The short version
If you read nothing else, read this.
- We hold what you put in — your account, your business details, your jobs, your customers' contact details, your drawings, your photos and your prices.
- We do not sell it, rent it, or use it to advertise to anyone.
- RoofMap is run by a working roofer — and nobody here can open your jobs, your quotes, your prices or your customers. That is worth its own section: read it.
- Your price book is never shown to another subscriber and never shared with a supplier.
- We use no tracking cookies and no third-party analytics. What we measure is twenty-one milestones — did a business set itself up, did it draw a roof, did someone sign in, which screen of the app they were on — and nothing about your customers.
- Roof images and supplier price lists go to an AI service only when you press the button that does that, and are not used to train anything.
- You can get your data out or have it deleted. Ask us and we will do it.
RoofMap is run by a roofer
The obvious question, answered before you have to ask it.
RoofMap is built and run by RoofMap Limited, its own New Zealand company. The person behind it is a working roofer in Northland, who also runs a roofing business of his own. So you are being asked to put your jobs, your customers, your margins and your price book into software owned by another roofer. That is a fair thing to be uneasy about, and the answer is not "trust us" — it is what the software will and will not let anyone do.
What nobody at RoofMap can do
- Open your jobs. Every job, drawing, photo, quote and price book belongs to one business, and every database query the server makes is filtered to the business that asked — there is no screen and no API call that returns another business's rows. An automated test tries to reach one company's job through another company's sign-in, and fails the build if it ever gets through. The founder's own roofing business holds an ordinary RoofMap account with exactly the same walls around it as yours.
- See your work through the support tools. The admin screens we use to run the service show accounts — business name, the owner's name and contact, which plan, how many people, whether the trial has run out, how many roofs have been drawn. They do not show a single job, quote, price, drawing or homeowner. That is not a promise about our manners: an automated test feeds a job full of customer details and prices through every one of those screens and fails the build if any of it comes back out.
- See your price book or your margins. Your rates are never shown to another subscriber, never sent to a supplier, and never used to work out what anyone else should charge.
- Be told who your customers are. When you send us a feedback report from inside the app, it carries the roof's measurements and nothing else — no client, no address, no photo, no price. That is deliberate, and it is pinned by a test too.
The part we will not dress up
Somebody has to be able to reach the database to keep the service running — restore a backup, fix a broken save, work out why an account cannot log in. At our size that is one or two people, and at RoofMap. We are not going to claim a technical impossibility that is not true: what we can tell you is that this access exists to run RoofMap and for nothing else, that the everyday tools deliberately cannot reach your work, and that we do not look at a subscriber's jobs, quotes or prices. If we ever need to look at something of yours to fix a fault you have reported, we will ask you first.
Competing with us
Plenty of RoofMap subscribers compete with the roofing business our founder runs. Nothing about your use of RoofMap is visible to it: not the addresses you quote, not what you charged, not whether you won it. If you would rather not take our word for any of this, ask — we will walk you through exactly what the support screens show, on your own account.
Whose information is whose
Two different relationships, and they matter for who you complain to.
There are two kinds of personal information in RoofMap and we treat them differently.
Yours — we are the agency
Your name, your work email, your business details, and the record of your use of RoofMap. We decide what to do with that, so under the Privacy Act 2020 we are the agency responsible. This policy tells you what we do with it, and your rights in section 11 apply to us directly.
Your customers' — you are the agency
The homeowner's name, site address, phone and email that you type into a job; the photos you take of their roof; the quote you send them. You collected that, for your purposes. We only hold it because you asked us to, and we do nothing with it except run the service for you.
If one of your customers wants to know what you hold about them, or wants it corrected or deleted, that request belongs to you, not to us — you can do all of it in the app. If a customer contacts us directly we will point them back to you and let you know.
What we hold
Four buckets. Everything RoofMap stores is in one of them.
Your account and your business
- Your name, email address, and a password that is stored hashed — nobody here can read it.
- Your business name and, once you set it up, your trading details: phone, office email, website, physical address, GST number, logo and any "about us" text you put on a proposal.
- Who is in your business, what role they have, and outstanding invitations.
- Your plan, your subscription status, and a trial end date if your account has one.
Your work
- Jobs: the client's name, the site address, their phone and email if you enter them, and the job number.
- Roof drawings — outlines, lines, pitches, penetrations, dimensions and the scale you set.
- Any aerial image or photograph you upload or take through the app.
- Your price book, labour rates and quote templates.
- Quotes and proposals, and the record of a customer opening, querying, declining or accepting one, including what they picked and the name they typed when they accepted.
- Snapshots of previous versions of a job, so a bad edit can be recovered.
- Who made a job and who sent the material order.
