Roof Rise is an underwriting tool for real estate investors. That means the most sensitive thing you give us usually isn't your email address — it's your deal: the property, the numbers, and what you're willing to pay. This policy explains what we collect, why, who processes it on our behalf, and what you can ask us to do with it.
This policy applies to roofrise.app and the Roof Rise web application ("Roof Rise", "we", "us"). It covers visitors to the marketing site, users of the free calculators, and subscribers on paid plans.
It does not cover third-party sites we link to. When you follow a link out — to a lender, a competitor comparison, or a processor's own policy — you're on their terms, not ours.
Below is the data we collect, grouped by where it comes from.
| Category | What's in it | Where it comes from |
|---|---|---|
| Account identity | Email address, display name, and — if you use Google Sign-In — the name and profile photo on your Google account. | You, when you create an account. |
| Profile and branding | Display name, photo, company name, logo, mailing address, phone number, website, Instagram, Facebook, LinkedIn, brand color, default city, and unit preferences. | You, optionally, on the Account page. Only what you choose to fill in. |
| Your deal data | Saved scenarios and projects: purchase prices, financing terms, rents, rehab budgets, partnership splits, tags, and the free-text names you give them. | You, as you use the calculators. |
| Subscription and billing | Your plan, subscription status, and a customer identifier issued by our payment processor. Card numbers are handled entirely by that processor and never reach our servers or database. | Our payment processor, when you subscribe. |
| Support messages | The subject and message text you send through the help form, along with your user id and email so we can reply. | You, when you contact support. |
| Team membership | For shared workspaces: the team name, who owns it, which accounts are members, and the email addresses of people invited but not yet joined. | The team owner, when inviting members. |
| Error diagnostics | When something breaks: the error and stack trace, the page it happened on, your browser and version, and your account's internal user id. See "Error monitoring" below for what is deliberately excluded. | Automatically, only on an error. |
| Usage and analytics | Which pages and calculators you open, what you save or export, roughly where in the world you are (from your IP address), and your device and browser type — across the marketing site and inside the application. We record the shape of what you do, never the contents: that a calculator was opened, not the price you typed into it. | Automatically as you use the site and the app, unless you've turned analytics cookies off. |
| Advertising and campaign measurement | On our public marketing pages: your IP address, device and browser details, the pages you viewed, how you arrived, and whether you took an action such as starting a trial. If you subscribe, a scrambled (hashed) version of your email address may be used to match the signup to the ad you clicked. | Cookies and similar tags placed by our advertising partners. Not active inside the app — see "Advertising" below. |
Saved scenarios are the reason this policy exists in the form it does. We treat them as confidential business information, not as content.
A practical warning worth reading: several calculators have a free-text "Property Name" field, and in practice people type a real street address into it. Whatever you type there is stored and included in reports you generate. If you'd rather it not be, use a nickname.
There is one use we do reserve, and we'd rather state it plainly than hide it in a definition. We may produce de-identified, aggregated data from deal information — patterns like typical cap rates in a market, or which assumptions investors revise most often — and use it to operate, analyze, and build new Roof Rise features, which may include training machine-learning models.
Before deal data is used that way we remove what ties it to you or to a particular property: your account and profile details, the free-text names you gave a scenario, and address-level detail. We don't try to re-identify the result, we don't let anyone else try, and we don't release it in any form that could single out one of your deals. Aggregated output like this describes the market, not your file — and everything above still holds for the identifiable version, which is never sold, published, or sent to an advertising partner.
We use the information above to operate the service and for no unrelated purpose:
On that first point: California law defines "selling" and "sharing" more broadly than the exchange of money — broadly enough that using common advertising cookies can count, even though no one pays us for your data. We describe exactly what those cookies do in the next section, and how to switch them off.
We advertise Roof Rise on search engines and social media platforms. To know whether that spending works, our public marketing pages carry cookies and small measurement tags provided by those advertising partners.
These tags run on our marketing pages only — the landing page, pricing, feature and comparison pages. They are not active inside the application, where your scenarios, projects, and profile live. Your deal data is never transmitted to an advertising partner.
Our advertising partners set their own cookies and receive the data described in the table above directly from your browser. They act independently of us and may combine what they collect with information they already hold about you — including from your account with them, if you have one. Their own privacy policies govern that use, and we can't control it on your behalf. The section below tells you how to limit it.
We don't run ads on Roof Rise itself. You will never see a third-party advertisement inside the product, and we don't provide our user list to anyone who wants to advertise to you.
We don't run our own servers. The providers below handle data for us, each for a specific job. We describe them by the role they play rather than by company name — publishing a component-by-component map of our infrastructure mainly helps people looking for a way in. If you need the current named list, for a vendor review or a data-protection assessment, email support@roofrise.app and we'll send it.
