Privacy Policy

Last updated 2026-09-10

RoofCRM (roofcrm.ecbtx.com) is operated by ECB TX LLC, a Texas limited liability company. This policy explains what data RoofCRM stores when a roofing company and its customers use the product, why, how long we keep it, who else touches it, and how to have it deleted.

What we store

RoofCRM is a CRM: it exists to store the information a roofing company needs to run its business. Depending on how a company uses it, that can include:

Company and user details — company name and address, and the name, email, phone, and role of each person the company adds as a user.
Homeowner (customer/lead) details — names, property addresses, phone numbers, and email addresses entered by the roofing company or submitted through a lead form.
Photos — job-site and inspection photos uploaded by the roofing company.
Signatures — the signature image, name, and e-sign audit details (timestamp, IP address, consent text, and a hash of the signed document) captured when a homeowner accepts an estimate.
Payment links — where a company uses Stripe-backed payment links, RoofCRM stores the link/reference used to collect payment. Card numbers are never stored by RoofCRM; Stripe handles the actual payment.
Storm data — hail and storm event records (dates, locations, severity) sourced from public weather data, associated with property addresses so a company can see storm history on a lead.

Why we store it

Every category above exists to run the CRM feature it belongs to: pipeline tracking, estimates and e-signature, invoicing, insurance claim tracking, jobs and scheduling, and the storm/hail lead engine. We do not collect data for any purpose beyond operating the product for the company that owns the account.

How long we keep it

We retain account data for the life of the account, plus 30 days after cancellation or closure, to allow for accidental-cancellation recovery and any legally required record-keeping window. After that period, the data is deleted from active systems.

Who else processes it (subprocessors)

RoofCRM runs on a small set of infrastructure and service providers, each of which processes data only as needed to provide their piece of the service:

Railway — application hosting and the production database.
Cloudflare R2 — object storage for uploaded photos and documents.
Stripe — payment processing for payment links (RoofCRM never stores card numbers).
Google Workspace — outbound transactional email (invite emails, estimate/invoice notifications) sent through a Workspace mailbox.

No sale of personal data

We do not sell personal data to third parties, and we do not use homeowner or company data for advertising. Data entered into a RoofCRM account belongs to and is used for that company's own business — it is not shared across companies or sold to anyone.

Your control and deletion

A company can request deletion of its account and all associated data at any time by emailing the support address below with "Data Deletion" in the subject. We will confirm and complete the deletion within a reasonable time, subject to any data we are legally required to retain longer.

Some companies also connect social accounts (Facebook, Instagram, Google Business Profile, and others) to surface reviews, mentions, and messages, and to publish posts. That is opt-in per platform through each platform's own OAuth consent screen — we only access what the company explicitly authorizes for the accounts it connects, tokens are encrypted at rest, and disconnecting a platform in RoofCRM immediately deletes the stored tokens for it.

Contact

Questions about this policy or a data-deletion request: will@txhailleads.com.