Privacy Notice
Effective November 6, 2026 | Privacy Notice 2026-11-06.1
1. Who we are and what this notice covers
Trussted Roofing LLC, operating Pro Studio CRM, provides business software at prostudiocrm.com. This notice explains our handling of website inquiries, account administration, billing, support, and service-use information. For homeowner, employee, crew, supplier, and other records a business customer stores in its CRM, that business ordinarily determines the purposes of processing; we process the records to provide the service under its instructions and our Data Processing Addendum (DPA). This notice does not replace that business's own privacy notice.
Privacy contact: prostudiocrm@gmail.com. Mailing address: 711 Dartmouth Dr, Island Lake, IL 60042. Effective date: November 6, 2026.
2. Information we collect and its sources
Information supplied by people and businesses: names, business names, titles, email addresses, telephone numbers, billing and property addresses, consultation answers, account settings, crew and supplier contacts, prices, job details, photos, uploaded reports, proposals, job cards, appointments, support messages and attachments, and content submitted to AI-assisted features. We receive this information from users, their business administrators, website forms, and integrations they choose to connect.
Billing and agreement records: plan, amounts, payment status, transaction references, billing contact details, and limited payment-method information returned by our processor. Full payment credentials are entered into the processor's checkout; users should not put card numbers or security codes in CRM notes. For electronic agreement signing, we retain the signer name, business role and email, agreement and pricing versions, consent selections, acceptance time, and proportionate verification/security evidence described at signing.
Technical information: IP address, browser/device information, request and error logs, authentication/session identifiers, feature activity, and browser storage used for login, preferences, and draft or offline work. Avoid sensitive information in support messages or AI prompts. The service is not designed to collect Social Security numbers, medical records, biometric identifiers, or payment-card security codes.
3. How information is used
We use information to provide and administer accounts; configure the CRM; generate documents, estimates and schedules; deliver requested messages; process authorized payments; record agreements; respond to inquiries and support; troubleshoot and improve reliability; prevent fraud and unauthorized use; and comply with legal obligations. Communications about service, security, billing, and an existing request are separate from optional marketing. Marketing emails, if sent, will provide a way to unsubscribe.
We do not use a customer's homeowner records, leads, private pricing, or business data to solicit roofing work for Trussted Roofing or another contractor. We do not sell personal information or share it for cross-context behavioral advertising, and we do not authorize training of general-purpose AI models on identifiable customer content without separate permission.
4. When information is disclosed
We disclose information to authorized users and administrators in the relevant business account; recipients selected by users; and service providers that help with hosting, file storage, email delivery, payments, AI features, or other approved operations. Access is limited by purpose and suitable confidentiality/data-protection arrangements. We may also disclose information as legally required, to protect legal rights and security, or in a business transaction with safeguards and appropriate notice. We do not grant another roofing business access merely because it also uses Pro Studio CRM.
The application uses or supports Cloudflare hosting/storage, Stripe billing, Resend email, OpenAI-assisted features, and optional Web3Forms consultation delivery. Customer-connected Google Calendar/Apps Script and Square services receive data when enabled. Their roles differ: payment providers and customer-controlled integrations may act under their own agreements rather than solely as our subprocessors. The DPA vendor schedule explains which vendors support the service and which integrations are optional. Optional providers process information only when the relevant feature is enabled.
AI features send the relevant prompt, conversation context and form or document content needed for the feature to the AI provider. AI output can be inaccurate. We retain service-side conversations according to the applicable retention schedule; vendor retention follows the applicable provider terms and configured feature controls. Disabling provider response storage in an API request is not a promise of zero vendor retention.
5. Cookies, browser storage and shared links
Essential cookies and browser storage support sessions, security, preferences, and locally retained work. Browser controls can remove or restrict storage but may interrupt login or discard unsaved work. We do not operate third-party advertising pixels or sell data for targeted advertising. Any later optional tracking will be disclosed with choices required by law before it is enabled. We will honor legally applicable opt-out signals and choices if regulated sale, sharing, or targeted advertising is introduced.
Users may generate links to proposals, photos, appointment invitations, and other records. Anyone receiving or being forwarded an accessible link may be able to view the linked material. Users should choose recipients carefully and avoid unnecessary personal information. On shared devices, sign out and protect any local exports or cached work.
6. Retention and security
We retain information for the stated purposes and as needed for lawful accounting, disputes, security, and contractual duties. Our retention schedule is: active CRM records during service; a 30-day post-termination export-request window followed by deletion of operational copies within a further 30 days; residual backups within 90 days after operational deletion; inactive consultation leads for 12 months; support tickets for two years after closure; routine security/application logs for up to 90 days; and signed agreements, consent evidence, invoices and transaction records for seven years after the relationship ends. Legal holds, unresolved disputes and applicable recordkeeping rules may require longer limited retention. A verified lawful deletion request may require an earlier deletion.
Temporary demo CRM data expires after sign-out or the configured 24-hour period; explicitly submitted support/feedback records may remain under the support retention schedule. Deletion is subject to processing and cleanup cycles. We apply reasonable administrative, technical and organizational safeguards, but no system is completely secure.
7. Choices, rights and contact
Account administrators can manage available records and user access. For records a contractor holds about a homeowner or other contact, direct access, correction, deletion or export requests to that contractor; we will assist under our DPA and applicable law. For information we control ourselves, contact prostudiocrm@gmail.com with the request and enough information to identify the relevant account. Do not send passwords or full payment credentials. We may reasonably verify identity and an agent's authority before disclosing or changing information.
Depending on applicable law and eligibility, rights may include access, correction, deletion, portability, and opt-out of regulated sale, sharing, targeted advertising or certain profiling. Where a right to appeal a denial applies, send an appeal to the same email and we will explain the outcome and any available regulator complaint process. We will not unlawfully discriminate for exercising privacy rights. Rights and exceptions depend on the relevant law; this notice does not imply every state law applies to every business or request.
The service is offered to US business customers, not to children under 18. It is not directed to children under 13 and we do not knowingly collect their information. Contact us if such information is submitted. US-only sales do not guarantee that every vendor processes data only in the US; processing locations depend on the vendor and enabled integration as described in the DPA vendor schedule. We will date material notice updates and provide appropriate notice. Changes do not retroactively authorize incompatible uses of customer content.