Privacy Policy

Version: AR-CRM-PRIVACY-2026-07-08-v1.1

Effective Date: July 8, 2026

Last Updated: July 8, 2026

This AerialReports CRM Privacy Policy explains how AerialReports, operated by Northway Management & Consulting LLC, and its affiliates, contractors, service providers, and authorized technology partners collect, use, store, disclose, and protect information in connection with AerialReports CRM, AerialReports Contractor OS, Quantum 3D, lead widgets, instant estimator tools, homeowner portals, mobile applications, measurement ordering tools, integrations, websites, dashboards, communication tools, and related services collectively referred to in this Policy as the “CRM Services.”

This CRM Privacy Policy supplements the general AerialReports Privacy Policy and Terms of Use available on AerialReports.com. If there is a conflict between this CRM Privacy Policy and the general website privacy policy for CRM-related data, this CRM Privacy Policy controls for CRM Services.

By accessing, subscribing to, installing, using, logging into, or allowing your users, employees, subcontractors, homeowners, customers, or representatives to use the CRM Services, you agree to the practices described in this CRM Privacy Policy. If you do not agree, do not use the CRM Services.

1. Who This Policy Applies To

This Policy applies to:

• Contractors, roofers, exterior contractors, adjusters, restoration companies, remodelers, consultants, builders, sales representatives, subcontractors, and business users who subscribe to or use the CRM Services.
• Authorized users invited to an AerialReports CRM account.
• Homeowners, property owners, tenants, customers, claimants, leads, or prospects whose information is entered into, submitted through, or processed by the CRM Services.
• Visitors who interact with AerialReports CRM pages, lead forms, instant estimator widgets, demo forms, order forms, customer portals, 3D measurement viewers, or communications.
• Users of AerialReports mobile applications, web applications, dashboards, integrations, and related tools.

2. Our Role: CRM Provider, Measurement Provider, and Service Provider

AerialReports provides both software and measurement/reporting services. Depending on the situation, we may act in different roles.

When a contractor, company, or account owner uses the CRM Services to store leads, customer records, projects, estimates, proposals, communications, appointment notes, photos, documents, payment records, measurement orders, or job information, AerialReports generally processes that information on behalf of the account owner.

When AerialReports receives information directly from you through our website, order forms, demo forms, billing pages, customer support, marketing pages, or direct business relationship with you, we may process that information for our own business purposes.

When AerialReports creates or delivers roof, wall, gutter, siding, exterior, deck, blueprint, 3D, ESX, XML, estimate, or other measurement-related reports, we may process property information, imagery, measurements, order details, project details, sketches, diagrams, report files, and supporting data as needed to fulfill the requested service.

The CRM account owner is responsible for ensuring that any personal information, homeowner information, lead information, photos, documents, claim information, phone numbers, email addresses, SMS consent, and project data entered into the CRM Services has been collected lawfully and with all required notices, permissions, and consents.

3. Information We Collect

A. Account and User Information

This may include name, business name, title, role, email address, phone number, username, password or authentication credentials, profile settings, team members, permission levels, subscription plan, billing status, account activity, login records, and support history.

B. Contractor and Business Profile Information

This may include company name, address, service areas, license information, insurance information, logo, branding, website, sales settings, pricing preferences, proposal templates, estimate templates, team structure, job stages, workflow settings, trades performed, lead sources, and other business configuration data.

C. Homeowner, Lead, Prospect, and Customer Data

The CRM Services may store or process information about homeowners, leads, prospects, customers, claimants, property owners, tenants, or other end customers. This may include name, address, property address, email address, phone number, communication preferences, appointment requests, project details, photos, insurance claim information, roof or exterior condition information, messages, notes, proposals, estimates, contracts, invoices, payment status, uploaded documents, and CRM activity.

D. Property, Measurement, and Report Data

Because AerialReports is also a measurement and report provider, we may collect, generate, or process property-specific data such as property address, parcel or location information, roof geometry, roof squares, pitch, facets, ridges, valleys, rakes, eaves, hips, step flashing, apron flashing, drip edge, gutters, downspouts, siding or wall areas, windows, doors, trims, deck measurements, blueprint measurements, 3D model data, report PDFs, ESX/XML files, sketches, diagrams, aerial imagery references, blueprint files, drone images, photos, notes, waste charts, estimate details, and related production data.