The first four are service providers in the strict sense: they're bound by agreements with us, act on our instructions, and are not permitted to use your data for their own purposes. The analytics provider is engaged on the same footing, with the platform settings that would otherwise let it use your data to improve its own products switched off, so it cannot use your data to improve its own products. Advertising platforms, listed last, are different in kind — they use what they collect for their own purposes as well, which is why they get their own section above.
| Role | What it does for us | What it handles |
|---|---|---|
| Identity and database provider | Account authentication and data storage. | Your email, name, sign-in credentials, profile, scenarios, projects, teams, and support messages. |
| Payment processor | Payments and subscription management. | Your name, email, payment card details, and billing history. Card data goes to the processor directly and is never stored by us. |
| Hosting and content delivery provider | Website and application hosting. | Standard server request logs, including IP address, as a normal part of serving the site. |
| Error monitoring provider | Diagnosing crashes and failures. | Error reports as described below — diagnostics and an internal user id, not your account email or your deal figures. |
| Analytics provider | Measuring which pages and calculators get used, across the marketing site and the application. | Page and interaction events, IP address, and device and browser details. Never the contents of your scenarios or projects — see "What we don't do". |
| Advertising platforms | Ad campaign measurement and retargeting, on our public marketing pages only. | Marketing-page browsing data as described in the table above, and a hashed email for signup matching. Never your deal data. Unlike the four above, these partners use what they collect for their own purposes too — see "Advertising". |
We may also disclose information if we're legally required to — a valid subpoena, court order, or equivalent legal process — or where necessary to protect our rights or someone's safety. If Roof Rise is ever acquired or merged, account data would transfer as part of that business, and we'd notify you before it changed hands.
Adding a provider in a new role is a change to this policy, and we'll update the date at the top when it happens. Swapping one vendor for another in a role already listed here doesn't change what's collected or why, so it won't always trigger a new date — ask us if you want to know who's current.
When the app hits an error, we send a report to our error-monitoring provider so we can fix it. What's in that report was designed around one rule: report the shape of the problem, not your data.
Several independent routes, because no single one covers everything:
Opting out doesn't mean fewer ads, only less relevant ones — and it doesn't affect your account, your saved work, or anything you're paying for. Because these opt-outs are stored as cookies or browser settings, clearing your cookies will clear them too.
Your account data, scenarios, and projects are kept for as long as your account is open, because that's the service — your saved work should still be there next year.
You can view and change most of your information yourself, on the Account page. For anything else, email support@roofrise.app and we'll handle it.
We honor these requests for everyone who asks, wherever you live, rather than only where a specific law compels it. We'll respond within 30 days, and we won't penalize you for asking — no worse price, no reduced service, no closed account because you exercised a right. To protect your account, we may need to verify your identity before acting on a request, though never for an advertising opt-out, which takes effect immediately.
Two limits, stated here rather than left to be discovered. First, if a request is manifestly unfounded, excessive, or a repeat of one we've already answered, we may decline it or ask for a reasonable fee to cover the work, and we'll tell you which and why. Second, some processing is inseparable from the service: we can't store your scenarios without storing your scenarios, take your payment without sending it to a payment processor, or keep you signed in without a session. If you ask us to stop or restrict something in that category, we can't honor the request and keep your account running at the same time — so we'll explain the conflict and let you choose. You can withdraw the request, or we'll close your account and refund any prepaid time you haven't used. What we won't do is quietly carry on processing against your wishes and say nothing.
If you'd like someone to act for you, an authorized agent can make a request on your behalf with written permission we can verify.
Data is encrypted in transit and at rest by our infrastructure providers. Access to the production database is limited to what's needed to operate the service. All writes to your data go through authenticated server-side endpoints — the app in your browser cannot write directly to the database, which limits what a compromised browser session can do.
No system is perfectly secure, and we won't claim otherwise. If a breach ever affects your personal information, we'll notify you and any regulator that requires it, without undue delay.
Roof Rise is operated from the United States, and our processors store and process data on servers in the United States. If you use Roof Rise from outside the US, you're sending your information to the US, where privacy laws differ from those in your country.
We do not currently hold an international data-transfer mechanism — no Standard Contractual Clauses, no Data Privacy Framework certification. We also do not target or market Roof Rise outside the United States: pricing is in US dollars, our advertising is US-only, and the calculators model US financing, US tax treatment, and US 1031 exchanges.
You can use Roof Rise from anywhere. If you are in the UK or the European Economic Area, we ask for your consent before setting any analytics or advertising cookie, and we honor your answer. This is a US product operated from the US, and you should decide with that in mind.
Roof Rise is a professional tool and isn't directed at children. We don't knowingly collect information from anyone under 18. If we learn we have, we'll delete it.
When we change this policy we'll update the date at the top. Adding a new processor, collecting a new category of information, or using your information for a new purpose all count as changes worth telling you about — for anything material we'll notify account holders directly rather than quietly editing the page.
Questions about this policy, or about your data, go to support@roofrise.app and a person will answer.