Your information. Clearly explained.

When you ask for a call, PorchRocket uses the information you submit to respond and follow up. With your privacy choices, we also use Google and Meta tools to learn which ads produce real business inquiries. We do not sell or rent your contact details for money. Some laws may call advertising measurement “selling,” “sharing,” or targeted advertising. You can turn it off at any time throughPrivacy Choices in the footer.

1. Scope

This policy applies to porchrocket.com, our callback and contact forms, any no-cost preliminary analysis delivered in response to those forms, and the address-specific roof-report microsites that PorchRocket operates for customers. PorchRocket controls information collected through the public marketing site. For a customer microsite, the customer agreement and any data-processing terms also apply and may describe the customer's role and instructions.

2. Information we collect

Depending on how you interact with the site, we may collect:

• Contact information, such as your name, work email, phone number, and company.
• Business context, such as your market or ZIP code, team size, CRM, priorities, preferred contact method and response window, browser-reported time zone, and whether you chose a text-capable contact option.
• Advertising and referral information, such as the landing page, referring page, UTM campaign fields, and ad-click identifiers including GCLID, GBRAID, WBRAID, FBCLID, gad_source, and gad_campaignid when they are present.
• Site activity, such as pages viewed, buttons selected, a successful callback request, and whether an inquiry later becomes qualified or becomes a customer. Ordinary analytics events do not include form-field values such as your name, phone number, email, market, or ZIP code.
• Technical and security data, such as IP address, user agent, browser and device type, approximate location, page URL, request time, consent state, and error information needed to deliver, measure, secure, and troubleshoot the site.
• Site-performance data, including page-load timing, Core Web Vitals, and the page path collected through Cloudflare Web Analytics.
• Customer-microsite engagement data, including a random page-session identifier, visible time, maximum page depth reached, whether a report call-to-action was used, a browser session-hidden lifecycle signal, and literal desktop top-edge exit intent. These signals are associated with the customer, mailing order, and addressed report that served the page. They do not establish that a person abandoned the page or completed a conversion.

Our callback form saves your phone number only after you press the button asking us to call. Afterward, you may choose call, text first, or either; tell us when you are most likely to answer; and add your name, company, or email to the same request. We record the permission version and server time only if you select a text-capable option and save it. Typing into a field without submitting it does not send that field to PorchRocket. The public website form does not ask for payment-card details, government identifiers, account passwords, or production CRM exports. Please do not submit that information through it.

To limit automated abuse, we derive a temporary one-way fingerprint from the IP address, a secret security key, and a short time window. We do not write the raw IP address to the lead record. The fingerprint is used for rate limiting, not advertising or user profiling, and expires after about 30 minutes.

The customer-microsite collector is first party and uses no cookie, local storage, advertising identifier, or cross-site identifier. Its signal records do not retain form-field values, the page URL, referrer, raw IP address, or user agent. IP address and user agent are processed transiently for rate limiting and recognizable-bot classification; its one-way rate-limit key expires after about one hour. A saved signal remains linked to the addressed report, so it is privacy-limited rather than anonymous.

3. Where information comes from

We collect information:

• Directly from you when you complete a form, email us, or speak with us.
• Automatically from your browser or device when it requests and displays the site.
• From service providers that help us deliver, secure, and measure the site, subject to their role in providing those services.

4. Cookies, browser storage, and advertising measurement

The privacy panel lets you accept or reject analytics and advertising separately. Optional Google storage and advertising data uses start turned off for every visitor and stay off until you make a choice. Meta also waits for explicit advertising permission. Your choice is saved in this browser so the site can remember it. Cloudflare may still use cookies that are strictly necessary for security, fraud prevention, or network operation.

When you allow the relevant category, the site may use:

• Session storage for the first landing page, referral source, and campaign context. It normally clears when the browser session ends.
• Local storage for advertising click identifiers. PorchRocket keeps these browser-side identifiers for up to 90 days so a later callback can still be credited to the right campaign.
• Provider cookies and identifiers, including Google identifiers and Meta identifiers such as _fbp and _fbc, for measurement, attribution, and permitted advertising uses.

Google Analytics and Google Ads

We use Google Analytics and Google Ads to understand site use, measure callback requests, connect qualified leads and customers to earlier ad interactions, and improve campaign reporting and bidding. Google may receive the page URL, IP address, approximate location, browser and device details, consent state, events, Google cookies or similar identifiers, Google ad-click identifiers, and conversion time, status, and approved value.

