What we collect, and what we do with it

Korvix Roofing LLC (“Korvix Roofing”, “we”, “us”) is a Missouri limited liability company that inspects, repairs, and replaces roofs in Chesterfield and the surrounding west St. Louis and St. Charles County communities. This policy covers korvixroofing.com, the estimate and invoice pages we send you a link to, and the emails, texts, and calls we send about your project.

It does not cover anything a separate company does under its own policy — a lender you apply to for financing, a shingle manufacturer you register a warranty with, or your insurer.

There is no account to create on this site and nothing to log into. Everything below comes from something you deliberately sent us.

The request form

Your name and phone number, which are required; and your email address, street address, city, the service you need, and anything you type in the message box, which are not. We also record which page of this site the form was sent from, so we know whether you were reading about storm damage or about financing when you got in touch.

Roof photos

Up to 8 photos, if you choose to add them. See section 3, because photos of your house deserve their own explanation.

Your messaging permissions

If you tick the text-message or the automated-call box, we record that you did, when, the exact wording you were shown, the page you were on, and the IP address and browser the submission came from. We keep the wording itself rather than a version number, so we can always show you precisely what you agreed to even after we have reworded the form.

Estimates, invoices, and signatures

The line items, prices, notes, and payment records for your project, plus the signature record described in section 4. This site never asks for and never stores a card number, a bank account number, or a Social Security number.

How you found us

If you arrive from an ad, the advertising parameters in the link — utm_source, utm_campaign, and Google’s or Facebook’s click identifiers — are attached to your request so we can tell which advertising actually works. They describe the ad, not you.

Server logs

The companies that host this site keep the ordinary request logs any web server keeps, which include IP addresses. We use them only to fix faults and to stop abuse of the photo upload. Their retention is set by those companies, not by us — see section 7.

The photo upload is optional, and it is the only place on this site where a stranger can put a file on our servers, so it is built tightly. Here is exactly what happens.

1. Your browser is issued a random, unguessable upload session that expires after two hours. The photos are stored against that session, not against you.
2. When you press send, the session is attached to your request and the photos become part of it.
3. If you never press send, nothing points at those photos and an automatic sweep deletes them — hourly for expired sessions, and a second daily sweep catches any file whose upload finished after the tab was closed.

Photos attached to a request are visible only to us. They are not published, not put in our gallery, not used in advertising, and not shown to anyone outside the company, and nothing on this site can serve one to the public. If we ever want to use a photo of your roof in our own marketing, we will ask you first and you are free to say no.

When you accept an estimate on the hosted estimate page, we store an audit trail alongside it: the name you typed, the signature you drew, the moment you accepted, and the IP address and browser user agent the acceptance arrived from. Those last two are there for one reason — an electronic signature is only worth anything if it can be shown to have been made by the person who made it, and that record protects you as much as it protects us.

The signature image, the IP address, and the user agent are never shown on the public estimate page and are never returned to anyone but us.

We do not text anyone who has not ticked the box asking us to. Your phone number, the fact that you opted in, and the wording you opted in to are kept as an append-only record: when you opt out we add a new entry saying so rather than deleting the old one, because the proof that we honoured your opt-out is only worth having if it cannot be erased.

The messaging program, in short

You opt in by checking the text-message box on our request form; the box is never pre-checked and consent is not a condition of purchase. Messages are about your own project — appointments, your estimate, your invoice. Message frequency varies. Message and data rates may apply.

Reply STOP to any text to stop them, or HELP for help — and you can also just tell us, by phone, by email, or in person. We do not require any particular method and we do not need you to use a particular word. Full messaging terms are on our Terms page.

As of the effective date of this policy we have not started sending text messages; the permission is being collected first and the carrier registration comes after. When messages begin, they will be carried by Twilio — see section 7.

This is the section most privacy policies quietly overstate, so to be precise about what is actually running today:

• No analytics or advertising pixel is loaded on this site. There is no Google Analytics tag, no Meta pixel, and no Google Ads conversion tag on the pages you are reading. The code that would fire one exists and does nothing, because the identifiers it needs are not configured. If that changes, this section changes with it and the effective date at the top of the page moves.
• We set no advertising or tracking cookies. The only browser storage this site uses is a single first-party sessionStorage entry remembering which ad, if any, brought you here, so that the attribution survives you reading a second page before filling in the form. It holds no personal information, it is readable only by this site, and it disappears when you close the tab.
• Signing in to the admin area — which is us, not you — uses a session cookie. There is no visitor-facing login.
• Web fonts are loaded from Google Fonts. Your browser therefore makes a request to fonts.googleapis.com and fonts.gstatic.com, and Google receives your IP address and user agent as part of it. That is a real transfer and we would rather name it than leave it out.

Because we run no cross-site tracking, there is nothing here to switch off with a Global Privacy Control or a Do Not Track header. We honour them anyway by not having built the thing they exist to stop.

We are a small company and we use ordinary software to run it. Each of these companies processes your information only to provide their service to us. None of them is permitted to use it for their own marketing.