E. Uploaded Files and Project Documents

Users may upload files, photos, blueprints, drone images, PDFs, insurance documents, claim documents, contracts, estimates, invoices, material lists, permits, inspection documents, customer signatures, before and after photos, and other project materials.

F. Communications Data

If communication features are enabled, we may process emails, SMS/text messages, call notes, voicemail notes, internal comments, automated messages, notifications, customer portal messages, appointment reminders, proposal messages, and related metadata such as sender, recipient, timestamp, delivery status, opt-in status, opt-out status, and message history.

G. Payment and Billing Information

We may collect billing name, billing address, billing email, payment status, invoice history, subscription plan, add-on purchases, usage charges, measurement order charges, payment method tokens, transaction IDs, refunds, failed payment attempts, and tax-related information. Payment card numbers and bank account details may be processed by third-party payment processors such as Square, Stripe, or another payment provider enabled for the CRM Services. Unless expressly stated otherwise, AerialReports does not intend to store full credit card numbers on its own servers.

H. Integration Data

If you connect third-party services, we may collect or process information from those integrations as authorized by you. Integrations may include services such as Google Calendar, Google Drive, Gmail or Google Workspace tools, QuickBooks, payment processors, SMS providers, email providers, supplier systems, cloud storage, mapping tools, lead sources, webhook services, or other CRM-related applications.

The information accessed depends on the integration permissions you approve and the features you enable.

I. Device, Usage, and Technical Data

We may collect IP address, browser type, device type, operating system, referring URLs, pages viewed, feature usage, login timestamps, crash reports, performance data, cookies, pixels, analytics events, session activity, location inferred from IP address, and other technical information used to operate, secure, debug, improve, and support the CRM Services.

J. Mobile App and Location Data

If you use a mobile app or location-enabled feature, we may collect mobile device information, app usage information, photo metadata, GPS or location data, route or field visit information, check-in/check-out activity, or location-based job activity if you grant permission. You may disable location permissions in your device settings, but some field-service, scheduling, routing, crew, photo, or job-location features may not function properly.

K. AI, Automation, and Analytics Data

Some CRM Services may use artificial intelligence, automation, machine learning, or rule-based decision-support tools to assist with lead intake, measurements, estimates, proposal generation, customer communications, report creation, project summaries, data extraction, workflow automation, analytics, recommendations, or productivity features. Information submitted to these features may be processed by AerialReports or authorized service providers to provide, improve, secure, and support the CRM Services.

AI-generated or automated outputs may contain errors, omissions, outdated information, or inaccurate assumptions. Users are responsible for reviewing, verifying, and approving all outputs before relying on them for proposals, estimates, contracts, claims, material orders, measurements, legal decisions, or customer communications.

4. How We Use Information

We use information to:

• Provide, operate, maintain, and improve the CRM Services.
• Create and manage user accounts, subscriptions, teams, seats, permissions, and dashboards.
• Process CRM setup, onboarding, support, demos, trials, and training.
• Create, deliver, store, display, and update measurement reports, 3D models, sketches, estimates, ESX/XML files, PDFs, project files, and related deliverables.
• Enable lead capture, instant estimator widgets, CRM workflows, scheduling, proposals, estimates, contracts, e-signatures, invoicing, payments, homeowner portals, and job management.
• Send transactional emails, SMS messages, reminders, alerts, security notifications, account updates, order updates, and service communications.
• Support integrations authorized by users.
• Process payments, subscriptions, invoices, taxes, credits, refunds, and usage-based charges.
• Detect, prevent, and investigate fraud, abuse, security incidents, unauthorized access, policy violations, and technical problems.
• Provide customer support and respond to inquiries.
• Analyze usage and performance to improve features, reports, accuracy, workflow, support, and user experience.
• Develop new features, benchmarks, analytics, templates, automation, AI tools, and measurement services using aggregated or de-identified data where appropriate.
• Send marketing communications where permitted by law and your communication preferences.
• Comply with legal obligations, enforce agreements, resolve disputes, and protect the rights, property, and safety of AerialReports, our customers, end users, and others.

