Privacy Policy

DripEdge.io ("DripEdge," "we," "us," or "our") builds software for roofing and home-services contractors. This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies to:

• this website (dripedge.io and its subdomains);
• the DripEdge web platform, including the estimating, scheduling, mapping, administration, and rep-portal applications ("Platform");
• the DripEdge FieldConnect mobile application ("FieldConnect");
• the DripEdge apps, cards, and workflow actions that install into HubSpot or other third-party platforms from an app marketplace ("Extensions").

Together these are the "Services." By using the Services you agree to the practices described here. If you do not agree, do not use the Services.

1. Our role: controller and processor

Most information that flows through the Services belongs to the contracting business that subscribes to DripEdge (a "Customer"). When a Customer connects its CRM, uploads photos, or enters details about its own homeowners, prospects, job sites, and employees ("Customer Data"), DripEdge processes that data on the Customer's behalf and under its instructions. In privacy-law terms the Customer is the controller and DripEdge is the processor or service provider.

DripEdge acts as a controller only for the limited information it collects for its own purposes: visitor and account-holder information on this website, billing and subscription records, support correspondence, and usage and security logs.

If you are a homeowner or other individual whose information was entered into the Services by a contractor, that contractor is responsible for that information. Please direct privacy requests to them; we will assist them in responding as described in Section 9.

2. Information we collect

Information you or your employer provide

• Account information. Name, work email, phone number, job role, company, brand, and market assignment, supplied when an account is created or invited.
• Customer and property records. Information a Customer enters or imports about homeowners, prospects, job sites, appointments, estimates, claims, warranties, and project notes.
• Photos, documents, and signatures. Photos and files captured or uploaded during inspections and projects; documents generated from templates (for example, warranty letters, proposals, and contracts); and, where a Customer uses electronic signing, the signature image, signer name, email, and the audit trail for that document.
• Form and feedback submissions. Information sent through the demo and support forms on this website and the in-app beta feedback widget, including the note you type and a snapshot of app version and device context.

Information from connected platforms

When a Customer connects a third-party platform, we receive data from that platform only within the permissions ("scopes") the Customer authorizes:

• HubSpot. CRM records and the properties on them (contacts, companies, deals, tickets, leads, tasks, meetings, notes, and any custom objects a Customer authorizes), pipeline and property definitions, owner and user lists, file attachments, and webhook notifications when those records change. Each Extension requests only the scopes it needs, and the scopes are shown to the Customer's administrator during installation.
• CompanyCam. Project names, addresses, coordinates, dates, and photos for projects a Customer chooses to link to a CRM record.
• Zoom Phone and other telephony providers. Where a Customer enables SMS or calling features, phone numbers, user and line assignments, message content and timestamps, call metadata, and, if the Customer turns it on, call recordings and transcripts.
• Google. Calendar events and availability where a Customer connects Google Calendar for scheduling, and address geocoding and map tiles from Google Maps Platform.
• Lead and data vendors. Lead details a Customer routes to us from its lead vendors, and public-record property, parcel, permit, and weather data that we license or collect to enrich a Customer's records.

Information collected automatically

• Location. FieldConnect can use the device's precise location, with your permission, to show your position on territory maps, attach field activity to the right property, and record where a visit occurred. You can revoke this in your device settings at any time. The web Platform may use approximate location derived from an address or IP address to center a map.
• Device and usage data. Device model, operating system version, app version, network state, sync timing, crash and diagnostic reports, pages and features used, and the IP address and browser of each request.
• Cookies and similar technologies. We use strictly necessary cookies and local storage to keep you signed in, remember preferences, and protect against abuse. We do not use third-party advertising cookies or cross-site tracking.

Billing information

If you purchase a subscription, our payment processor collects your payment card details directly. We receive and keep only the billing contact, plan, transaction history, and a token that references the payment method; we never see or store full card numbers.

3. How we use information

• To provide the Services: sync records between FieldConnect, the Platform, and a Customer's connected systems; generate and deliver documents; match photos and projects to records; place records on maps; route messages; and schedule work.
• To operate Extensions inside a third-party platform, including showing data in a record card, running a workflow action the Customer configured, and writing results back to the Customer's records.
• To provide optional AI-assisted features, such as extracting line items from an insurance document or summarizing a recorded call, when a Customer enables them. Content sent to an AI provider is used only to return the result to that Customer.
• To bill for subscriptions and manage accounts.
• To respond to support, demo, and feedback requests.
• To monitor performance, debug problems, detect and prevent fraud and abuse, and secure the Services.
• To understand how the Services are used in aggregate so we can improve them. Aggregated or de-identified data does not identify any person or Customer.
• To comply with law, enforce our terms, and protect the rights and safety of our users and others.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws. We do not use Customer Data to train machine-learning models, and we do not permit our AI providers to do so.

4. HubSpot and other marketplace Extensions

Our Extensions connect to a Customer's HubSpot account (or another platform) through OAuth. This section describes practices specific to those Extensions.