Convex — database and file storage

Holds your request, your estimate, your invoice, your consent record, and the roof photos you upload. This is where your information actually lives. Convex runs on Amazon Web Services, offers hosting regions in the United States and Ireland, and publishes a privacy policy, a data-processing addendum, and a list of its own sub-processors. Its data-processing addendum commits it not to sell or share customer personal data and not to use it for any purpose other than providing the service. Convex states it is SOC 2 Type II compliant.

Vercel — website hosting

Serves the pages you are reading. Its request logs record the client IP address, the browser user agent, and the path requested. Vercel’s privacy notice says it derives city and country from an IP address and does not identify precise location. Vercel publishes a privacy notice and a data-processing addendum.

Resend — email delivery

Sends the confirmation, estimate, reminder, and invoice emails, and therefore handles your email address, your name, and the contents of those messages. Resend states that it stores customer data in the United States and that it retains email data for 30 days, and it publishes a data-processing addendum — in which it agrees not to sell personal information — and a sub-processor list. Resend states it is SOC 2 Type II compliant.

Twilio — text messaging (not yet in use)

Will carry text messages once our carrier registration is approved, and will then receive your mobile number and the text of the messages. Nothing had been sent to Twilio as at the effective date above.

OpenAI — writing our blog articles

Used only to draft articles and illustrations for our blog. No customer information is sent to OpenAI. What is sent is a topic we chose plus facts already published on this website — our services, our service areas, and our warranty wording. There is no path in our software from a customer record to that service, and no article is published without a person reading it first. For completeness: OpenAI states that data sent to its API is not used to train its models unless a customer opts in, and that abuse-monitoring logs are kept for up to 30 days.

Google Fonts — typefaces

Receives your IP address and browser details when your browser fetches our fonts, as described in section 6.

What we have not independently verified

We can tell you exactly what our software sends to each company above, because we wrote it. What we cannot do is audit what they then do internally, and we would rather name the gaps than paper over them:

• How long Vercel keeps the request logs that contain your IP address. Vercel publishes retention periods for the logs it shows us, but not for its own internal retention, and we are not going to quote one figure as though it were the other.
• Vercel’s full list of sub-processors. It is behind a request form on Vercel’s trust centre rather than published openly, so we cannot link you to a complete one.
• Exactly which parts of an email Resend holds during its stated 30-day window. Their documentation says “email data” without itemising it.
• Every statement above is what these companies published on the effective date of this policy. They can change their terms without telling us, and their own current documents govern, not our summary of them.

If a specific vendor question matters to you, ask us and we will point you at that company’s current terms rather than paraphrase them.

We will also disclose information where the law genuinely requires it — a court order, a subpoena, or a legal obligation — and to our own insurer or lawyer if a dispute makes it necessary.

• We do not sell your personal information, and we never have.
• We do not share it with other contractors, lead brokers, or marketing companies.
• We do not share your text-messaging opt-in or consent with anyone, for any purpose.
• We do not buy contact lists and text or call the people on them. Every number we message has asked us to message it.
• We do not publish your roof photos without asking you first.

Requests, estimates, invoices, and job records

Kept for as long as we may need them for the work, the warranty on it, our tax and accounting obligations, and any dispute that could still arise — and then deleted on request.

Consent and opt-out records

Kept for at least five years after the last message sent under that permission, and never deleted while a messaging relationship is live. This is deliberate: these records are the proof that we had permission and that we honoured your opt-out, and a deleted consent record is a deleted defence for both of us.

Roof photos

Photos attached to a request are kept with it. Photos uploaded but never submitted are deleted automatically within a few hours — see section 3.

Server logs

Held by our hosting providers on their own schedules, which we do not control.

Missouri has no general consumer privacy statute giving residents a statutory right of access or deletion. We offer these anyway, to anyone who asks, regardless of where they live:

• Ask what we hold about you. We will tell you, in writing.
• Ask us to correct it. A misspelt street is a missed appointment; we would rather fix it.
• Ask us to delete it. We will delete your enquiry, your photos, and your contact details. Two things survive, and we would rather say so up front than surprise you: records we are legally required to keep, such as the invoice for work we actually did, and the record that you opted out of messages — which we keep precisely so that we cannot accidentally start texting you again.
• Stop the messages at any time, by any means, as described in section 5.

Email office@korvixroofing.com or call (555) 014-2200. We will get back to you within 30 days, and normally within a day or two — we are a roofing company, not a call centre queue.

The site is served over HTTPS. Your information is held in a managed database with no public read access: the admin area is behind a password and sign-ups are disabled, so there is exactly one account and it belongs to the owner. Estimate and invoice links use a 128-bit random token that is unguessable and can be revoked by regenerating it, which is why the link in your email is the only way to open your document and why you should not post it publicly.

No system is perfectly secure and anyone who tells you otherwise is selling something. If we ever discover a breach affecting your information, we will tell you.

This site is for homeowners and is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has sent us something, tell us and we will delete it.

We will update this page when what we do changes — turning on analytics, starting to send text messages, or adding a service provider are all changes that will appear here. The effective date at the top moves when they do. Because we store the exact consent wording each person agreed to, a change here can never retroactively alter what you already agreed to.

Korvix Roofing LLC
Chesterfield, MO 63017
office@korvixroofing.com
(555) 014-2200

See also our Terms of Service, which cover the messaging program in full.