PRIVACY POLICY

This Privacy Policy explains how Black Bolt USA LLC ("Black Bolt," "we," "us," or "our") collects, uses, discloses, and protects personal information when people visit our websites, create or use a Black Bolt account, communicate with us, or use our Services. Read it together with the Black Bolt Terms of Service and with any customer agreement or data processing addendum that applies to your account.

1. Who this Policy is for, and our two roles

Black Bolt plays two different roles, and which one applies changes who is responsible for your information.

Information we handle for our own purposes. When we collect account, billing, support, website, security, and marketing information about the people who sign up for and use Black Bolt, we decide how that information is used. In privacy-law terms we are the controller or business for it, and this Policy describes what we do with it.

Information we handle for a business customer. When a roofing contractor or roofing company uploads or generates information about homeowners, property owners, employees, subcontractors, or other people in the course of using the Services, we process that information on that customer's behalf and under that customer's instructions. In privacy-law terms we are a processor or service provider for it. That customer decides why the information is collected and how it is used, and that customer is responsible for providing the required notices, obtaining any required permissions, and giving us lawful instructions.

One exception, which the customer agrees to in the Terms of Service. Black Bolt also uses information submitted to the Services for one purpose of its own: to secure and support the Services. A customer permits this use by accepting the Terms of Service, and Section 10 of the Terms sets the limits on it.

2. If you are a homeowner or property owner

If a roofing contractor used Black Bolt to inspect, estimate, or propose work on your property, your information reached us because that contractor put it there. The contractor, not Black Bolt, decides what is collected, how it is used, and how long it is kept, and the contractor's own privacy policy governs that relationship.

Send requests to access, correct, or delete your information to the contractor you worked with. If you contact us instead, we will, where we are able, forward your request to that contractor and tell you we have done so. We will act on your request directly only where the law requires us to or where the contractor instructs us to. You can reach us at support@black-bolt.com.

3. Information we collect

We do not collect payment-card numbers ourselves. Card details are collected and stored by our payment processor under its own security controls, and we receive only limited metadata about the transaction.

Please do not upload Social Security numbers, driver's license or government credential images, full payment-card data, medical records, biometric identifiers, or other highly sensitive information unless a Black Bolt feature expressly requires it and we have authorized that use in writing.

4. How we use information

• Provide, operate, personalize, maintain, and support the Services.
• Authenticate users, administer subscriptions, process payments, and communicate about accounts.
• Process documents, photographs, measurements, pricing, estimates, supplements, proposals, and orders at a user's direction.
• Enable and maintain third-party integrations that a user connects.
• Monitor performance, debug errors, improve usability, develop features, and perform analytics.
• Detect, investigate, and prevent fraud, abuse, security threats, and unlawful activity.
• Comply with law, enforce our agreements, resolve disputes, and protect rights and safety.
• Send product, service, or marketing communications consistent with law and your preferences.
• Index carrier reimbursement pricing from a customer's own claim documents so that customer can look up their own pricing history, as described in Section 5.

We do not use project or homeowner information uploaded by a business customer for our own marketing, and we do not disclose it to other customers.

5. Artificial intelligence and automated features

We use artificial intelligence, machine learning, optical character recognition, and automated document-processing providers to extract, classify, compare, summarize, or generate the information requested through the Services. Those providers may process submitted content and related metadata under contract with us. Automated outputs can be wrong and require human review.

We do not permit our technology providers to use Customer Data to train publicly available general-purpose AI models. If that ever changes, we will give clear notice in advance and obtain any consent that law or contract requires.

Your own pricing history. Claim documents contain the regional price list amounts an insurance carrier used to calculate a loss. We index those line-item amounts from the claim documents in a customer's own account, so that a contractor supplementing a line item that was not on the original claim can look up what that item was reimbursed at on their own past claims.

Pricing indexed from your claim documents stays in your account. We do not show it to any other customer, and we do not show you another customer's pricing. Section 10 of the Terms of Service reserves the possibility of a pooled pricing database in the future; if we build one, we will give advance notice and a way to decline before any of your data is included.

Credentials for your own vendor accounts. Where you give us an API key or token for your own account with a third-party vendor, we store it using reasonable security measures and use it only to perform the operations you request. You can revoke it at any time by disconnecting the integration or rotating the key with that vendor.

We do not use automated decision-making that produces legal or similarly significant effects about an individual without human involvement.