5. Customer Data Ownership

As between AerialReports and the CRM account owner, the account owner retains ownership of customer records, leads, project data, uploaded documents, business data, and other content submitted to the CRM Services by or on behalf of the account owner, subject to the rights granted to AerialReports to provide and improve the CRM Services.

AerialReports does not claim ownership of a contractor’s underlying customer list, homeowner records, project files, uploaded business documents, or CRM records solely because they are stored in the CRM Services.

AerialReports may use Customer Data as necessary to provide the CRM Services, fulfill measurement and reporting orders, support users, maintain security, comply with law, process payments, operate integrations, troubleshoot, improve the system, and perform obligations under the applicable agreement.

6. Measurement Data and Report Data

AerialReports may generate, store, process, and deliver measurement-related data, including roof, wall, gutter, siding, exterior, deck, blueprint, 3D, ESX, XML, sketch, estimate, and related report outputs.

Measurement reports and report files may be created from aerial imagery, satellite imagery, blueprints, drone images, user-submitted information, third-party data sources, technician review, computer vision, AI-assisted processes, manual review, or a combination of these methods.

AerialReports may retain copies of measurement reports, order records, source files, output files, notes, and related production data for quality control, support, audit, redo handling, dispute resolution, recordkeeping, security, product improvement, and legal purposes.

Unless otherwise agreed in writing, AerialReports may use aggregated, de-identified, or anonymized measurement and usage data to improve report accuracy, develop product features, benchmark service performance, train internal systems, improve technician workflows, and enhance the CRM Services, provided that such data does not identify a specific customer or individual.

7. SMS, Text Messaging, and Phone Numbers

The CRM Services may allow AerialReports, account owners, contractors, users, or authorized service providers to send SMS/text messages, appointment reminders, order updates, lead responses, verification codes, project updates, proposal notifications, customer portal messages, or other communications.

By providing a mobile phone number to AerialReports or through the CRM Services, you consent to receive service-related and transactional SMS messages where applicable. Marketing or promotional text messages will only be sent where permitted by law and where required consent has been obtained.

If a contractor or account owner sends SMS messages to homeowners, leads, customers, tenants, or prospects through the CRM Services, the contractor or account owner is responsible for obtaining and maintaining legally sufficient consent before sending messages. This includes any required express consent or express written consent, depending on the type of message.

Message frequency may vary. Message and data rates may apply. Recipients may opt out of non-essential SMS messages by replying STOP or using any other opt-out method provided. Recipients may reply HELP for assistance where supported. After an opt-out request, a confirmation message may be sent, and non-essential messages should stop unless the recipient opts in again.

Mobile phone numbers, SMS opt-in records, and SMS consent data will not be sold, rented, or shared with third parties for their independent marketing purposes. We may share SMS-related information with communication providers, carriers, compliance vendors, and service providers as necessary to deliver messages, manage consent, prevent abuse, maintain deliverability, comply with law, and operate the CRM Services.

8. Email, Notifications, and Marketing Communications

We may send service-related emails, transactional messages, support messages, security notices, product updates, billing notices, report delivery notices, and CRM notifications. These are necessary to provide the CRM Services and may not always include an unsubscribe option.

We may also send marketing emails, product announcements, educational content, or promotional offers where permitted by law. You may opt out of marketing emails by using the unsubscribe link or contacting us. Opting out of marketing emails does not stop service-related or transactional communications.

9. Payments and Payment Processors

Payment processing may be handled by third-party payment processors such as Square, Stripe, or another provider enabled in the CRM Services. These providers may collect, process, store, tokenize, or transmit payment data according to their own terms, privacy policies, and security practices.

AerialReports may receive limited payment-related information such as payment status, transaction ID, customer ID, last four digits of a payment method, card brand, billing details, invoice details, refund status, chargeback or dispute status, and subscription status.

