Privacy Policy

OverheadAndProfit.ai · Effective date: August 20, 2026 · Last updated: August 20, 2026 Contact for privacy requests and everything else: support@overheadandprofit.ai

We built this policy to be readable. It covers our website, web app, and installable phone app.

1. Who this covers

Our customers are businesses — roofing and restoration contractors. This policy explains what we do with two very different kinds of data: your account data, and the homeowner's data inside the claim documents you upload. The homeowner is not our customer, and we treat their data with extra care because of that.

2. Our role: you are the controller, we are the processor

For the homeowner data inside your uploads, you (the contractor) decide why it is collected and what it is for — you are the "controller." We process it only to do the job you paid for — we are your "processor." For your own account, billing, and support data, we are the controller.

3. What we collect from you

• Account: name, business name, email, login records (through our login provider, Clerk).
• Billing: order history and payment status. Card numbers go directly to Stripe; we never see or store them.
• Support: emails you send us.
• Technical: login-session cookies and basic security logs. We run no advertising trackers and no third-party analytics.

4. What is inside the claims you upload

Carrier estimate PDFs and photos usually contain the homeowner's name, address, insurance claim number, policy number, and claim dollar amounts, and photos of their property. Uploading is your choice as the contractor; you promise us (in the Terms) that you have the right to do it.

5. How we use data

Claim content is used for exactly one thing: producing and delivering your supplement packet, plus the security, support, and legal compliance around that. Account data is used to run your account, charge what you approved, and help you. That's the list.

6. What we will never do

We do not sell anyone's data. We do not use it for advertising. We do not build profiles of homeowners. We never contact the homeowner or the insurance carrier. We do not use identifiable claim data to train AI models, and our contracts forbid our vendors from doing so with your data.

7. AI processing

Our analysis uses AI systems operated by third-party providers (named in the table below). Before any document text reaches an AI provider, we strip direct identifiers — names, addresses, claim numbers, policy numbers — and send only the minimum data the analysis needs, under API terms that do not permit training on your data. The homeowner's details are added back into your finished packet by our own document engine, never by the AI. Providers retain API inputs and outputs only for a limited period under their API terms. AI results can be wrong — that is why the Terms require your human review of every output.

8. Who touches the data (service providers)

Provider	What they do	Data they handle	Where
Clerk	Login and accounts	Your name, email, session	United States
Stripe	Payments	Your billing details, card (never on our servers)	United States
Supabase	Database and file hosting	Claim files, account data	United States
Resend	Transactional email	Your email address, order notices	United States
Anthropic, PBC	AI analysis (primary)	Redacted, minimum-necessary claim content	United States
OpenAI	AI analysis (backup)	Redacted, minimum-necessary claim content	United States

Each provider is bound by written terms covering confidentiality, security, deletion, and no-training. If we ever add a provider that would handle claim content in a materially different way, we will tell you at least 30 days first.

9. Cookies and the phone app

We use only the cookies needed to keep you logged in. The installable app stores only what it needs to work; it does not add tracking. There is no advertising identifier anywhere in the product.

10. How long we keep things

• Claim content (estimates, photos, extracted text, packets): kept 90 days after your packet is delivered so you can download and reference it during the carrier's process. It is purged from active systems within 7 days after that window, and leaves encrypted backups within 35 more days. You can delete any claim earlier, anytime, from your account or by emailing us.
• Billing records: kept 7 years for tax and accounting law — without claim documents inside them.
• Security logs: about 12 months. Support emails: about 24 months.
• When your account closes: claim content is deleted within 30 days (export your packets first), unless a legal hold applies.

11. Deletion, access, and correction

• Contractors: email support@overheadandprofit.ai or use your account. Valid requests are completed within 45 days.
• Homeowners: you may email us directly at support@overheadandprofit.ai. Because your contractor controls the claim file, we will verify your request, pass it to them within 5 business days, and carry out the deletion. We will not confirm whether any claim exists until we have verified who is asking.
• An authorized agent with proof may act for either.

12. Security

Encryption in transit, access controls, least-privilege access for the two people who run this company, and vendor contracts with security obligations. No system is perfect; that is why we also keep the retention windows short.

13. If something goes wrong

If we confirm a security incident affecting your claim content, we will notify you without unreasonable delay and no later than 72 hours after confirming it, with what we know and what we are doing. We will also meet any notice duties under state breach laws.

14. Your responsibilities for homeowner data

You are the homeowner's point of contact. Give them the notices your contract and your state require, upload only what the claim needs, and route their questions about our processing to us.

15. State privacy laws

At our current size we qualify as a small business under the SBA definition, which exempts us from most obligations of the Texas Data Privacy and Security Act — but we do not lean on that: the commitments in this policy (no selling data, deletion rights, short retention, processor contracts) meet or beat what that law asks of covered companies. We never sell sensitive data, which is prohibited for us without consent regardless of size. As we grow into other states we will update this policy before anything changes.

16. Children

The service is for businesses. We do not knowingly collect data from anyone under 18, and claim files should never include children's information beyond what a carrier estimate happens to contain.

17. Where data lives

All processing and storage happen in the United States.

18. Changes to this policy

If we change this policy in a way that matters, we will notify account holders at least 14 days before it takes effect and update the date at the top. Old versions are available on request.

19. Contact

support@overheadandprofit.ai — for privacy requests, questions, and everything else.