How the product is used
Twenty-one milestones, per business, with a timestamp: signed up, finished setup, opened the sample job, drew a roof, saved a job, saved a price book, sent a quote, had a quote accepted, sent a material order, made an AI request (counted so a free trial's daily limit can be applied), signed in, drew on the canvas (recorded at most once per half hour), sent a feedback report, spent time in the app (active minutes, in five-minute batches, each batch naming which of the app's main screens it was spent on — Home, Map Roof, Job Pack, Quote, Settings, or one of the order and roof-setup popups), which of those screens was open when the app was closed or put in the background, which path a new account took on its first sign-in (the practice job, the sample job, or neither) and how far through the practice walkthrough it got, where a roof picture came from (satellite, photo or PDF plan — never the picture itself), whether "Help with this step" was pressed, and — before any of those — asked for a setup call. The screen and walkthrough ones exist so we can see where a new roofer gets stuck; they name a screen, never what was typed, clicked or drawn on it, and they feed a daily activity summary that goes to our own support address.
The setup-call one is the only milestone recorded before there is an account. It stores the region, the number of roofs quoted a month and the software already in use — the three answers from the request form — and no name, address or email. What you typed into that form is held separately, as contact details, and is covered in section 3.
That is the entire list. There is no page tracking finer than the named screens above, no record of clicks, no session recording, no third-party analytics tag, and no event carries a customer name, an address or a price. It exists to answer one question — do new subscribers actually get anywhere in their first week — and it is deliberately built so it cannot quietly become anything else.
Errors
When something breaks, we record the error message, where in the app it happened, the version of RoofMap, your business name and the email of whoever hit it — so we can ring the right person. Access tokens, passwords and image data are stripped out before an error is stored or sent anywhere.
Our servers also keep ordinary web logs, including IP addresses, for a short period.
Why we hold it
To run the thing you are paying for, and to keep it working.
- To provide the service — store your jobs, do the sums, produce the job pack, serve the quote link your customer opens, send the emails you ask us to send.
- To keep your account secure and to know who did what inside your business.
- To bill you, and to know which plan you are on.
- To fix it when it breaks — see the errors bucket above.
- To know whether it is working for new subscribers — the twenty-one milestones, and nothing beyond them.
- To talk to you about your account: a failed payment, a price change, a security notice, an outage. These are not marketing and you cannot unsubscribe from them while you hold an account.
We do not sell personal information. We do not share it with advertisers. We do not build profiles of your customers, and we do not use one subscriber's pricing to inform another's.
Who else touches it
The full list of companies your data passes through, and what each one gets.
RoofMap runs on services provided by other companies. Each one only ever gets what it needs to do its job. This is the complete list.
| Who | What for | What they get |
|---|---|---|
| SupabaseDatabase & sign-in | Stores everything, and handles logging in. | All of it. |
| RailwayBackend hosting | Runs the server the app talks to. | Everything, in transit. Server logs. |
| VercelWebsite hosting | Serves the app and the customer quote pages. | Request logs and IP addresses. No job data is stored there. |
| AnthropicAI | Reading a roof outline off an image; reading a supplier price list. | Only the image or file you submit, at the moment you submit it. See section 6. |
| LINZ and EsriAerial imagery | The satellite view you draw on. | The map area being viewed. Not your job data. |
| NominatimOpenStreetMap address lookup | Turning a typed address into a map position. | The address text you search for. |
| GoogleApps Script mail relay | Sending quote emails, material orders, password resets and our own alerts. | The recipient, subject, message and any attached PDF. |
| FergusJob management | Linking a RoofMap job to a Fergus job. Only if you turn it on. | The job and pricing details you push across. |
| StripePayments | Taking subscription payments, once paid plans are live. | Your billing details. Card numbers go to Stripe directly and never reach our servers. |
Several of these are outside New Zealand, so your information is stored or processed overseas. We only use providers that are subject to privacy laws with comparable safeguards, or that are contractually bound to equivalent protections, as required by information privacy principle 12 of the Privacy Act 2020.
Beyond that list, we disclose personal information only where the law requires it — a court order, or a lawful request we are obliged to answer — or where it is necessary to prevent a serious threat to somebody's safety. If we are ever compelled to hand over your data and we are allowed to tell you, we will.
If we add a provider, this table changes before the code ships.
What goes to an AI, and when
Two buttons, both yours to press. Nothing goes automatically.
RoofMap uses Anthropic's Claude for exactly two things:
- Reading a roof outline off an image. When you ask it to trace a roof, the image you are working on is sent, and what comes back is a set of corner coordinates and a suggested pitch.
- Reading a supplier price list. When you upload a CSV or PDF price list, the file is sent, and what comes back is a list of products, units and prices.
Neither happens on its own. Your jobs, your customers' details, your saved price book and your quotes are never sent to an AI service in the background. Nothing is sent unless you press the button that does it.
