations and reminders to you and your customers
Dashboard display: We show scheduled appointments in your RoofEra dashboard for easy management and reporting

Prohibited uses: We do NOT use Google user data for:

Advertising, retargeting, or interest-based profiling
Training AI models or machine learning (this prohibition is absolute and contractual with our AI service providers)
Selling to data brokers or information resellers
Credit-worthiness assessments or lending purposes
Any purpose other than providing the scheduling features described above

How We Store Google User Data

Event metadata storage: We store calendar event metadata (titles, descriptions, times, customer details) for appointments created through RoofEra for as long as you maintain an active account. This enables appointment history viewing and reporting features in your dashboard.
Availability data: Calendar availability information is accessed in real-time during scheduling and is not permanently stored. When shared with OpenAI for real-time scheduling during calls, this data is processed immediately and not retained by OpenAI.
Encryption: All Google user data is encrypted in transit using TLS/HTTPS and encrypted at rest in our databases using industry-standard encryption protocols (AES-256-GCM).
Access controls: Strict role-based access controls limit which systems and personnel can access Google user data.

How We Share Google User Data

We do not sell, rent, or trade your Google user data to third parties. We do not share your Google Calendar data with advertising platforms, data brokers, or information resellers.

We share Google user data only in these limited circumstances:

Service Providers (Nylas): We use Nylas as our calendar integration provider to facilitate secure connections between RoofEra and Google Calendar. Nylas processes Google Calendar data on our behalf solely to provide scheduling functionality. Nylas is contractually obligated to comply with the Google API Services User Data Policy and does not use your data for its own purposes.
AI Service Provider (OpenAI): When the Sales Agent schedules appointments during phone calls, we share only calendar availability information (free/busy status and open time slots) with OpenAI—not full calendar event details. OpenAI is contractually prohibited from using this data for AI model training or any purpose other than providing our Services. This data is processed in real-time for scheduling purposes only and is not retained by OpenAI.
Security and Legal Compliance: We may disclose Google user data when reasonably necessary to investigate security incidents, abuse, or fraud, or to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
Corporate Transactions: In connection with a merger, acquisition, or sale of assets, only where the recipient agrees to protections at least as strong as those in this Privacy Policy and where explicit user consent is obtained when required.

How We Protect Google User Data

We implement multiple layers of security to protect your Google user data:

Encryption in transit: All data transmitted uses TLS/HTTPS encryption
Encryption at rest: All stored Google user data is encrypted using AES-256-GCM encryption
OAuth 2.0 authentication: We never see or store your Google password; all access uses secure OAuth 2.0 tokens
Secure credential management: Authentication tokens are securely managed by Nylas and are not directly accessible to RoofEra application code
Access logging: All access to Google user data is logged and monitored
Limited human access: Humans cannot access your Google Calendar data except when you explicitly request support, for security investigations, or to comply with law

Data Retention and Deletion of Google User Data

Active accounts: We retain calendar event metadata for appointments created through RoofEra for as long as you maintain an active account with us
Disconnected calendars: If you disconnect your Google Calendar integration, we retain historical appointment data but will no longer access your Google Calendar
Account deletion: When you delete your RoofEra account, we will delete or de-identify your Google user data within 30 days, subject to legal retention requirements
User-requested deletion: You may request deletion of your Google user data at any time by contacting us at ryan@roofera.ai, and we will delete or de-identify this data within 30 days

Your Control Over Google User Data

You have full control over your Google Calendar connection:

Disconnect in RoofEra: You can disconnect Google Calendar integration in your RoofEra account settings
Revoke via Google: You can revoke RoofEra's access at any time via your Google Account permissions page
Request deletion: You can request deletion of stored Google user data by contacting us at ryan@roofera.ai

Revoking access will stop RoofEra from accessing your Google Calendar and may disable related scheduling features, but will not affect other RoofEra features that do not rely on calendar integration.

Limited Use Disclosure

RoofEra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This means:

We use Google user data only to provide or improve user-facing features that are prominent in the RoofEra interface
We do not transfer Google user data to third parties except as explicitly disclosed in this Privacy Policy (service providers, security purposes, legal compliance, or corporate transactions with user consent)
We do not allow humans to read your Google user data except with your explicit consent, for security purposes, to comply with law, or when using aggregated and de-identified data for internal operations

Changes to Google User Data Usage

If we change how we access, use, store, or share Google user data, we will update this Privacy Policy and notify you before applying those changes to existing data. Where required, we will obtain your consent before implementing any material changes to our use of Google user data.

8. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which users have an account with us.

