Data and privacy

Instant Roofer is operated by Up On The Roof Technologies, Inc. d/b/a Instant Roofer. The Privacy Policy and Terms of Use apply to Instant Roofer services. This page explains the data used by its AI assistant connection.

What connecting shares

You sign in to Instant Roofer and choose permissions on the consent screen. The connection acts as your team member at your company. Your assistant receives the results of the tools it calls within those permissions. These results may include:

• Your name, company, account entitlements and configured measurement limits.
• Customer and lead names, property addresses and job identifiers. Phone and email are omitted from searches unless the assistant requests contact details for the user's task.
• Roof locations, outlines, dimensions, confidence information and report files.
• Stored project price estimates, including any saved solar cost assumptions, only when requested through the measurement tool's includeEstimates option.
• Quote line items, prices, totals, financing information and payment status.
• Project photos and documents, captions, tags, note text and transcripts. Photo and field-pitch capture coordinates are omitted unless the assistant requests location metadata for the user's task. Device details and internal note audit fields are not returned in structured results.
• Webhook field mappings, delivery settings and redacted request previews.

Only connect an assistant you authorize to access this information. Your assistant provider processes tool results under its own terms and privacy settings. Do not paste existing passwords, payment card details or authentication codes into a conversation.

For Roofing company platform tools, record IDs needed to retrieve or attach the selected records, property locations needed for roof work, and dates needed to understand recency, status or expiry are retained. Account responses omit internal user IDs, raw privilege lists and company creation dates. Report lists omit download links; request a selected report for its files. Media lists return previews; request a selected asset for its original download link. These response limits do not edit the contents or embedded metadata of stored photos, documents or reports.

Actions and external services

Address and building workflows use mapping and measurement providers. Human-Certified report orders send the property and supplied homeowner details to the drawing service; credits or payment authorization are used after approval. Card details stay in the billing workflow and are not requested by these tools.

If you request a location notification, the map link can be sent by push notification, text or email. Anyone holding a live confirmation link can view and confirm that location. New measurements can also trigger your company's enabled webhooks. Webhook delivery sends the selected fields to the destination you configure. Creating, enabling, changing or testing a webhook can therefore share data outside Instant Roofer.

Public quote links grant access to their holder. Requesting one creates or refreshes that access and may regenerate a PDF; it does not itself send a customer message. Report and media download links should also be treated as shareable access links. An expiry on a signed download governs that URL; it does not retract a downloaded copy or establish the access policy of another stored or public link.

Webhook tools hide authentication header values, fixed custom values and destination URL paths and query strings in results. Test results omit destination response bodies and arbitrary response headers. Configure existing secrets through the authenticated dashboard; when asking the assistant to create a new integration, use a fresh integration secret.

Records and expiration

The service stores connection and permission records, tool audit records and temporary rate-limit counters. Audit records identify the account, assistant, tool, time, duration and outcome. They can include an input hash, request IP and user agent, plus selected action facts such as location-verification status or webhook identifiers and delivery outcomes. These records support security, troubleshooting and usage history. Hashing an input is not a promise that the resulting record is anonymous.

Temporary data has the following lifetimes in the integration's active storage:

• A pending sign-in/permission request expires after 30 minutes or is removed when completed or declined. A one-use authorization code expires after 5 minutes or is removed when exchanged.
• An access-token session expires after 1 hour. A replacement-token cache used for connection retries expires after 10 minutes. Refresh tokens are valid for 30 days from issuance; refreshing issues a new token with a new 30-day lifetime. Token validity does not establish a deletion deadline for the persistent connection or token-history records.
• A location-confirmation record expires after 30 minutes. When a requested push, text or email notification is recorded, its lifetime becomes 24 hours from that notification. The temporary record can contain property coordinates, a preview link, confirmation details and the notification recipient. Declining or consuming the confirmation preserves only its remaining lifetime; it does not delete business records created from it.
• An Instant Measure PDF download handoff expires within 15 minutes, or sooner if the signed source link expires first. This removes the temporary handoff record, not the stored PDF.
• Requesting an image gallery temporarily copies the permitted saved images and measurement/address metadata for display. Those image copies and their link records expire after 15 minutes. Anyone holding a live image link can view the image. Expiry does not delete original images or retract downloaded copies.
• The per-connection tool-call rate counter expires after 60 seconds. Other security counters use their own bounded windows.

Connection, permission and audit records do not use these short temporary-data lifetimes. Business records, including customer records, measurements, reports, quotes and original media, also have separate lifecycles. Quote links use the expiration returned with that quote link; other file and media links may have different access rules. Expiration of a link does not establish deletion of the underlying file, database row, provider log or backup. For retention criteria and deletion requests, see the Privacy Policy.

Disconnecting and deletion requests

You can revoke a connection in Company Settings → AI Assistants in the dashboard. Revocation stops future access through that connection and removes its refresh-token rows. Existing access-token cache entries expire within their original one-hour lifetime and are rejected after revocation; connection and audit history remain. Revocation does not delete business records, undo deliveries, retract shared links or remove information already returned to an assistant.

Use the dashboard to manage webhooks and available quote/media controls. Temporary MCP download links expire automatically; disconnecting does not cancel them. For removal of stored content or a share link that has no suitable dashboard control, contact Instant Roofer.

To request access to or deletion of integration data, use the contact details in the Privacy Policy, Section 13. Identify the account/company and the records or connection involved; do not send passwords, authentication codes or access tokens. Information already delivered to an assistant provider or another recipient must also be managed through that recipient's privacy controls.