Data Processing Addendum
Last updated: August 8, 2026 · Effective: August 8, 2026
This Addendum forms part of the Terms of Service between Extreme Roofing Solutions, LLC (“ERS”, “we”) and the Customer (“you”) and applies where we process personal information about a Homeowner on your behalf. Where this Addendum and the Terms disagree on data protection, this Addendum governs.
1. Roles
For Homeowner personal information that you enter or upload - a name, contact details, a property address, a measurement report - you are the controller and we are the processor. You decide whose information goes into the Service and why; we process it to provide the Service to you.
For your own account information - the names, email addresses, phone numbers and roles of your users, and your billing records - we are the controller and our Privacy Policy applies.
2. Your responsibilities
You confirm that you have a lawful basis for giving us each Homeowner’s information and for us to process it as described here, and that the instructions you give us do not require us to break the law. You are responsible for the accuracy of what you enter and for only entering what you actually need.
3. What we process
Categories of individual: Homeowners and other property contacts you record. Categories of data: name, email address, telephone number, property address, roof measurements and related project detail, and the contents of documents you upload for measurement reading. Purpose: preparing, pricing, storing and sharing quotes, and providing support. Duration: for as long as your account is active, and as described in section 8.
We do not collect payment details from Homeowners. Homeowners do not pay through IMQ - a quote shared with a Homeowner is an estimate they can accept or decline, not a checkout - so no Homeowner payment information exists in the Service.
4. Our instructions
We process Homeowner personal information only on your documented instructions, which include your use of the Service and any configuration you choose, unless the law requires otherwise - in which case we will tell you before processing, unless the law forbids that. We will not sell Homeowner personal information, share it for cross-context behavioural advertising, or use it for our own purposes.
5. Confidentiality
Access is limited to personnel and contractors who need it to run and support the Service, and they are bound by confidentiality obligations. Where a member of our staff accesses a Customer’s account to provide support, that access is recorded.
6. Security
We maintain technical and organizational measures appropriate to the risk, which today include: encryption of traffic in transit (TLS, with HSTS enforced); authorization scoped to your organization so that requests cannot reach another organization’s records; an immutable audit trail recording who did what, with the originating IP address and browser, including any support impersonation; encryption at rest of stored credentials and integration secrets; revocation of active sessions on password change or account deletion; and content-security and clickjacking protections at the edge. We review these as the Service changes.
7. Subprocessors
You authorize us to engage the subprocessors below. This list is the same one published in our Privacy Policy and the two are kept in step.
Anthropic - the in-app support assistant, and automated reading of measurement reports you upload (documents that commonly contain a Homeowner name and property address). Google - sign-in, and address lookup as an address is typed. Intuit / QuickBooks - billing and payments between you and ERS. Extreme Roofing Solutions, LLC - our own mail servers, which send Service email; we do not hand email to a third-party sending provider.
We remain responsible for our subprocessors’ performance of these obligations. We will give you notice before adding or replacing one, by updating this page and the Privacy Policy; if you object on reasonable data-protection grounds, tell us and we will work with you in good faith, and if we cannot resolve it you may terminate the affected part of the Service.
8. Retention, return and deletion
We keep Homeowner personal information for as long as your account is active, because a quote is a business record you may need to refer back to, and afterwards only as long as the law or a legitimate financial or legal obligation requires.
You can ask us to delete a Homeowner’s information at any time and we will do so. Where a user account is deleted, we anonymize the personal information on it, clear its credentials and revoke its sessions, retaining only a non-identifying record so that past quotes and invoices remain internally consistent. On termination, we will return or delete Homeowner personal information on your request.
We have not fixed numeric retention periods for every category of record. Rather than publish a schedule we do not yet operate, we have described above what actually happens today, and we will update this section when those periods are set.
9. Helping you meet your obligations
If a Homeowner contacts you to access, correct, delete or object to the processing of their information, we will give you reasonable assistance to respond, taking into account the nature of the processing and what is available to us. If a Homeowner contacts us directly about data held on your behalf, we will refer them to you rather than acting on it ourselves, unless the law requires otherwise. We will also give you reasonable assistance with data protection impact assessments and prior consultations that relate to the Service.
10. Personal data breaches
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Homeowner personal information that we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware of it. We will tell you what we know, what we are doing about it, and what we recommend, and we will keep you updated as we learn more.
11. Demonstrating compliance
On reasonable written request, and no more than once a year unless a regulator requires otherwise or we have notified you of a breach, we will make available the information reasonably necessary to demonstrate our compliance with this Addendum, and will contribute to an audit conducted by you or an independent auditor you appoint who is bound by confidentiality. Audits must be conducted on reasonable notice, during business hours, and without unreasonable disruption to the Service or to other customers.
12. International transfers
The Service and its data are hosted in the United States. Our subprocessors may process information in the United States and, where their own terms allow, elsewhere. Where a transfer requires a specific legal mechanism, we will put an appropriate one in place.
13. Changes and contact
We may update this Addendum. When we change it materially we will update the date above and ask you to accept the current Terms next time you sign in. Questions about it, and any request under it, go to info@extremeroofingsolutions.org.
Extreme Roofing Solutions, LLC - 12574 Flagler Center Blvd, Suite 101 #1016, Jacksonville, FL 32258.