Privacy Policy

1.1 Tenant Account & Authorized User Information

When a business registers for GraniteRox, we collect the business's name, address, billing information, and the name, email, phone number, and role of each Authorized User (staff, technicians, managers) it adds.

1.2 End Customer Data Submitted by Tenants

Tenants use GraniteRox to manage their own customers and business contacts. This may include, for individuals such as homeowners, insurance adjusters, and vendors:

• Contact information (name, address, phone, email)
• Property and job information
• Photos and videos (including those synced from CompanyCam)
• Moisture, atmospheric, and equipment readings; sketch/scope data
• Insurance claim numbers, adjuster/carrier details, and related correspondence
• Electronic signatures and signing session metadata (IP address, timestamp)
• Communications sent or received through the Service (email/SMS content and metadata)

We process this data solely on behalf of, and at the direction of, the Tenant that submitted it.

1.3 Payment Information

Payment card and bank details are collected and processed directly by our payment processor, Stripe, Inc. GraniteRox does not store full card numbers. We retain limited billing metadata (e.g., subscription plan, invoice history, last four digits of a card) necessary for account administration.

1.4 Location Data

For dispatch, routing, and route-optimization features, the Service may collect approximate or precise location data from technicians' devices while using those features, and property addresses entered by Tenants.

1.5 Automatically Collected / Usage Data

We collect standard technical data such as IP address, browser type, device identifiers, pages visited, and timestamps, via server logs and (where applicable) cookies or similar technologies, to operate, secure, and improve the Service.

We use the information described above to:

• Provide, operate, and maintain the Service (e.g., displaying job records, generating estimates and invoices, sending Tenant-initiated communications, syncing with QuickBooks/CompanyCam/JobTread)
• Process payments and manage subscriptions (via Stripe)
• Provide customer support to Tenants
• Maintain the security and integrity of the Service, including fraud and abuse prevention
• Improve and develop the Service, including AI-assisted features (e.g., claim-evidence analysis, business and marketing analysis, and benchmarking), using aggregated and de-identified data
• Comply with legal obligations and enforce our Terms of Service

GraniteRox does not sell End Customer personal information. GraniteRox does not disclose one Tenant's Customer Data to another Tenant in identifiable form. GraniteRox does produce aggregated, de-identified statistical insights from Customer Data across Tenants — for example, typical marketing-channel performance, cost of acquisition, or job margin by service type and region — and may use those insights to improve the Service and to provide benchmarking, analysis, and suggestions to Tenants. These insights contain no personal information, no communication content, and no direct or indirect identifier of any End Customer, and GraniteRox does not attempt to re-identify them. See our Terms of Service §5.6.

2.1 Aggregated Insights

We create statistical insights from Customer Data across Tenants — for example, how marketing channels perform by region, typical acquisition cost by service type, or seasonal demand patterns. These are produced by irreversible aggregation and are governed by Terms of Service §5.6. They contain no personal information, no message or note content, and nothing that identifies an End Customer. A Tenant may ask us in writing to stop including its data in future insights.

Mobile information. Mobile phone numbers and SMS opt-in consent are never sold, rented, or shared with third parties or affiliates for their own promotional or marketing purposes. Text messaging originator opt-in data and consent are not shared with any third party except the messaging providers strictly necessary to deliver the messages you have asked to receive. You may opt out of text messages at any time by replying STOP, or reply HELP for assistance. Message frequency varies. Message and data rates may apply.

We share information with:

• Sub-processors / Third-Party Services that support the Service's operation, including: Stripe (payments), Intuit / QuickBooks Online (accounting sync), CompanyCam (photo management), Telnyx (SMS and voice delivery), SendGrid (email delivery), JobTread (data sync), and Google Cloud Platform / Firebase (hosting, database, and cloud functions infrastructure). Each of these providers is contractually restricted to using data only to provide their service to us.
• The Tenant's own designated recipients — e.g., when a Tenant sends an estimate, invoice, or claim correspondence to a homeowner, adjuster, or carrier through the Service, at the Tenant's direction.
• Legal and safety purposes — where required to comply with law, legal process, or to protect the rights, property, or safety of GraniteRox, our Tenants, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
• Aggregated Insights — statistical, de-identified information as described in Section 2.1 may be surfaced within the Service to Tenants, or published, in a form that identifies no End Customer or Authorized User.

We do not share End Customer personal information with third parties for their own independent marketing purposes.

We retain Customer Data for as long as the Tenant maintains an active subscription, plus a limited period thereafter (see Terms of Service § 13.4) to allow for data export, followed by deletion in accordance with our standard backup retention cycle. We may retain limited billing and transaction records longer where required for tax, accounting, or legal compliance.

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction, including tenant-level data isolation, encryption in transit, and access controls. No system is completely secure, and we cannot guarantee absolute security.

The Service supports Do-Not-Contact flags (dncEmail, dncSms, dncPhone) that Tenants can use to honor an individual's request not to be contacted. Tenants are responsible for maintaining these preferences accurately and for complying with applicable communications law. Individuals who wish to stop receiving communications from a specific business should contact that business directly using the opt-out method provided in the communication (e.g., unsubscribe link, STOP reply).

Depending on your state of residence, you may have rights to know what personal information is collected about you, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information (GraniteRox does not sell personal information). Because End Customer data is typically collected and controlled by the Tenant business, requests should generally be directed to that business; GraniteRox will provide reasonable assistance to Tenants in fulfilling verified requests as their service provider. Tenant administrators or Authorized Users seeking to exercise rights over their own account information may contact us directly at the email below.

The Service is intended for business use by adults and is not directed to, and should not be used to knowingly collect personal information from, children under 13 (or under 16 where applicable state law requires).

The Service is intended for use by businesses operating in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email to Tenant administrators at least 15 days before taking effect.