We use Google's advanced consent mode. A configured Google tag may load while optional choices are off and send limited, cookie-free consent and measurement signals. It does not receive permission to use optional analytics storage, advertising storage, or advertising user data until you grant it. We keep Google's ad-personalization consent denied. A saved choice or recognized opt-out signal updates the other defaults. If you allow ad measurement and conversion matching, we may use Google's enhanced conversions and offline conversion tools. For those tools, we may send your phone number or email in a provider-approved matching process and report whether the inquiry later became qualified or became a customer. Contact information is normalized and cryptographically hashed before or as part of that process. A hash is still personal information; it is not anonymous.

Learn more about how Google uses information from sites using its services and Google's privacy policy.

Meta Pixel and Conversions API

If you allow advertising measurement, we may use the Meta Pixel and Meta Conversions API to measure and improve advertising. Meta may receive page visits and lead events, event time, page URL, IP address, user agent, browser and device information, and Meta click or browser identifiers such as FBCLID, _fbc, and _fbp. For matching, we may also send a cryptographically hashed version of a phone number or email you gave us. Hashing helps with matching but does not make the data anonymous. The browser and server events use the same event identifier so Meta can count one lead once. Meta Pixel does not load and PorchRocket does not send an optional Conversions API event when advertising permission is off.

Meta processes this information under the Meta Business Tools Terms and Meta Privacy Policy. Meta's uses may include measurement, attribution, ad delivery, audience services, personalization, security, and improvement of its products, subject to its terms and your Meta settings.

Cloudflare

Cloudflare provides edge hosting, security, database and file storage, operational email delivery, and site-performance measurement. Cloudflare may process request metadata, including IP address and headers, and submitted content on our behalf. Authorized lead-alert emails may include the contact and request details you submitted. According to Cloudflare, its separate Web Analytics service does not use cookies or local storage, fingerprint visitors, or track individuals across customer sites. It collects limited page and performance information such as paths, referral data, device categories, and Core Web Vitals. Learn about Cloudflare Web Analytics and see Cloudflare's privacy policy.

5. How we use information

• Save and respond to inquiries, make the requested callback, and prepare a requested plan.
• Honor preferred contact methods and broad response windows, which are not appointments.
• Operate, secure, troubleshoot, and improve the website and services.
• Understand site use and page performance.
• Measure which ads produce callbacks, qualified inquiries, and customers.
• Improve advertising reports, campaign decisions, and bidding when you allow it.
• Maintain business records and establish, exercise, or defend legal claims.
• Comply with legal obligations and protect the rights and safety of PorchRocket and others.

We do not use the public callback form to make a decision that has a legal or similarly significant effect on you without human review.

6. Who receives information

We disclose information only as reasonably necessary for the purposes described in this policy, including to:

• Cloudflare and other operating providers that support hosting, security, data storage, email delivery, diagnostics, and website operations.
• Google for consent-aware analytics, advertising measurement, ad attribution, enhanced conversion matching, and later-stage conversion reporting as described above.
• Meta for Pixel and Conversions API measurement when advertising permission is on, as described above.
• Authorized PorchRocket personnel, including Rafael Ortega and limited internal recipients who need the information to respond to an inquiry. Operational email records may include the recipient, delivery status, attempt times, and a limited error description.
• Professional advisers, such as attorneys, accountants, or insurers, when reasonably necessary to provide their services or protect legal rights.
• Authorities or other parties when required by law or reasonably necessary to protect rights, safety, users, or the integrity of our services.
• A successor organization in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to applicable law.
• Others at your direction or with your consent.

We do not sell or rent contact information for money. Our permitted use of Google and Meta advertising tools may be considered a sale, sharing, targeted advertising, or cross-context behavioral advertising under some privacy laws. You can turn that activity off through Privacy Choices. We do not knowingly send sensitive personal information through ordinary analytics or advertising event fields.

7. Retention

We keep a privacy choice until you change it or clear this site's browser storage. Session attribution normally ends with the browser session. PorchRocket browser-side ad-click identifiers expire after 90 days. The anti-abuse fingerprint expires after about 30 minutes. Short-lived technical and delivery logs are kept only for operational and security needs.