If a CRM account owner uses payment features to collect money from its own customers, the account owner is responsible for its customer relationship, pricing, refund policy, tax obligations, disputes, chargebacks, customer notices, and compliance with applicable payment processor terms.

10. Third-Party Integrations and Services

The CRM Services may connect with third-party services selected, enabled, or authorized by you. These may include payment processors, SMS providers, email providers, calendar services, accounting platforms, cloud storage, mapping providers, supplier systems, financing providers, e-signature providers, analytics tools, AI providers, measurement providers, or lead sources.

When you enable an integration, you authorize AerialReports to access, process, transmit, and store information as needed to provide that integration. Third-party services are governed by their own terms and privacy policies. AerialReports is not responsible for the privacy, security, availability, performance, or compliance practices of third-party services that it does not control.

You are responsible for reviewing third-party terms before enabling integrations and for ensuring that your use of any integration complies with applicable law and contractual obligations.

11. Google API and Google Workspace Data

If you connect Google services such as Google Calendar, Google Drive, Gmail, Google Sheets, or Google Workspace tools, AerialReports will use Google user data only to provide or improve user-facing CRM features that you request or enable.

We will not sell Google user data. We will not use Google user data for advertising or unrelated marketing. We will not transfer Google user data except as necessary to provide or improve the requested user-facing features, comply with law, protect security, or as otherwise permitted by Google’s applicable policies and your consent.

Human access to Google user data is limited to circumstances such as providing support with your permission, investigating security or abuse, complying with law, or internal operations using aggregated or de-identified data where permitted.

12. Cookies, Tracking, Analytics, and Session Tools

We may use cookies, pixels, web beacons, local storage, analytics tools, and similar technologies to operate the CRM Services, maintain login sessions, remember preferences, secure accounts, measure performance, analyze usage, improve features, support advertising, and troubleshoot issues.

We may use analytics or session-replay tools to understand how users interact with our website or application, identify technical issues, improve onboarding, and support product development. Where required by law, we will provide notice or consent options.

You may control cookies through your browser settings, but disabling cookies may affect login, dashboard, checkout, security, integrations, and CRM functionality.

13. How We Share Information

We may disclose information to:

• Service providers that help us host, operate, support, secure, analyze, deliver, bill, communicate, and improve the CRM Services.
• Payment processors for billing, subscriptions, invoices, payments, refunds, disputes, fraud prevention, and compliance.
• SMS, email, voice, notification, and communication providers to send messages and manage opt-in/opt-out status.
• Cloud hosting, storage, database, backup, CDN, security, monitoring, and infrastructure providers.
• Integration providers authorized by you.
• Measurement production teams, technicians, subcontractors, quality-control personnel, or service partners as needed to fulfill orders and support CRM Services.
• Professional advisors such as attorneys, accountants, auditors, insurers, and consultants.
• Government authorities, law enforcement, courts, or regulators where required by law or necessary to protect rights, safety, and security.
• A successor or buyer in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction.
• Other parties with your consent or at your direction.

We may also share aggregated, de-identified, or anonymized information that does not reasonably identify a specific individual or customer.

14. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. These safeguards may include access controls, authentication, encryption, monitoring, backups, logging, permission management, vendor controls, and security review procedures.

No system, transmission, storage method, or security measure is perfect. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials, limiting user access, managing team permissions, training your users, securing your own devices and networks, and promptly notifying us of suspected unauthorized access.

15. Data Retention

We retain information for as long as reasonably necessary to provide the CRM Services, maintain accounts, deliver reports, support users, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, maintain security, process billing, and support business operations.

CRM account data, measurement reports, order files, logs, backups, support records, payment records, SMS consent records, and legal records may be retained for different periods depending on the nature of the data and applicable requirements.

If an account is cancelled or terminated, we may retain certain data for a limited period for backup, audit, legal, billing, security, dispute-resolution, tax, quality-control, or compliance purposes. Data stored in backups may not be immediately deleted but will be handled according to our retention practices.

16. Your Privacy Choices and Rights

Depending on your location, you may have rights to request access to, correction of, deletion of, or portability of certain personal information. You may also have the right to opt out of certain marketing communications or certain types of data sharing where applicable law provides such rights.