Calendar Data Retention: For calendar events created through RoofEra's Sales Agent, we store event metadata (titles, descriptions, appointment times, and related customer information) for as long as you maintain an active account with us. This data is retained to provide dashboard functionality, appointment history, and reporting features. If you disconnect your calendar integration, we will retain historical appointment data but will no longer access your calendar. You may request deletion of stored calendar data at any time by contacting us at ryan@roofera.ai, and we will delete or de-identify this data within 30 days of your request, subject to our legal obligations.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process, including:

Encryption in transit: All data transmitted between your device and our servers uses TLS/HTTPS encryption
Encryption at rest: Our database provider encrypts all stored data at rest
Application-level encryption: Sensitive data is additionally encrypted using AES-256-GCM encryption with authenticated encryption
Access controls: Strict access controls limit who can access personal information
Secure credential management: Authentication tokens and API credentials are securely stored and managed through our infrastructure providers

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at ryan@roofera.ai.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section " HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section " HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. For further information, please see our Cookie Notice: http://roofera.ai/cookie-policy.

If you have questions or comments about your privacy rights, you may email us at ryan@roofera.ai.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

Category	Examples	Collected
A. Identifiers	Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name	YES
B. Personal information as defined in the California Customer Records statute	Name, contact information, education, employment, employment history, and financial information	NO
C. Protected classification characteristics under state or federal law	Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data	NO
D. Commercial information	Transaction information, purchase history, financial details, and payment information	NO
E. Biometric information	Fingerprints and voiceprints	NO
F. Internet or other similar network activity	Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements	NO
G. Geolocation data	Device location	NO
H. Audio, electronic, sensory, or similar information	Images and audio, video or call recordings created in connection with our business activities	YES
I. Professional or employment-related information	Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us	NO
J. Education Information	Student records and directory information	NO
K. Inferences drawn from collected personal information	Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual's preferences and characteristics	NO
L. Sensitive personal Information		NO

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

Receiving help through our customer support channels;
Participation in customer surveys or contests; and
Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for:

Category A - As long as the user has an account with us
Category H - As long as the user has an account with us

Note on Calendar Data: Calendar data (calendar events, availability information) from Google Calendar or Microsoft Calendar is only collected when you choose to connect your calendar for the Sales Agent feature. This data falls under Category H. Google Calendar data is processed in accordance with the Google API Services User Data Policy as detailed in Section 6 of this Privacy Notice.

Sources of Personal Information

Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, " HOW DO WE PROCESS YOUR INFORMATION?"

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, " WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. Wewill not sell or share personal information in the future belonging to website visitors, users, and other consumers.

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

Right to know whether or not we are processing your personal data
Right to access your personal data
Right to correct inaccuracies in your personal data
Right to request the deletion of your personal data
Right to obtain a copy of the personal data you previously shared with us
Right to non-discrimination for exercising your rights
Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending upon the state where you live, you may also have the following rights:

Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
Right to review, understand, question, and correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Minnesota)
Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can contact us by submitting a data subject access request, by emailing us at ryan@roofera.ai, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at ryan@roofera.ai. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at ryan@roofera.ai or contact us by post at:

RoofEra LLC

2205 W 136th Ave Ste 106 PMB 2382

Broomfield, CO80023

United States

PRIVACY POLICY

SUMMARY OF KEY POINTS

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

Google API

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

5.1 Data Shared with AI Models

5.2 User Consent and Opt-Out

6. HOW DO WE USE CALENDAR INTEGRATION SERVICES?

What calendar data we collect

What data we access and how we access it

Why we request this data (how we use it)

How we store and protect this data

Third-party service provider (Nylas)

How we share calendar data

Human access to calendar data

Your control and revocation

Changes to calendar data usage

7. GOOGLE USER DATA DISCLOSURE

What Google User Data We Collect

How We Use Google User Data

How We Store Google User Data

How We Share Google User Data

How We Protect Google User Data

Data Retention and Deletion of Google User Data

Your Control Over Google User Data

Limited Use Disclosure

Changes to Google User Data Usage

8. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

9. HOW LONG DO WE KEEP YOUR INFORMATION?

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

11. DO WE COLLECT INFORMATION FROM MINORS?

12. WHAT ARE YOUR PRIVACY RIGHTS?

Account Information

13. CONTROLS FOR DO-NOT-TRACK FEATURES

14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

Categories of Personal Information We Collect

Sources of Personal Information

How We Use and Share Personal Information

Your Rights

How to Exercise Your Rights

Request Verification

Appeals

California "Shine The Light" Law

15. DO WE MAKE UPDATES TO THIS NOTICE?

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?