• Authorization. An administrator installs an Extension and sees the exact scopes it requests. We request only the scopes needed for that Extension to work, and we remove any scope we stop using.
• Access tokens. The OAuth tokens that let an Extension act on a Customer's account are stored in access-restricted infrastructure, are used only to perform the functions of that Extension, and are never shared with any third party. Tokens are revoked and deleted when the Extension is uninstalled.
• What we store. To make an Extension fast and reliable we may keep a working copy of the records and properties the Extension uses, the links a Customer creates (for example, between a deal and a CompanyCam project), the templates and settings the Customer configures, generated documents, and a log of each action run. We do not copy a Customer's entire CRM unless a specific Extension requires it and says so.
• Write-back. Extensions write to a Customer's records only where the Customer has configured them to, for example attaching a generated PDF to a deal or setting a property the Customer chose.
• Uninstall. When a Customer uninstalls an Extension, we stop accessing its account immediately, revoke the token, and delete the data we held for that installation within 30 days, except billing records and logs we must keep under Section 7.
• Platform policies. Our use of information received from HubSpot is subject to HubSpot's developer policies. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

5. Messaging and telephony

Where a Customer enables SMS or calling through the Services, the messages and calls are sent from the Customer's own phone numbers and providers. The Customer is responsible for obtaining any consent required to contact a person, honoring opt-out requests, and complying with the Telephone Consumer Protection Act and similar laws. We store message content and call metadata so the Customer can see that history on the related record, and we process opt-out keywords received on those numbers so the Customer can honor them.

6. How we share information

We share information only in these circumstances:

• With your Customer. If your account was provisioned by your employer or the business you work with, that business can see the data you enter and your activity in the Services.
• With connected platforms, at the Customer's direction. Data flows to and from HubSpot, CompanyCam, Zoom, Google, and other systems the Customer connects.
• With service providers that host and operate the Services under contracts that restrict them to acting on our instructions. Our current categories of sub-processors are:

• For legal reasons. To comply with law, a subpoena, or a court order; to enforce our terms; or to protect the rights, property, or safety of DripEdge, our users, or the public. Where allowed, we will notify the affected Customer.
• In a business transfer. If DripEdge is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your consent or at your direction.

We will provide a current, provider-level list of sub-processors on request and will notify Customer administrators before adding a new category of sub-processor that handles Customer Data.

7. Data retention

• Customer Data is kept for as long as the Customer's subscription or installation is active. After termination or uninstall, we delete or de-identify it within 30 days unless the Customer asks us to export it first or the law requires a longer period.
• Generated and signed documents are kept for the life of the Customer's account because they may be legal records of the Customer. On termination they are exported to the Customer or deleted with the rest of Customer Data.
• Account information is kept while the account is active and for up to 90 days after deactivation so an administrator can restore it.
• Billing records are kept for seven years to meet tax and accounting obligations.
• Security, access, and audit logs are kept for up to 12 months.
• Backups roll off on a fixed schedule, typically within 30 days of deletion from the live system.

8. Security

We protect information with safeguards appropriate to its sensitivity, including encryption in transit (TLS) for every connection, encryption at rest at the storage layer, role-based access controls, least-privilege API keys between our own services, signed and verified webhook and card requests from connected platforms, secrets kept in a managed vault rather than in code, and logging and monitoring of production access. Access to Customer Data by DripEdge personnel is limited to what is needed to operate and support the Services.

No system is perfectly secure. If we learn of a breach affecting your information we will notify the affected Customer without undue delay and cooperate with its response, consistent with applicable law. Please report suspected vulnerabilities to hello@dripedge.io.

9. Your choices and rights

• Device permissions. You control FieldConnect's access to location, camera, photos, and notifications in your device settings.
• Connected platforms. A Customer administrator can disconnect any platform or uninstall any Extension at any time from that platform's settings.
• Access, correction, deletion, and portability. You may ask us to access, correct, delete, or export the personal information we hold about you. If your data is managed by a Customer, we will forward the request to that Customer and help them respond.
• Account deletion. To delete your DripEdge or FieldConnect account, email hello@dripedge.io from the address on the account, or ask your administrator. We process deletion requests within 30 days.
• Marketing email. Any marketing email we send includes an unsubscribe link. Service and billing notices are not marketing and will continue while you have an account.

U.S. state privacy rights

Residents of California, Colorado, Virginia, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws have the rights described above, plus the right to opt out of the sale of personal information, targeted advertising, and certain profiling, and the right not to be discriminated against for exercising their rights. We do not sell personal information or use it for targeted advertising or profiling with legal or similarly significant effects. To exercise a right, email hello@dripedge.io. We will verify your request using the email address on your account. You may use an authorized agent; we will ask the agent for proof of authorization. If we deny a request, you may appeal by replying to our decision, and we will respond within the time the applicable law allows.

Users outside the United States

The Services are operated from the United States and are intended for businesses located there. If you access them from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Where the GDPR or UK GDPR applies, our lawful bases are performance of a contract, our legitimate interests in operating and securing the Services, and consent where we ask for it, and you have the additional rights those laws provide, including the right to lodge a complaint with a supervisory authority.

10. Children's privacy

The Services are business tools for adults and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. Third-party sites and platforms

The Services link to and operate inside third-party platforms such as HubSpot, CompanyCam, Zoom, and Google. Those platforms have their own privacy policies, which govern the data you provide to them directly. This policy covers only how DripEdge handles information.

12. Changes to this policy

We may update this policy as the Services and the law change. We will post the updated policy here with a new effective date. For material changes that affect how we handle Customer Data, we will notify Customer administrators by email or an in-product notice at least 14 days before the change takes effect, where practical. Continued use of the Services after the effective date means you accept the updated policy.

13. Contact us

Questions, requests, or concerns about this policy or our data practices? Email hello@dripedge.io. Customers with a signed data processing agreement should also refer to that agreement, which controls in the event of a conflict with this policy for Customer Data.