Privacy Policy

1. Information we collect

• Account and profile information: name, email, phone, authentication and verification records, contact preferences, referral attribution, and saved signatures you choose to provide.
• Customer and job information: property addresses, inspection requests, appointment times, job photos, uploaded documents, insurance and adjuster details, work scope, signatures and approval records, messages, and job progress.
• Financial records: job amounts, recorded payments and refunds, payment methods and references, referral rewards, commissions, and crew charges. Recording a payment does not initiate a bank transfer. Do not upload unnecessary full card numbers or banking credentials.
• Technical and security information: IP addresses, device/browser information, session identifiers, request/error logs, audit events, and information used by our abuse-prevention and CAPTCHA providers.
• Optional connected-service information described below. We also receive referral information from participants who confirm permission to contact the homeowner.

2. How we use information

We use information to authenticate users, enforce workspace and crew permissions, respond to roofing inquiries, coordinate inspections and work, store approved documents, communicate about jobs, maintain payment and referral records, deliver requested notices, investigate errors or abuse, and meet legal and recordkeeping obligations.

Referral participation does not require buying a roof. Shared links preserve valid attribution but do not expose private CRM records. Public signing and confirmation links provide limited access to their intended request; they are not general access to a customer’s profile.

Referral leaderboard sharing is off by default. If you enable it in your client portal, your chosen display name and total earned referral rewards, including documented adjustments, are visible to active signed-in members of the same referral program. This does not reveal your contact details, jobs, referral tree, unpaid balance, or payment history. You can turn sharing off in Account or Leaderboard; future leaderboard requests then exclude your entry. Others may have copied information while it was shared.

3. Google account and Gmail data

Google mailbox connections are optional and initiated by an authorized team member. We access the connected email address and account identity to verify the sending mailbox, and store encrypted authorization credentials on the server to maintain the connection. Sending access allows GoldLabel to send the recipients, subject, message, and files you choose through Gmail when you explicitly send an email.

Gmail read access is separately requested when you enable the customer inbox. GoldLabel checks Inbox sender metadata, then retrieves and stores matching customer message content and threading information for known lead contact addresses. The initial import covers the preceding 30 days; later checks retrieve new matching replies. Unmatched message content is not saved in GoldLabel. Original received attachments remain in Gmail. Opening an imported message in GoldLabel does not mark it read or delete it in Gmail.

Imported correspondence is visible according to existing job permissions: sales representatives see their connected mailbox’s matched messages for assigned leads; CEO/COO may see matched customer correspondence across connected company mailboxes. These access rules are also disclosed when connecting the customer inbox. Private unsent drafts remain personal. We do not make your mailbox public.

GoldLabel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the disclosed features. We do not sell it, use it for advertising, creditworthiness decisions, or general-purpose AI/model training.

Transfers of Google user data are limited to providing the authorized features with consent, security purposes, legal requirements, or a business transfer with the required prior consent. Human access to Google user data is limited to your affirmative agreement to the disclosed collaboration features, security investigation, legal requirements, or permitted aggregated internal operations. Google data is not provided to data brokers or advertising platforms.

4. Calendars, maps, and other connected services

If you connect a calendar, GoldLabel and its calendar provider may access calendar identifiers, time zones, availability, and event details needed for your calendar view and appointment synchronization. Availability checks use busy intervals to avoid scheduling conflicts. Connected personal event details are restricted to the account owner’s calendar view; job appointments are shared only with authorized participants. Calendar permissions and availability depend on the provider you authorize.

Optional Microsoft mailbox connections send the emails and selected attachments you approve. The integration can prepare drafts and attachments in Outlook; interrupted preparation may leave an unsent draft. Our email connection notice explains provider-specific behavior.

Maps and address suggestions send address/search text, the visible map area, and technical request information to configured mapping providers such as Google Maps and Geoapify. Choosing a location feature may send a location bias with your browser’s permission. Google Street View previews are temporary and are not stored as job uploads. Map requests do not include customer names, private notes, insurance records, or documents. See the maps privacy notice and maps terms.

5. Sharing and service providers

We share information with authorized employees, job participants, and crews only as permitted for their work. Crews do not receive customer prices, internal documents, or insurance records through their portal. Direct referral details are limited; deeper referral participants are anonymized in the client portal.

Service providers process information necessary to host, authenticate, store, secure, and operate the app, including Vercel, Supabase, Cloudflare, and configured email, SMS, calendar, and mapping services. Their infrastructure may process information outside your location. Embedded Quick Learn videos and external links, including Google Maps directions, are subject to the destination provider’s policies.

When you send an email, text, or file, the selected content goes to the provider and recipient and may be retained outside GoldLabel. We may disclose information when required by law, to protect security and rights, or in a lawful business transfer. The additional Google Limited Use restrictions above continue to apply to Google-derived data.

6. Storage, security, and retention

We use encrypted connections, account verification, role and row-level access controls, private file storage, limited file links, and audit records to protect information. Connection credentials are encrypted on the server. Required management accounts use authenticator verification. No system can guarantee absolute security; keep credentials and private signing links secure.

We retain account and job records while needed to provide services and maintain accurate business, payment, signed-document, and audit history, and for legal, tax, dispute, fraud-prevention, and backup obligations. Disconnection stops future connected-service access but does not automatically erase previously saved job correspondence, sent emails, or completed financial obligations. Backups may retain prior copies until their normal retention cycle expires.

7. Your choices, disconnection, and deletion

Update your profile and available contact preferences in Account or Settings. Email/SMS notices depend on configured delivery services and your applicable preferences or consent; required operational and security notices may still apply. You may opt out of supported text notices by replying STOP.

Pause customer inbox checks or disconnect a mailbox in Settings → Email. Disconnecting removes the stored mailbox connection credentials; saved customer correspondence is retained according to the recordkeeping rules above. Manage calendar connections in Settings → Calendar. You may also revoke GoldLabel access in your Google Account connections or other provider’s account settings.

To request access, correction, account closure, deletion of stored Google-derived messages, or deletion of other personal information, email info@goldlableroofing.com. Identify the account and the request without sending passwords, authenticator codes, full card numbers, or other unnecessary sensitive information. We verify identity and authority before making changes, and explain records that must be retained. Applicable privacy rights depend on your location.

8. Cookies, age limits, and policy updates

We use Vercel Web Analytics to measure visits and page views, including browser/device and approximate location statistics. Analytics page URLs are reduced to general app sections; query strings, fragments and record identifiers are removed, and private signing and verification pages are excluded. We do not send form contents, customer names, messages, documents, financial amounts or Google mailbox content as analytics events. We respect supported Do Not Track and Global Privacy Control browser signals. Vercel describes its cookie-free visitor measurement in its Web Analytics privacy notice.

Authentication cookies and local device storage keep sessions, drafts, and preferences available. Security providers may use cookies or similar technology for abuse prevention. We do not use Google API data for advertising tracking. Clearing device storage may sign you out or remove unsaved drafts.

The app is intended for adults and business use, not children under 18. Contact us if you believe a child has supplied personal information.

We publish changes here with an updated date and provide additional notice when appropriate. Before using Google data for a new purpose outside the previously disclosed permissions, we update disclosures and obtain the required additional consent.