To exercise privacy rights, contact us using the information below. We may need to verify your identity before processing a request. If your information is controlled by a CRM account owner, such as a contractor using AerialReports CRM, we may direct you to that account owner or process the request in coordination with that account owner.

We will not discriminate against you for exercising privacy rights available under applicable law.

17. U.S. State, Canadian, and International Privacy Rights

The CRM Services are primarily intended for users located in the United States and Canada. Some jurisdictions provide additional privacy rights. If you are located in California or another jurisdiction with specific privacy laws, you may have additional rights regarding access, deletion, correction, portability, opt-out, limitation of sensitive personal information, or appeal of privacy decisions.

If you are located outside the United States, your information may be transferred to, processed in, and stored in the United States or other countries where we or our service providers operate. These countries may have data protection laws different from your location.

18. Children’s Privacy

The CRM Services are not intended for children under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the CRM Services, contact us so we can review and take appropriate action.

19. Account Owner Responsibilities

If you are a CRM account owner, contractor, company administrator, or business user, you are responsible for:

• Providing required privacy notices to your customers, homeowners, leads, employees, subcontractors, and users.
• Obtaining required consents for SMS, email, calls, recording, marketing, customer portal access, payment collection, document uploads, and other communications.
• Ensuring that data entered into the CRM Services is accurate, lawful, and authorized.
• Managing user permissions and access levels.
• Removing users who should no longer have access.
• Complying with consumer protection, privacy, marketing, telemarketing, TCPA, CAN-SPAM, CASL, payment, employment, insurance, construction, and other laws applicable to your business.
• Reviewing AI, estimate, proposal, measurement, and automation outputs before relying on them.
• Verifying measurements, pricing, scope, materials, contracts, code requirements, insurance claim information, and customer communications before use.

20. Changes to This Policy

We may update this CRM Privacy Policy from time to time. When we make changes, we will update the “Last Updated” date. If changes are material, we may provide additional notice through email, the CRM dashboard, website notice, or other reasonable means. Your continued use of the CRM Services after an updated Policy becomes effective means you accept the updated Policy.

21. Sub-Processors and Service Providers

AerialReports uses a limited set of third-party service providers ("Sub-Processors") to operate the CRM Services. The list below reflects our current material Sub-Processors and may change from time to time. This list is provided for transparency; it is not a warranty that any specific provider will be used at any specific time.

• Application Hosting & Compute — Render (application runtime, web services, background jobs).
• Database — Neon (managed Postgres for CRM records and account data).
• Object Storage & Media — Cloudflare R2 (photos, uploaded documents, report files).
• CDN, DNS & Edge Security — Cloudflare (content delivery, DDoS protection, DNS).
• Payment Processing — Square (subscriptions, wallet top-ups, one-time payments). Stripe or an equivalent alternative processor may be enabled for specific accounts or geographies.
• Email Delivery — Resend and/or SendGrid (transactional and notification email).
• SMS Delivery — Twilio (SMS, MMS, voice status, A2P 10DLC campaign delivery).
• Mapping & Property Data — Google Maps Platform (address autocomplete, geocoding, satellite imagery in-app, Street View).
• User-Enabled Integrations — Google Workspace (Calendar, Drive, Gmail), QuickBooks, and other integrations that a customer chooses to connect.

Each Sub-Processor is bound by its own terms of service and privacy commitments and processes information only as needed to provide the service for which it is engaged. AerialReports remains responsible for the acts and omissions of its Sub-Processors to the extent required by applicable law and by our contracts with those Sub-Processors.

22. Data Retention — Specific Periods

Section 15 describes our overall approach to retention. The periods below are our target retention windows unless a longer or shorter period is required by law, contract, or a legal hold. Actual retention may vary based on backups, replication, account status, and technical feasibility.