Raw customer-microsite engagement signals are retained for no more than 400 days and are available only to authorized PorchRocket personnel for product and campaign diagnostics. Calls and submitted responses are recorded separately; lifecycle signals are not used as verified conversions, billing events, or automated homeowner decisions.

We keep inquiry records and their attribution only as long as reasonably necessary to respond, manage the business relationship, measure campaigns, maintain appropriate business records, resolve disputes, enforce agreements, and meet legal obligations. Retention can differ based on whether an inquiry became a customer and whether a legal hold applies. Google, Meta, and Cloudflare keep information under their own terms, account settings, and retention controls.

When information is no longer needed, we delete it from active systems or de-identify it where reasonably practicable. Limited residual copies may remain temporarily in protected backups or provider systems until their normal expiration.

8. Security

We use administrative and technical safeguards designed for the nature of the information we handle, including encrypted transport, restricted service bindings, request validation, and controls intended to reduce automated abuse. No internet transmission or storage system can be guaranteed completely secure.

9. Your privacy choices

Open Privacy Choices in the footer to accept all, reject optional tools, or choose analytics and advertising separately. You can reopen it and change your mind at any time. Turning off advertising prevents future Meta Pixel and PorchRocket Meta Conversions API events and prevents advertising contact matching. Google may still receive limited cookie-free consent and measurement signals as explained above. Clearing browser storage may reset your saved choice, so set it again when you return.

When this browser sends a recognized Global Privacy Control signal, we set advertising off for that browser. You may also manage Google personalization through My Ad Center, use the Google Analytics opt-out add-on, and review your activity off Meta technologies or Meta ad preferences. Provider-level controls may not delete the inquiry record held by PorchRocket; contact us for that.

10. Privacy rights by region

Depending on where you live and subject to legal exceptions, you may have rights to know about, access, correct, delete, or obtain a copy of personal information, or to object to or restrict certain processing. You may also have the right to appeal a decision and to receive equal service without unlawful discrimination for exercising a privacy right.

Submit a request by emailing rortega@porchrocket.com with “Privacy request” in the subject. Describe the request and the email address associated with your interaction. We may need to verify your identity and authority before acting. An authorized agent may submit a request where permitted by law. We will respond within the period required by applicable law.

United States. Where state law gives you the right, Privacy Choices lets you opt out of future use of site information for sale, sharing, targeted advertising, or cross-context behavioral advertising. You may also have rights to limit certain sensitive-data uses and to appeal a denied request. We do not unlawfully discriminate because you use a privacy right. To appeal, reply to our decision or email us with “Privacy appeal” in the subject.

EEA, United Kingdom, and Switzerland. Depending on the activity, we process information to take steps you request before a contract, for our legitimate interests in answering business inquiries, operating and securing the site, with your consent for optional analytics and advertising, or to meet legal obligations and protect legal rights. Where we rely on consent, you may withdraw it at any time without affecting earlier processing. You may have rights to access, correct, erase, restrict, object, and receive portable data, and to complain to your local data-protection authority.

PorchRocket and its providers may process information in the United States and other countries. Those places may have different privacy laws. Where required, the responsible provider uses an approved transfer mechanism or other safeguard. Provider roles may differ by service and region; Google and Meta also process information under their own privacy terms.

11. Communications

We may call you about an analysis or other request you submitted, including on weekends during permitted local hours. The initial callback form does not give us text permission. If you later selectText me first or Either works and save, you authorize PorchRocket to send one-to-one texts about that request to the number you provided. Message frequency varies, and message and data rates may apply. Text permission is not a condition of purchase. Reply STOP or use any other reasonable method to ask us to stop texts; you may also ask us to stop calls or marketing email at any time. We may still send non-marketing communications needed to respond to an active request or administer a service when permitted.

12. Children

PorchRocket is a business-to-business service and is not directed to children under 16. We do not knowingly collect personal information from children through the site. If you believe a child has submitted information, contact us so we can review and delete it as appropriate.

13. Third-party links

The site may link to third-party services governed by their own privacy practices. A link does not mean PorchRocket controls that service's privacy or security practices.

14. Changes to this policy

We may update this policy as our services change. We will post the revised version here and update the date above. If required by law, we will provide additional notice or obtain consent before a material change applies.

15. Contact

Questions, complaints, and privacy requests can be sent to rortega@porchrocket.com.