Privacy Policy

This Privacy Policy explains how Rose Tech HQ LLC (“we”, “us”), which operates LossFolio, handles personal information when you visit lossfolio.com, sign up, or use the LossFolio platform (the “Services”). LossFolio is a business service used by roofing and restoration contractors and their teams.

• We decide how information is used (we act as a “business” or “controller”) for information about our customers' account users, company contacts, billing contacts, website visitors and prospects.
• We process information on our customers' behalf (we act as a “service provider” or “processor”) for the job information our customers put into the Services — for example a homeowner's name, contact details, property address, claim details and property photos (“Customer Data”). Our customer controls that information, and our Data Processing Addendum governs it. See section 10.

Information you or your company give us

• Account and contact information: name, work email, phone, role, company name, company address and billing contact.
• Billing information: billing terms, invoices and payment history. Card details are entered directly with our payment processor, Stripe; we receive only the card brand, last four digits and expiry, never the full card number.
• Orders and jobs (Customer Data): property addresses, homeowner names and contact details, claim and policy numbers, dates of loss, roof specifications, notes, photos, uploaded documents (such as carrier estimates or other measurement reports) and the reports we produce.
• Communications: messages to support, conversations with the in-app assistant, and survey or feedback responses.
• Agreements: acceptance of our agreements, including the name, time, IP address and browser used to accept.

Information collected automatically

• Sign-in and security data: sign-in events, session tokens, IP address, browser and device type.
• Activity records: orders placed, settings changed and administrative actions, kept in an audit log for security and accountability.
• Cookies: only the cookies needed to sign you in and keep your session secure, and a browser setting that remembers light or dark mode. See our Cookie Notice.

Information from other sources

• Your company's administrator, who may create your account or assign you a role.
• Property and weather data sources used to produce reports — for example aerial roof measurements and imagery, geocoding, public weather records (NOAA) and building-code publishers (PLRB). These relate to a property, not to you personally.
• Account executives or referral partners who introduce your company to us.

• Provide the Services: create accounts, produce and deliver reports, measure roofs, price quotes, and support your team.
• Process payments, issue invoices, refunds and account credit, and pay commissions and referral rewards owed on accounts.
• Communicate with you about your account, orders, security, and changes to the Services or our terms. You can opt out of non-essential marketing emails at any time; service and security messages are part of the Services.
• Keep the Services secure: authenticate users, prevent fraud and abuse, investigate incidents, and keep audit records.
• Improve the Services using aggregated or de-identified information that does not identify you, your company or your customers.
• Comply with law, enforce our agreements, and protect the rights and safety of our users and others.

We do not use personal information for purposes that are incompatible with these without telling you first and, where required, getting your consent.

Some features use an AI model to read documents and photos (for example a carrier estimate, another tool's measurement report, or roof photos), to find building-code gaps, or to answer questions in the in-app assistant. The relevant content is sent to our AI provider (listed on our Subprocessors page) only to produce that result. Our AI provider's commercial terms do not permit it to train its models on that content. AI output is reviewed by people before anything is charged or sent, and we do not use AI to make decisions about individuals that produce legal or similarly significant effects.

• Service providers (subprocessors) that host, secure and run the Services on our behalf under contracts that limit their use of the information — see the Subprocessors page.
• Within your company: your company's administrators can see their company's users, orders, reports and activity.
• Your company's account executive (a LossFolio representative or partner assigned to your account) can see your company's account details, pricing, order history and billing status to service the account.
• People you choose to share with: when you email or download a report, you decide who receives it (for example your customer or a carrier).
• Legal and safety: when required by law or legal process, or to protect rights, safety and the security of the Services.
• Business transfers: in a merger, acquisition, financing or sale of assets, subject to this Policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We do not use advertising cookies, tracking pixels or third-party analytics on the Services. Because we don't sell or share, a Global Privacy Control signal or “Do Not Sell or Share” request requires no change — but we honor it as a valid opt-out if our practices ever change. We do not use personal information for profiling that produces legal or similarly significant effects.

• Account information: while the account is active, and deleted or de-identified within 90 days after the account is closed and a deletion request is received, except as below.
• Customer Data and reports: as directed by the customer under the Data Processing Addendum; deleted on the customer's request after the account ends.
• Billing, tax and transaction records: for 7 years, as required for accounting and tax purposes.
• Audit and security logs: for at least 7 years. The audit log cannot be edited or deleted, so we can show who did what.
• Backups: deleted information may remain in encrypted backups until those backups expire on their normal schedule.

We protect information with technical and organizational measures including encryption in transit and at rest, database-level separation between companies, role-based access, an append-only audit log, and logged, time-limited, reason-required support access. Details are on our Trust Center. No system is perfectly secure; if a breach affects your information, we will notify affected customers without undue delay — and within 72 hours of confirming it for Customer Data — and as required by law.

Depending on where you live, you may have the right to: know and access the personal information we hold about you; get a portable copy; correct it; delete it; opt out of sale, targeted advertising and certain profiling (we do none of these); and appeal our decision on your request. Residents of states with comprehensive privacy laws — including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — have these rights by law, and we extend them to everyone who uses the Services.

• How to ask: email service@rosetechhq.com with “Privacy request” in the subject, or ask any LossFolio representative. Tell us what you're asking for.
• Verification: we verify requests by confirming control of the email address on the account and, where needed, a few account details. We never ask for more information than we need.
• Authorized agents: someone can make a request for you with your signed permission; we may ask you to confirm it directly.
• Timing: we respond within 45 days. If we need more time (up to 45 more days), we'll tell you why.
• Appeals: if we decline your request, reply to our decision with “Appeal” in the subject. We'll answer within 60 days. If you're not satisfied, you may contact your state attorney general.
• No discrimination: we will not treat you differently for exercising your rights.

If a contractor used LossFolio for work on your property, that contractor controls your information, and we process it for them. Please send requests about it to the contractor. If you contact us, we'll pass your request to the contractor and help them respond. We never contact, market to or sell information about our customers' customers.

In the past 12 months we have collected the following categories of personal information (as defined in the California Consumer Privacy Act) for the business purposes in section 3, and disclosed them only to the recipients in section 5. We have not sold or shared any of them.

We use sensitive personal information only as needed to provide the Services, so a “limit the use” right does not apply. We do not knowingly collect precise geolocation of individuals, government ID numbers, financial account numbers, health or biometric information.

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.

We store and process information in the United States. If you use the Services from outside the United States, your information will be transferred to and processed in the United States.

We may update this Policy. We'll post the new version here with a new effective date and, for material changes, notify account administrators by email or in the app before they take effect.

Rose Tech HQ LLC, Attn: Privacy, 4 Haddonfield Rd, Cherry Hill, NJ 08002 · service@rosetechhq.com