Effective October 17, 2026
OverheadAndProfit.ai · Effective date: October 9, 2026 · Last updated: October 9, 2026 Contact for privacy requests and everything else: support@overheadandprofit.ai
We built this policy to be readable. It covers our website, web app, and installable phone app.
Our customers are businesses: roofing and restoration contractors. This policy explains what we do with two very different kinds of data: your account data, and the homeowner's data inside the claim documents you upload. The homeowner is not our customer, and we treat their data with extra care because of that.
For the homeowner data inside your uploads, you (the contractor) decide why it is collected and what it is for. You are the "controller." We process it only to do the job you paid for. We are your "processor." For your own account, billing, and support data, we are the controller.
Carrier estimate PDFs and photos usually contain the homeowner's name, address, insurance claim number, policy number, and claim dollar amounts, and photos of their property. Uploading is your choice as the contractor; you promise us (in the Terms) that you have the right to do it.
Claim content is used for exactly one thing: producing and delivering your supplement packet, plus the security, support, and legal compliance around that. Account data is used to run your account, charge what you approved, and help you. That's the list.
We do not sell anyone's data. We do not use it for advertising. We do not build profiles of homeowners. We never contact the homeowner or the insurance carrier.
We use outside AI service providers to read claim documents, describe job-site photos, and help prepare supplement packets. Before the main estimate analysis, we use automated redaction to remove names, addresses, claim numbers, and policy numbers from document text, but it may miss information. A separate step helps fill in claim details when our upload screen cannot read them: it sends estimate text, up to 80,000 characters, to our AI service providers without redacting it first. That text can include the homeowner's name, address, claim number, policy number, and other personal information. When an estimate page has little or no readable text, such as a scanned page, we send an image of the whole page to our AI service providers to read it, before any redaction. We also send job-site photos for AI processing; identifying details such as faces, house numbers, and signs may be included. Not all information sent to AI services is redacted. AI results can be wrong, and you must review every output before using it.
| Provider | What they do | Data they handle | Where |
|---|---|---|---|
| Clerk | Login and accounts | Your name, email, session | United States |
| Stripe | Payments | Your billing details, card (never on our servers) | United States |
| Supabase | Database and file hosting | Claim files, account data | United States |
| Resend | Transactional email | Your email address, order notices | United States |
| Address lookup service | Suggests property addresses as you type and checks the address you enter | The property address as you type it, and the street, city, and state we check | Set by the provider |
| AI service providers | Read claim documents, fill in claim details, describe photos, and help prepare supplement packets | Claim document text, including unredacted estimate text up to 80,000 characters for filling in claim details; images of scanned estimate pages, before redaction; homeowner names, addresses, claim and policy numbers; job-site photos and identifying details visible in them | Set by each provider |
If we ever add a provider that would handle claim content in a materially different way, we will tell you at least 30 days first.
We use only the cookies needed to keep you logged in. The installable app stores only what it needs to work; it does not add tracking. There is no advertising identifier anywhere in the product.
Encryption in transit, access controls, least-privilege access for the two people who run this company, and vendor contracts with security obligations. No system is perfect; that is why we also keep the retention windows short.
If we confirm a security incident affecting your claim content, we will notify you without unreasonable delay and no later than 72 hours after confirming it, with what we know and what we are doing. We will also meet any notice duties under state breach laws.
You are the homeowner's point of contact. Give them the notices your contract and your state require, upload only what the claim needs, and route their questions about our processing to us.
At our current size we qualify as a small business under the SBA definition, which exempts us from most obligations of the Texas Data Privacy and Security Act, but we do not lean on that: the commitments in this policy (no selling data, deletion rights, short retention, processor contracts) meet or beat what that law asks of covered companies. We never sell sensitive data, which is prohibited for us without consent regardless of size. As we grow into other states we will update this policy before anything changes.
The service is for businesses. We do not knowingly collect data from anyone under 18, and claim files should never include children's information beyond what a carrier estimate happens to contain.
The table in section 8 shows where each service provider handles data.
If we change this policy in a way that matters, we will notify account holders at least 14 days before it takes effect and update the date at the top. Old versions are available on request.
support@overheadandprofit.ai, for privacy requests, questions, and everything else.