Privacy Policy

Last updated: May 1, 2026

This Privacy Policy describes how ValidCRM ("ValidCRM," "we," "our," or "us") collects, uses, and discloses information when you use our customer relationship management software and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not use the Service.

1. Information We Collect

Information You Provide Directly

When you create an account or use the Service, you provide us with information including:

Account information: name, email address, phone number, business name, and password
Billing information: billing address and payment details (payment card data is processed and stored by our payment processor, Stripe — we do not store full card numbers)
Customer relationship data: contact information, addresses, notes, photos, proposals, schedules, and other information you enter about your customers and leads
Communications: emails, support messages, and feedback you send to us

Information Collected Automatically

When you use the Service, we automatically collect:

Usage data: pages viewed, features used, actions taken, timestamps
Device data: browser type, operating system, IP address, screen size
Cookies and local storage: session tokens, preferences, and similar identifiers used to keep you signed in and remember your settings

Information from Connected Services

If you choose to connect third-party services (such as Facebook Pages, RingCentral, Google Drive, or Stripe), we receive data from those platforms as authorized by you. This may include lead form submissions, call records, files, or payment information. We only access data within the scope of the permissions you grant.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Authenticate users and secure accounts
Process payments and manage subscriptions
Sync data with services you connect (e.g., import Facebook leads into your CRM)
Send transactional emails (account confirmations, password resets, billing receipts, security alerts)
Respond to support requests
Detect, investigate, and prevent fraud, abuse, and security incidents
Comply with legal obligations

3. How We Share Information

We do not sell your personal information or your customers' personal information to third parties.

We share information only in these limited circumstances:

Service providers: with infrastructure and tooling providers who help us operate the Service, including Supabase (database and authentication), Vercel (web hosting), Render (background services), Stripe (payments), and similar vendors. These providers are bound by contract to protect your information and use it only as needed to perform their services.
Connected services: when you connect third-party services, data flows between ValidCRM and those services as you authorize.
Within your organization: users in the same organization can see customer data, proposals, and other records based on the role and permissions you grant them.
Legal requirements: when required by law, subpoena, court order, or to protect the rights, property, or safety of ValidCRM, our users, or others.
Business transfers: if ValidCRM is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4. Data Security

We take reasonable steps to protect your information:

All data is transmitted over encrypted HTTPS/TLS connections
Data is encrypted at rest in our database and file storage
Passwords are hashed and never stored in plain text
Access to production systems is restricted to authorized personnel
Daily automated database backups
Row-level security policies isolate each organization's data from every other organization's
Payment card information is handled exclusively by Stripe (PCI-DSS Level 1 certified) and never touches our servers

However, no method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your information within 90 days, except where we are required to retain it for legal, tax, accounting, or fraud-prevention purposes. Backup copies may persist for up to 35 days after deletion before being purged.

6. Your Rights and Choices

Access, Correction, and Deletion

You can access and update most of your information directly within the Service. To request a copy of all data we hold about you, or to request deletion of your account, email us at william@novaroof.com.

California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right to opt out of the sale or sharing of your information (we do not sell or share for cross-context behavioral advertising). To exercise these rights, contact us at william@novaroof.com.

EU/UK Residents

If you are in the European Union or United Kingdom, you have rights under the GDPR and UK GDPR, including rights of access, rectification, erasure, restriction of processing, data portability, and objection. The legal basis for our processing is typically (a) the performance of our contract with you, (b) your consent, or (c) our legitimate interests in operating and improving the Service. To exercise your rights or lodge a complaint, contact us at william@novaroof.com.

Marketing Communications

We may send you product updates, tips, and marketing emails. You can opt out at any time by clicking "unsubscribe" in any marketing email. You cannot opt out of transactional emails (account, security, billing) while you remain a customer.

7. Cookies and Tracking

We use cookies and browser local storage to keep you signed in, remember your preferences, and understand how you use the Service. We do not use third-party advertising cookies or sell tracking data. You can disable cookies in your browser settings, but parts of the Service may not function correctly without them.

8. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If we learn that we have collected such information, we will delete it.

9. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your jurisdiction.

10. Customer Data You Upload

Important: When you use ValidCRM to manage your customer relationships, you upload information about your end customers (their names, contact details, photos of their property, etc.). You are the "controller" of that information; ValidCRM is the "processor." You are responsible for having a lawful basis to collect, store, and process that information, and for providing your end customers with appropriate privacy notices. We process that data only to provide the Service to you.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. For material changes, we will notify you by email or through the Service.

12. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

ValidCRM
Email: william@novaroof.com