• Active CRM account data — retained for the life of the subscription and during the thirty (30)-day post-cancellation grace period described in the EULA §39.
• Backups and disaster-recovery snapshots — typically retained up to thirty-five (35) days on a rolling basis and then overwritten.
• Support and communications logs — typically retained twenty-four (24) months for support quality, dispute resolution, and abuse review.
• SMS opt-in and consent records — retained at least four (4) years, or longer where required by law or by carrier or provider rules.
• Payment and billing records — retained for at least seven (7) years for tax, accounting, and audit purposes.
• Policy acceptance records (Privacy, EULA, NDA) — retained for the life of the account plus at least seven (7) years thereafter to support compliance defense.
• Measurement orders, report files, and production records — retained for at least seven (7) years for quality control, redo eligibility, dispute defense, and internal training.
• Security logs, access logs, and audit logs — typically retained twenty-four (24) months, or longer where required by law, security investigation, or legal hold.

23. U.S. State Privacy Rights

Depending on your state of residence, you may have specific rights under state privacy law, including under the California Consumer Privacy Act as amended by the CPRA ("CCPA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), and other similar state laws. These rights typically include the right to know, access, correct, delete, or receive a portable copy of your personal information, the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising (we do not engage in either), the right to limit the use of sensitive personal information, and the right to appeal a denied request.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising as defined by the CCPA or similar state laws. To exercise a state privacy right, contact privacy@aerialreports.com. We may need to verify your identity before processing a request and, where you are exercising rights over data controlled by a CRM account owner, we may direct or coordinate the request with that account owner.

24. Canadian PIPEDA and Provincial Rights

If you are located in Canada, you may have rights under the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial laws (including Quebec's Law 25, Alberta's PIPA, and British Columbia's PIPA), including rights of access, correction, and withdrawal of consent. You may contact privacy@aerialreports.com to exercise these rights.

25. Data Processing Addendum

Business customers who require a written Data Processing Addendum ("DPA") to comply with GDPR, UK GDPR, CPRA, or other privacy laws may request one by emailing privacy@aerialreports.com with the subject line "DPA Request." AerialReports offers a standard DPA that incorporates the current Sub-Processor list, applicable Standard Contractual Clauses where required for international transfers, and reasonable security commitments. Custom modifications to the standard DPA may be subject to a review fee and legal review.

26. Cookies, Tracking, and Consent

Section 12 describes our use of cookies, pixels, local storage, and analytics tools. Where required by applicable law (including in the European Economic Area, the United Kingdom, and certain U.S. states), AerialReports will provide notice or a consent interface for non-essential cookies before setting them. Essential cookies and local storage necessary to operate the CRM Services (such as login sessions, security tokens, load balancing, and CSRF protection) are used without prior consent where permitted by law because the CRM Services will not function without them.

You may control cookies through your browser settings. Disabling essential cookies or local storage will break login, dashboard, checkout, integrations, and CRM functionality.

27. Security Incident and Vulnerability Reporting

To report a suspected security incident, unauthorized access, data breach, vulnerability, or other security concern involving the CRM Services, please email security@aerialreports.com. Please include enough detail to allow us to reproduce and investigate the issue. We appreciate responsible disclosure and will not pursue good-faith security researchers who follow reasonable disclosure practices.

28. Accessibility

AerialReports is committed to providing accessible software and to improving accessibility over time. If you experience an accessibility barrier when using the CRM Services or reading this Policy, please contact support@aerialreports.com so we can work with you on accommodations and address the barrier where feasible.

29. Contact Us

Use the role-specific email that best matches your inquiry:

• General support and support-ticket inquiries: support@aerialreports.com
• Privacy requests, data-subject rights, opt-outs, and DPA requests: privacy@aerialreports.com
• Legal notices, arbitration opt-outs, and contract questions: legal@aerialreports.com
• Security incidents, vulnerability reports, and abuse notices: security@aerialreports.com

AerialReports / Northway Management & Consulting LLC
Website: https://www.aerialreports.com
Mailing Address: 200 Innovative Way, Suite 1300, Nashua, NH 03062

Until a role-specific inbox is monitored, messages sent to any of the addresses above will reach the same team via support@aerialreports.com.

For CRM account-specific data controlled by a contractor or business account owner, please contact the applicable account owner first.