Privacy Policy

1. Who we are

Spencer Roofing ("we", "us") is operated from Colorado, United States. This policy covers www.thedenverroofer.com and every form, chat, and tool on it. Questions about anything here: email [email protected] or call 720-360-8546.

2. What we collect

• What you type into a contact form: your name, email address, phone number, property address, the service you need, project details, how you heard about us, and your marketing consent choices.
• What you type into the chat assistant: your questions and, if you book an inspection from the chat, your name, phone number, and property address. Chat conversations are stored, and a short summary of your questions is attached to your inspection request so we have context when we call you.
• What you type into the storm-risk checker: the property address you enter to get a storm-damage risk report.
• Ordinary technical records: IP address and request logs, kept for security and for keeping the site running, plus the Google Analytics cookies described in section 5.

We are not after sensitive information such as health details, finances, or government IDs, and the forms never ask for it. Please do not type it into them, including into the chat.

3. How we use it

To respond to your request, provide estimates, schedule and perform roofing work, answer your questions through the chat assistant, generate the storm-risk report you asked for, handle billing, insurance claims, and legal obligations, and operate, secure, and improve the site. Marketing email or text messages are sent only if you opt in on a form, and you can opt out at any time: click unsubscribe in any email, reply STOP to any text, or contact us directly. We keep records of your consent choices. Nothing else: no targeted advertising, no ad profiles, no selling or renting of your data, and no automated decisions with legal effects.

4. Who processes it

We do not sell or rent personal data. The services below process it for us, each receiving only what its job needs:

• Resend and AWS SES deliver our email, including the notification we get when you submit a form.
• Neon hosts the database where form submissions and chat transcripts are stored.
• Railway hosts the website and its server.
• Cloudflare sits in front of the site as an edge and delivery network.
• Anthropic powers the AI chat assistant: the messages you type into the chat are sent to Anthropic's API to generate replies, and transcripts are stored so we can review them.
• MyRoofRisk generates the storm-risk reports: the address you enter into the storm-risk checker is sent to our myroofrisk.com service to produce your report.
• Google provides Analytics (section 5), the embedded maps on our contact pages, and the fonts the site loads.
• Our own central lead-operations system, where contact submissions are also stored so we can respond to them. This is our internal infrastructure, not a sale or a disclosure to another business.

Beyond those: we disclose information if the law requires it (a valid subpoena, a court order, or to prevent real harm), and if the business is ever acquired or merges, this data transfers with it, still under this policy's promises. Nobody else.

5. Cookies, analytics, and privacy signals

We use Google Analytics to understand how the site is used (which pages people visit, roughly where visitors come from). It sets cookies whose names start with _ga to tell returning visitors apart. We use this only in aggregate; we do not use it for advertising.

You can opt out of Google Analytics in several ways: enable the Global Privacy Control signal in your browser and we simply will not load Google Analytics for you (we honor GPC), block or delete cookies in your browser settings, or install Google's own opt-out browser add-on at tools.google.com/dlpage/gaoptout.

The embedded Google Maps on our contact pages and the Google Fonts the site loads may also involve requests to Google; those are governed by Google's privacy policy.

6. How long we keep it

• Contact and inspection requests: while we are working with you and for our business records afterward, or deleted earlier any time you ask (subject to the legal retention below).
• Chat transcripts: kept so we can review the assistant's answers and follow up on requests, deleted on the same schedule as contact requests.
• Project, billing, and insurance records: as long as tax, lien, insurance, and warranty law require, typically up to 7 years after a project.
• Marketing consent records: as long as we send you marketing, plus the period the law requires us to be able to prove consent.
• Request logs: a short rolling window, weeks not years.

After that, data is deleted or anonymized unless a legal obligation requires keeping it longer.

7. Your rights

Email [email protected] to see what we hold about you, correct it, get a portable copy of it, or have it deleted, whatever state you live in. Requests are free. We verify requests by confirming you control the email address or phone number on file, and we answer within 45 days (the law allows one 45-day extension for complex requests, and we will tell you if we need it). We will never treat you worse for exercising these rights.

Colorado residents have these rights by statute under the Colorado Privacy Act, plus the right to opt out of data sales, targeted advertising, and profiling (we do none of those, so that opt-out is already the permanent state), and a right to appeal: if we refuse a request, reply and say so, and your appeal will get a fresh look and an answer within 45 days. If you are still unsatisfied, you can contact the Colorado Attorney General.

8. Children

This site is not directed to children under 13, and we do not knowingly collect their information. If you believe a child's information reached us, email us and we will delete it.

9. Security

Traffic is encrypted in transit and access to stored data is restricted. No system is perfectly secure, so we promise care, not invulnerability. If a breach affects your information, we will notify you as Colorado law and any other applicable law require.

10. Where the data lives

On servers in the United States. If you use the site from somewhere else, your information is processed here, and the data protection laws of your country may differ.

11. Changes to this policy

If this policy changes materially, the new version will be posted here with a new effective date before it takes effect.

12. Contact us