Privacy Policy

Account information. When you create an account we collect your name, email address, date of birth, and a hashed copy of your password. We collect your date of birth solely to confirm you meet our minimum age requirement; it is not used for any other purpose. If you contact us or provide a business phone number, we collect that number too. If you enable two-factor authentication we store the encrypted secret used to verify your codes.

Quote information. When you request a quote we collect the property address, ZIP, roof and structure details you enter, any phone number you or a homeowner contact provide, and any photo you choose to upload. We pass the address to third-party APIs to retrieve satellite imagery, parcel data, and roof geometry. Generated quote PDFs are stored in our database and linked to your account so you can revisit them.

Conversion tracking. If you mark a quote as closed in your dashboard we store the optional sale amount and note you provide.

Widget telemetry. When the Truss embed widget loads on a contractor's website we record an event with the hosting domain, IP address, user agent, and the type of event (impression, quote attempt, quote completion).

Demo abuse controls. To prevent abuse of the free live demo we set a long-lived truss_demo_id cookie and compute a hash of basic browser characteristics (canvas rendering, screen size, language, timezone, user agent). The hash is combined with your IP address and used solely to count demo quotes per visitor.

Logs. Like every web service we maintain server logs that include IP address, timestamps, request paths, and error traces.

We use the information described above to:

• Run the satellite-measured estimator and produce quote PDFs.
• Authenticate you, secure your account, and operate two-factor login.
• Bill paid plans and process subscription changes.
• Send transactional emails (verification, password reset, quote PDF, receipts).
• Show contractors the quotes their account generated and any conversions they mark.
• Surface aggregated widget usage in the contractor dashboard.
• Detect and prevent fraud, abuse, or other violations of these policies.
• Comply with applicable law and respond to lawful requests.

We do not sell or rent your personal information. We do not use your data to train third-party AI models beyond the prompts and completions required to generate your specific quote.

How we may contact you. Truss may contact business contacts by phone and email about the service, including sales outreach, onboarding, support, and account notices. You can opt out of these communications at any time: email privacy@trussquote.org or tell us so during a call. We maintain an internal do-not-call list, honor removal requests immediately, and retain that list for at least five years. We do not send SMS marketing messages without your prior express written consent.

We rely on the following service providers to operate the platform. They process information only on our instructions and under written confidentiality and security obligations:

• Vercel: hosting, edge network, server logs, anonymous traffic analytics.
• Railway: API hosting, managed PostgreSQL database (account data, quotes, audit logs), and private file storage.
• Stripe: subscription billing, payment method storage, receipts. We do not see or store your full card number.
• Purelymail: transactional email delivery (verification, password reset, quote PDFs, contact form).
• Google Maps Platform: address autocomplete, geocoding, satellite imagery, and roof solar/geometry data used in measurement.
• OpenAI: large language model that reviews each quote and analyzes optional user-uploaded roof photos. Photos and prompts are sent to OpenAI's API; we use only providers that contractually do not train on submitted data.

We may also disclose information when required by law, in response to a valid legal process, to protect the rights or safety of Truss or our users, or in connection with a merger, acquisition, or asset sale (with notice to you).

Account, quote, and conversion records are retained while your account is active. Uploaded roof photos are deleted from private object storage immediately after analysis or when removed by the user. Generated quote PDFs persist with the quote record. Server logs are kept for up to 90 days. You may request deletion of your account and associated data at any time by contacting privacy@trussquote.org. Some records (billing history, audit logs, fraud signals) may be retained longer where required by law.

We set the following cookies on this site:

• better-auth.session_token: HttpOnly session cookie used to keep you logged in.
• truss_demo_id: HttpOnly cookie that counts free demo quotes per visitor.

We use Vercel Web Analytics, which records anonymous, aggregated traffic information without third-party advertising trackers. We do not run advertising or cross-site tracking cookies.

Data is encrypted in transit (TLS) and at rest. Passwords are hashed using a modern key-derivation function. Two-factor authentication is available on every account. Access to user data is restricted to personnel who need it to operate the service. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach of your personal information occurs, we will notify affected users and the applicable regulators as required by law, including Fla. Stat. 501.171.

Truss is not directed to minors and is intended only for users who are at least 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact privacy@trussquote.org and we will delete it.

Depending on your jurisdiction you may have the right to access, correct, delete, or port your personal data, to limit or object to certain processing, and to opt out of any “sale” or “sharing” of personal information. Truss does not sell or share personal information for cross-context behavioral advertising.

To exercise any right, email privacy@trussquote.org from the email address associated with your account. We will verify your identity and respond within 30 days, or 45 days where extension is permitted by law. You may appeal a denial in the same channel.

Truss operates in the United States. If you access the service from outside the US, your information will be transferred to and processed in the US and other countries where our subprocessors operate.

We may update this policy from time to time. Material changes will be communicated via email or a prominent in-app notice at least 14 days before taking effect. Continued use after that date constitutes acceptance.

Questions about this policy should be directed to privacy@trussquote.org.