Privacy policy

Overview

Verlua operates Instant Quote, a service that measures homes from satellite imagery and provides price ranges for exterior services. This policy explains how we collect, use, share, and protect personal information from two groups: contractors who use our service and homeowners who request quotes through contractor websites.

Information we collect

From contractors

When you create an account to use Instant Quote, we collect:

• Your name, email, business name, and phone number.
• Your business address and service areas.
• Pricing configuration (the numbers you set for services and materials).
• Team member names and emails.
• Payment information (processed by Stripe; we do not store credit card data).
• Your usage (quotes requested, widgets embedded, leads submitted).

From homeowners using the widget

When a homeowner enters an address in the Instant Quote widget on your website, we collect:

• The property address and coordinates.
• The homeowner's responses to questions (number of stories, roof type, materials they want).
• If they request a quote: their name, phone number, email, preferred contact time, and whether they consent to text messages.
• A hash of their IP address (not the IP itself), used only to detect abuse and limit repeated requests.

We do not store the homeowner's credit card information, payment method, or any information they choose not to provide.

How we use this information

For contractors

We use your information to:

• Create and manage your account and team members.
• Operate the Instant Quote widget and dashboard.
• Bill you for your subscription and usage.
• Route leads to you via email, webhook, or SMS based on your settings.
• Monitor for abuse, fraud, and policy violations.
• Improve Instant Quote and provide customer support.

For homeowners

We use homeowner information to:

• Measure the home from satellite imagery and provide a price range.
• Deliver the quote and lead information to the contractor.
• Send one SMS to the homeowner (if they consented) thanking them and offering to schedule an appointment.
• Monitor for abuse and prevent spam or duplicate quotes.

Legal basis for processing

We process information under these legal bases:

• Contract: to provide Instant Quote to you (contractor) and to deliver quotes to homeowners.
• Legitimate interest: to prevent fraud and abuse, to improve our service, and to comply with legal obligations.
• Consent: homeowners consent when they click "Request estimate"; they consent to SMS if they check the SMS box.

How we share information

Subprocessors

We share information with the following service providers:

• Supabase: cloud database and authentication (US servers). Stores account data and lead information.
• Google Cloud Platform: satellite imagery and address data via the Maps Platform (Solar, Places, Geocoding, Maps Static APIs). Google receives the address and location data needed to provide imagery.
• Stripe: payment processing (payment information only, not stored by us).
• Twilio: SMS delivery for lead notifications to homeowners and alerts to contractor teams (SMS number only).
• Resend: email delivery for lead confirmations and account notifications.
• Upstash: rate limiting to prevent abuse (IP hashes only, no personal data).
• RentCast: optional property records to improve address accuracy and homeowner details (used only if configured by the contractor).
• Netlify: hosting and CDN.
• Google Analytics: visit statistics for our marketing site only, never the widget or dashboard (when enabled).
• Contractor's CRM or webhook: if the contractor configures lead routing, we send the homeowner's information to their specified endpoint or CRM.

Each subprocessor is contractually bound to use information only for the stated purpose and to comply with applicable privacy laws.

We tell contractor customers by email at least 30 days before we add a subprocessor that handles homeowner or account data. If you object, reply to that email; if we can't address the objection, you can cancel and we'll refund any prepaid fees for the unused period. Email support@verlua.com for the current list.

Other sharing

We do not sell or share personal information for cross-context behavioral advertising. We do not share or rent your information to third parties, except:

• As required by law (subpoena, court order, government request).
• To protect our legal rights or prevent fraud and abuse.
• In connection with a merger, acquisition, or sale of assets (with notice).

Retention and deletion

Contractor accounts

We retain your account information and configuration for as long as your account is active. If you cancel your subscription, we retain this data for 30 days (to allow export) and then delete it, unless required by law.

Leads and homeowner data

Leads (homeowner contact information) are retained for the lifetime of your account so you can track job status and accuracy. If your account is deleted, we retain leads for 30 days for your export and then permanently delete them.

Satellite imagery cache

Satellite imagery and measurement data are cached for up to 7 days per address. After 7 days, this raw data is deleted. Derived measurements (footprint size, roof type, estimated run lengths) are stored with each quote.

IP address hashes

We store IP address hashes (SHA-256, salted) to prevent abuse and track requests by origin. Hashes are retained for 30 days and then deleted.

Cookies and tracking

The Instant Quote widget uses only essential cookies:

• Session cookies: to keep you logged in to your contractor dashboard.

We do not use advertising cookies, analytics cookies, or third-party tracking pixels in the homeowner's widget. The widget does not send information to Google Analytics, Facebook, or other advertising networks.

On our own marketing site (not in the widget and not in the contractor dashboard) we may use Google Analytics to learn how visitors find and use the site. When it is on, Google Analytics sets first-party cookies (such as _ga) and records page views and a sign-up event. It never receives homeowner lead information. You can opt out with Google's browser add-on or by blocking cookies for this site.

California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right to:

Know

Request what personal information we have collected about you in the past 12 months.

Delete

Request deletion of your personal information. We will delete it within 45 days, unless we need to retain it to complete your transaction, comply with legal obligations, or enforce our agreements.

Correct

Request correction of inaccurate personal information.

Opt-out

We do not "sell"or "share"personal information for cross-context behavioral advertising, so there is no opt-out required. If this changes, we will provide a "Do Not Sell My Personal Information"link on our website.

How to submit a request

To exercise any of these rights, email support@verlua.com with:

• "CCPA Request: [Know / Delete / Correct]"
• Your name and email address.
• A description of what you're requesting.

If you are a homeowner, the contractor who collected your lead can also submit a request on your behalf. We will verify your identity and respond within 45 days.

Children's privacy

Instant Quote is not directed to children under 13. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 13, we will promptly delete it.

Security

We use industry-standard security measures to protect your information:

• Encryption in transit (HTTPS).
• Restricted access to database systems.
• Regular security audits and vulnerability testing.
• Limited employee access to customer data.

However, no security measure is perfect. If we discover a breach, we will notify you in accordance with applicable law.

Third-party links and services

Our website and dashboard may link to third-party services (e.g., your CRM, calendar, or payment processor). This policy does not apply to those services. We encourage you to review their privacy policies before providing information.

Changes to this policy

We may update this policy by posting the revised version here with an updated date. Material changes will be communicated via email at least 30 days before they take effect.

Contact

If you have questions about this policy or our privacy practices, contact support@verlua.com.