6. How we disclose information

• Service providers and subprocessors that supply hosting, storage, security, AI and OCR processing, analytics, payments, email, support, communications, mapping, and other business functions, under contracts that limit their use of the information to providing services to us.
• Connected third parties, when an authorized user enables an integration or directs a transfer.
• Affiliates and professional advisers, including auditors, insurers, and financing sources, under appropriate obligations of confidentiality.
• Authorities and other parties, when reasonably necessary to comply with law or legal process, protect rights or safety, prevent fraud, or investigate a security incident.
• A buyer or successor, in connection with a merger, financing, restructuring, bankruptcy, acquisition, or sale of assets, subject to this Policy or a successor policy with notice.
• Others at your direction or with your consent, or as otherwise disclosed when the information is collected.

A current list of our subprocessors is available on request from support@black-bolt.com. We will give notice before adding a subprocessor that processes Customer Data.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising as those terms are defined by state privacy laws.

7. Data retention

We keep personal information for as long as reasonably necessary to provide the Services, maintain business and legal records, meet contractual and legal duties, secure the Services, resolve disputes, and enforce agreements. How long that is depends on the type of information, customer instructions, legal requirements, risk, and technical backup cycles.

Information subject to a legal hold, an open dispute, or a legal obligation is kept until that ends.

8. Cookies, analytics, and similar technologies

We and our providers use cookies, local storage, pixels, SDKs, and similar technologies for authentication, preferences, security, performance, and analytics, and for marketing if we enable it. Where consent is required, we request it or offer controls. Blocking these technologies in your browser may affect how the Services work. For details of the specific technologies we use, contact support@black-bolt.com.

The technologies in use today are listed below. We will update this table when they change.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, which may include access controls, encryption in transit, encryption at rest, monitoring, logging, backups, vendor review, and incident-response procedures. No safeguard eliminates all risk.

Account owners and users must protect credentials, configure user permissions carefully, and promptly report any suspected compromise to support@black-bolt.com. If a security incident affects your information, we will notify the affected account without undue delay and in any event within 72 hours of confirming the incident, and will notify regulators and individuals as law and our agreement with you require.

10. Your choices and privacy rights

Depending on where you live and subject to legal exceptions, you may have the right to know about or access the personal information we hold about you, correct inaccuracies, delete it, obtain a portable copy, opt out of sales, sharing, targeted advertising, or certain profiling, limit the use of sensitive personal information, withdraw a consent you gave, and appeal a decision we make about your request. We will not unlawfully discriminate against you for exercising a right.

How to make a request. Submit a request by email to support@black-bolt.com. We will verify your identity and, for an agent, that person's authority, and we may ask for information reasonably necessary to process the request. We respond within the time the applicable law allows.

Appeals. If we deny your request, you may appeal by writing to support@black-bolt.com within 30 days. We will respond in writing with our decision and the reasons for it, and will tell you how to contact your state attorney general if you disagree.

Requests about a business customer's data. If we hold information only because one of our business customers put it in their account, we will direct your request to that customer, as described in Section 2.

Marketing. You can unsubscribe from marketing email using the link in any marketing message or by writing to support@black-bolt.com. You will still receive essential service and transaction messages.

11. State privacy notices

Texas. Texas residents have rights under the Texas Data Privacy and Security Act to confirm and access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data, targeted advertising, and certain profiling. We honor universal opt-out preference signals where the law requires it. Use the request and appeal methods in Section 10.

California. California residents have rights under the California Consumer Privacy Act, as amended. The categories of personal information we collect and our purposes are described in Sections 3 and 4, and the categories of recipients are described in Section 6. We do not sell or share personal information as California defines those terms, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit. If that changes, we will provide the required notice and opt-out methods.

Other states. Residents of other states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Oregon, Montana, and others as those laws take effect, have comparable rights to access, correct, delete, and obtain portable copies of personal data and to opt out of sales, targeted advertising, and certain profiling. Where required, we provide an appeal process and recognize authorized agents and universal opt-out signals.

12. Children

The Services are intended for business users age 18 and older and are not directed to children. We do not knowingly collect personal information directly from children under 13. If you believe a child provided information directly to us, contact support@black-bolt.com and we will delete it.

13. International data transfers

Black Bolt operates in the United States, and we and our providers process information in the United States and potentially in other countries where privacy protections differ. The Services are not offered to individuals in the European Economic Area, the United Kingdom, or other jurisdictions with comprehensive cross-border transfer requirements. If we begin serving those regions, we will use an approved transfer mechanism and appropriate contractual safeguards and will update this Policy.

14. Third-party services and websites

Connected services and third-party websites have their own privacy practices. Review those policies before authorizing an integration. Black Bolt is not responsible for a third party's practices beyond our role in enabling a connection you requested.

15. Changes to this Policy

We may update this Policy. We will post the updated version and change the Last Updated date. If the changes are material, we will provide additional notice, such as email or an in-product notice, as required.

16. Contact us