Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between RoofGo LLC, organized in Mississippi, which operates RoofGo (“RoofGo”, “we”, “us”)and the business that uses RoofGo (“Customer”, “you”). It applies whenever RoofGo processes personal information on your behalf, mainly the homeowner details your team puts into RoofGo (“Customer Personal Data”). It applies automatically; you do not need to sign anything. If your company needs a countersigned copy, request one by email.

1. Roles

You are the controller (or “business”) of Customer Personal Data and decide why and how it is used. RoofGo is your processor (or “service provider” or “contractor”) under the US state privacy laws that apply, such as the California Consumer Privacy Act, and processes it only for you. You are responsible for having a lawful basis to collect it and to give us these instructions.

2. Instructions

We process Customer Personal Data only to provide RoofGo under the Terms, as you direct through your settings and use of the service, or as the law requires. If the law requires us to process it some other way, we will tell you first unless the law forbids that. If we think an instruction breaks the law, we will tell you.

3. What we will not do

• Sell or share Customer Personal Data.
• Use it for targeted or cross-context behavioral advertising, for our own marketing, or for any other customer.
• Keep, use or disclose it for any purpose other than providing RoofGo to you, or outside our direct business relationship with you.
• Combine it with personal information we get from anyone else, except as the law allows a service provider to.
• Use it to train AI models.

We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop and fix any unauthorized use.

De-identified data. As the law allows a service provider, we may de-identify Customer Personal Data and combine it with other de-identified data in aggregate form. Once it cannot reasonably be linked to a person or household it is no longer Customer Personal Data, and these limits and the deletion terms below do not apply to it. We will not try to re-identify it, we will keep reasonable measures to prevent that, and anyone we share it with must agree to the same.

4. Our people

Only RoofGo staff who need access to run and support the service can reach Customer Personal Data, and they are bound to keep it confidential. When staff access your account to help you, it is recorded in your audit log.

5. Security

• Encryption in transit (HTTPS) for every connection.
• Each company’s data separated, with every database query limited to the signed-in company and checked against the person’s role.
• Passwords stored as salted one-way hashes.
• Sign-in throttling, single-use sign-in links and an audit log of access, billing and settings changes.
• Personal details removed from error reports before they leave the app.

6. Subprocessors

You authorize RoofGo to use these subprocessors. Each is bound by written terms that protect the data at least as well as this DPA, and we remain responsible for them.

• Google Maps Platform (Maps, imagery, address search and roof data): Addresses and map locations, and the address text you type into search, to show maps and satellite imagery, find addresses and measure roofs.
• Stripe (Payments): Billing name, email, address and payment details, to take payments. Card numbers go straight to Stripe and never reach RoofGo.
• Resend (Email delivery): Recipient addresses and message content, to deliver sign-in links, account notices and the estimates a roofing company emails to a homeowner.
• Vercel (Hosting and web analytics): Hosting for the RoofGo website and app, which means every request passes through it, and Vercel Web Analytics for page view counts.
• Neon (Database): The database where account, company and homeowner records are stored.
• Sentry (Error monitoring): Error reports from the app. Cookies, sign-in headers, request bodies, user details, IP address headers and secret link tokens are removed before a report is sent.
• Anthropic (AI drafting (AI add-on only)): Only for companies that use the AI add-on: the property facts a rep asks it to work from (such as the address, homeowner name, door history, notes and estimate figures), to draft a follow-up or note.

We will update this list and email account owners at least 30 days before adding or replacing a subprocessor. If you object for a reasonable data protection reason and we cannot address it, you may cancel and we will refund any prepaid fees for the time after cancellation.

7. Helping with requests

RoofGo lets you look up, correct, export and delete Customer Personal Data yourself. If a homeowner or a regulator contacts us directly about it, we will pass the request to you and will not answer it ourselves unless you ask us to or the law requires it. We will give you reasonable help with requests, assessments and consultations that concern RoofGo.

8. Security incidents

If we confirm a breach of security that leads to unauthorized access to, or loss of, Customer Personal Data, we will tell the account owner without undue delay and within 72 hours of confirming it. We will share what we know, what we are doing about it, and what you may need to do, and we will help you meet your own notification duties.

9. Deletion and return

The account owner can download Customer Personal Data at any time from Account in the app. When the company account is deleted, we delete Customer Personal Data from our live systems within 30 days, and it leaves our backups within 30 days after that, unless the law requires us to keep it.

10. Information and audits

On request, and no more than once a year unless there has been an incident, we will answer a reasonable security questionnaire and give you the information you need to show that we meet this DPA.

11. Where data is processed

RoofGo is offered in the United States. Customer Personal Data is processed in the United States and wherever our subprocessors operate.

12. Liability and order of precedence

The limits of liability in the Terms apply to this DPA. If this DPA and the Terms disagree about personal data, this DPA wins.

Contact