Anthropic does not use data submitted through its API to train its models. We do not use it to train anything either — we do not train models at all.
Be aware of what you are submitting. An aerial image of a property is personal information about the people who live there, and a supplier price list is commercially sensitive. If you would rather not send either, don't — every measurement in RoofMap can be drawn and calibrated by hand, and every price can be typed in.
Where it is stored
Overseas, on managed infrastructure, encrypted in transit and at rest.
Your data is held in Supabase's managed Postgres service, with the backend running on Railway and the frontend on Vercel. All three run on infrastructure outside New Zealand. There is no New Zealand-resident option today, and we would rather say so here than leave you to find out.
All traffic between your browser and our servers, and between our servers and every provider above, is encrypted with HTTPS/TLS. Data at rest is encrypted by the hosting provider.
What sits on your device
No tracking cookies. Local storage so the app works on a roof with no signal.
RoofMap sets no advertising or tracking cookies, and carries no third-party tags. What it does keep on your device is:
- Your sign-in token and which business you are signed in to, so you are not asked to log in every time.
- Your settings and preferences — panel widths, which tab you were on.
- A local copy of the job you are working on, including photos, held in your browser's storage so the app keeps working with no signal and sends the work up when the signal returns.
That local copy lives on the device until it syncs. Clearing your browser data, or signing out, removes it — along with any work that had not reached our servers. On a shared or borrowed device, sign out when you are done.
How it is protected
Separation between businesses is enforced on every query, and tested.
- Every job, setting and price book is scoped to the business that owns it, and every query the server makes is filtered by that business — a request can only ever reach its own company's rows. A test suite tries to cross that line through an id in a URL, and fails the build if it succeeds.
- Passwords are hashed by Supabase Auth. Nobody at RoofMap can see one.
- Sessions are signed tokens that expire, and are checked on every request.
- Customer quote links are guarded by a long random token, and stop working when the quote is withdrawn or the account is closed.
- Access to production data is limited to the people who need it to run the service — and what the everyday support tools can reach is narrower still: accounts, never anyone's work (why that matters here).
- Errors are monitored, and secrets are stripped before an error is recorded or sent.
- Changes are covered by an automated test suite that runs on every deployment.
A fuller account — how the customer quote links work, what sits on a phone on site, how the Fergus key is held, and the list of what we have not built yet — is on the security page.
No system is perfect, and we would rather say so than imply otherwise. If there is ever a privacy breach that is likely to cause serious harm, we will notify the affected people and the Office of the Privacy Commissioner, as the Privacy Act 2020 requires.
How long we keep it
While you're a subscriber, plus 60 days. Then it goes.
| What | How long |
|---|---|
| Your account and your jobs | While the account is open, then 60 days after it closes. |
| Job version history | With the job it belongs to. |
| Backups | Rolling, on our database provider's schedule — a deleted item can persist in a backup for a short period after deletion, then it is gone. |
| Usage milestones | 24 months, then deleted automatically. No customer information in them. |
| Error records | Held in memory only, most recent 200, cleared whenever the server restarts. |
| Billing records | 7 years, as New Zealand tax law requires. |
| Server logs | As long as our hosting providers keep them — a short rolling window. |
You can delete a job yourself at any time, which removes it and its history. If you want your whole account gone sooner than 60 days, ask us and we will do it.
Your rights
Access, correction, deletion, and a complaint to the Privacy Commissioner if we get it wrong.
Under the Privacy Act 2020 you can ask us to:
- Show you what personal information we hold about you.
- Correct it if it is wrong. Most of it you can correct yourself in Settings.
- Give you a copy of your data in a usable format, including your jobs.
- Delete your account and its data.
Email support@roofmap.co.nz. We will confirm we have your request and respond within 20 working days, which is what the Act requires. There is no charge.
Some things we may have to keep even after a deletion request — a billing record we are required to hold for tax, for instance. We will tell you if that applies and why.
Remember the distinction in section 2: if the request is about your customer's information, it comes to you, not to us.
Changes to this policy
Same 30 days' notice as the Terms.
We will update this policy as the product changes. For a change that materially affects how we handle your information — a new provider in section 5, a new purpose in section 4 — we will give at least 30 days' notice by email and change the version and date at the top. Older versions are in the public repository this site is built from, so you can see exactly what changed and when.
Contact and complaints
Come to us first. If we don't sort it out, the Privacy Commissioner is free.
RoofMap Limited — privacy enquiries
900 Horeke Road, RD 1, Okaihau 0475
Email: support@roofmap.co.nz
If you are not satisfied with how we have handled a privacy matter, you can complain to the Office of the Privacy Commissioner. It costs nothing.
privacy.org.nz · enquiries@privacy.org.nz · 0800 803 909