Privacy Policy

Vertex CRM is a business tool that our customers (roofing and related contractors) use to run their operations. When you are an account holder or Workspace member, we act as the controller of your account information and the information we collect to operate the Service.

When our customer stores information about their own clients, homeowners, suppliers, employees, or other third parties in the Service (“Customer Data”), the customer determines what information is collected and how it is used, and we process that information on the customer’s behalf and under their instructions. The customer is responsible for their own privacy practices and for having any required notices and consents. If you are such a third party and have questions about how a business uses your information, or wish to access or delete it, please contact that business directly; we may refer your request to them.

We collect the following categories of information:

• Account and profile information — such as your name, email address, password credentials, profile details, workspace and company details, and role.
• Workspace and Customer Data — the content you and your team submit to or generate in the Service, including contacts and leads, job records, roof measurements, proposals and estimates, material and work orders, invoices, payments and expenses, catalog items, calendar events, notes, messages, files, and photos.
• Billing information — subscription, seat, and usage details, and payment information processed by our third-party payment processor. We do not store full payment-card numbers on our own servers.
• Communications — messages you send to us or to teammates through the Service, support requests, and related correspondence.
• Technical and usage information — your IP address, browser and device information, log data, feature usage, approximate location derived from IP or addresses you enter, and similar data automatically collected to operate, secure, and improve the Service.
• Location data — addresses you enter are geocoded to provide mapping features; some map and location data is cached in your browser to speed up the Service.

You are responsible for the Customer Data you enter. Please do not submit sensitive personal information (such as government identification numbers, health information, or full payment-card numbers) into free-text fields unless necessary and permitted.

We use information to:

• Provide, operate, maintain, and secure the Service and its features, and process your transactions within it;
• Create and manage your account and workspace, authenticate you, and enforce security settings such as multi-factor authentication;
• Process subscriptions, seats, storage, and payments, and send billing and transactional communications;
• Provide support, respond to your requests, and send service, security, and administrative notices;
• Deliver notifications, reminders, invitations, and other messages you or your team request through the Service;
• Monitor, analyze, troubleshoot, and improve the Service, develop new features, and understand how the Service is used;
• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms; and
• Comply with legal obligations and enforce our agreements and rights.

We may create and use aggregated, anonymized, or de-identified information derived from the Service — which does not identify you, your workspace, or any individual — for any lawful purpose, including analytics, benchmarking, and improving and developing our products. We do not use Customer Data to serve third-party advertising, and we do not sell your personal information.

We process information as necessary to provide the Service you request, to perform our contract with you, to pursue our legitimate business interests (such as security, fraud prevention, billing, analytics, and product improvement), to comply with legal obligations, and with your consent where required by applicable law, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Where we rely on consent, you may withdraw it as described below, subject to legal and contractual restrictions.

We do not sell your personal information. We share information only as follows:

• Within your Workspace. Customer Data is accessible to the Workspace Owner, admins, and other Authorized Users according to the roles and permissions set within the Workspace. Owners and admins can access, export, and delete Workspace data.
• With service providers. We use trusted third parties to operate the Service — for example, cloud hosting and database, authentication, payment processing, email delivery, and mapping, geocoding, and weather providers. They may process information only to provide services to us and are bound by confidentiality and data-protection obligations.
• For legal reasons. We may disclose information if required by law, subpoena, or legal process, or where we believe disclosure is reasonably necessary to protect our rights, enforce our Terms, prevent fraud or harm, or ensure the safety and security of the Service and its users.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
• With your direction or consent. We share information as you direct or otherwise consent, such as when you send a document or invite a teammate.

We retain information for as long as your account or Workspace is active and as needed to provide the Service, and thereafter as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

You are responsible for exporting and keeping your own copies of any Customer Data you may need. Following cancellation, termination, non-payment, or account or Workspace deletion, we may deactivate access and permanently delete Customer Data at any time thereafter, without further notice and without obligation to retain or return it. We may retain aggregated or de-identified information indefinitely, and may retain limited records where required by law or for legitimate business purposes. We store credentials and sensitive tokens using industry-standard protections.

We use reasonable administrative, technical, and physical safeguards designed to protect information, including transport encryption, access controls, authentication, and row-level access rules that scope data to the appropriate Workspace and role. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential, for configuring your Workspace’s access and security settings appropriately, and for the security of your own devices and accounts.

The Service uses cookies and similar technologies (including browser storage) that are necessary to operate — for example, to keep you signed in, maintain your session and preferences, and cache certain map and location data to improve performance. We do not use the Service for third-party advertising or cross-site advertising tracking. You can control cookies through your browser settings, but disabling necessary cookies may prevent the Service from working.

Subject to applicable law, you may have the right to access, correct, update, or request deletion of your personal information, to withdraw consent, to object to or restrict certain processing, and to make a complaint to a privacy regulator. You can update much of your account information directly in the Service. Because much of the information in the Service is Customer Data held on behalf of, and controlled by, our customer, we may direct requests about that data to the relevant customer or ask you to contact them. To exercise a right, contact us using the details below; we may need to verify your identity before responding, and some requests may be limited by legal or contractual obligations.

The Service is a business tool intended for adults and is not directed to individuals under the age of majority in their jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided information through the Service, contact us and we will take appropriate steps.

We are based in the Province of Ontario, Canada, and our service providers may process and store information in Canada, the United States, or other countries. Where information is transferred across borders, it may be subject to the laws of those jurisdictions, and we take steps to ensure it remains protected consistent with this Policy and applicable law.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and may provide additional notice within the Service or by email. Changes are effective when posted. Your continued use of the Service after changes are posted constitutes acceptance of the updated Policy.

For privacy questions or to exercise your rights, contact us at privacy@ontarioroofers.org (or support@ontarioroofers.org), or write to Vertex CRM, Ontario, Canada.