Privacy Notice

This notice explains what information Vfane collects from homeowners, from contractors, and from the past clients contractors invite to endorse them — why we collect it, who can see it, and how we protect it. Vfane is an online marketplace that connects homeowners in Texas with residential roofing contractors.

From homeowners:

• Your account: email address and sign-in credentials. You can also start anonymously — unused anonymous accounts are deleted automatically (see Cookies and Analytics).
• Optional profile details you add: your name, phone number, and ZIP code
• Project details you enter: project type, urgency, and the project ZIP code — plus any project notes you write. Project notes are private to you; they are not shared with contractors.
• Messages and attachments you send. These are delivered to the contractor you send them to.
• Reviews and endorsements you submit about contractors
• A record of the contact details you choose to share with a contractor through the in-app sharing control
• Your AI assistant conversations — the questions you ask and the responses you receive (see AI Assistant and Service Providers)
• Content and lists you save on the platform, such as contractors you save to your list

From contractors:

• Your business profile: business name, business contact details, specialties, service areas, years in business, certifications you list, portfolio photos, posts you publish, other profile content you upload, and connections you make with other contractors
• Certificate of Insurance (COI) documents you choose to upload. These are stored privately and seen only by you and Vfane's admin. Vfane does not confirm insurance coverage with carriers — uploading a COI is not a Vfane verification of your coverage.
• Evidence you submit when you request pillar verification
• Invitations you send to past clients: the email addresses of past customers you invite to endorse you, and any personal message you include. By entering someone's contact details, you confirm you have the right to share them with us. If a past client accepts an invitation, they sign in with the invited email address — that creates a Vfane account, and Vfane collects that account's email address along with the endorsement they submit. Invited past clients have the same deletion rights described in Your Choices and Data Deletion.
• Lead and CRM records you type in your workspace — notes, quick replies, and contact entries, which may include homeowner contact details
• Publicly available business information: for contractor business profiles — including profiles created before they are claimed — Vfane may collect public business information, such as business listings and public ratings

Automatically:

• Cookies and first-party usage records — described in the Cookies and Analytics section below. Like any website, Vfane's servers and the service providers that run them receive IP addresses and standard technical request data when your browser connects.

We collect information for one purpose: operating Vfane. That means matching homeowners with contractors, checking contractor pillar claims against named sources, delivering your messages and notifications, and keeping the platform safe and honest. We do not use it for any purpose other than operating Vfane.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not sell leads or contact information. There are no advertisers on Vfane. When your information moves to someone else — like a matched contractor seeing your project details — it is to fulfill your own request, at your direction; it is never sold to a third party for its own independent use.

• Homeowner project details: By default, a contractor who receives a matched lead sees only your project type, urgency, and the ZIP code area of the project (the 5-digit ZIP) — not your name, email, phone, or address. Your contact information stays private unless you choose to share it: through Vfane's in-app sharing control you can share specific details with one connected contractor at a time, and Vfane keeps a best-effort record of what you shared and with whom. The structured contact details you can share this way are limited to your name, email, phone, and ZIP/area — not a street address. Anything you type directly into a message is your own disclosure, shared as you send it, outside this control.
• Contractor profiles: Public. Anyone can view your business name and your pillar statuses — Verified, meaning Vfane confirmed that item against a named source; Stated by contractor, meaning the item is the contractor's own claim, not independently checked; or, while Vfane checks an item submitted for verification, Under review — plus specialties, service areas, years in business, portfolio photos, posts, reviews, and endorsements. Business contact details you enter for display are part of the public profile: your business email is shown in full, your business phone is shown masked except to homeowners with an active lead with you, and your business address is shown only to signed-in viewers.
• Project notes: Private to the homeowner who wrote them. They are not shared with contractors.
• Messages: Visible to the participants in the conversation, including any attachments.
• Reviews and endorsements: Public, on the contractor's profile. They are written by homeowners or, for invited endorsements, by people a contractor invites as past clients — they are not verifications or endorsements of the contractor by Vfane.
• COI documents: Private. Files you upload go to a private storage bucket that only you and Vfane's admin can access; they are not displayed publicly. Vfane does not confirm insurance coverage with carriers — homeowners should request a current COI from the contractor directly.
• Sign-in email addresses: Private. The email address on your account is not displayed publicly. A contractor's business email is separate — contractors enter it specifically for public display.
• Profile activity (contractor analytics): Contractors can see anonymized activity about their own profile — aggregate counts of match appearances and profile views (small counts are hidden), and a per-visit timeline showing only metadata such as project type, ZIP code area, dates, and general AI assistant topic labels. These views do not include your name, your contact details, or the text of your messages or assistant conversations.

Vfane sets a small number of first-party cookies — cookies from Vfane itself, none from advertisers or other companies:

• Sign-in cookies (sb-*): set by our authentication provider, Supabase, to keep you signed in
• vfane_role: remembers for one hour whether your account is a homeowner or contractor account, so pages route correctly
• vfane-session-id: a random identifier, kept for 30 days, that our own analytics use to connect visits from the same browser into one session
• NEXT_LOCALE: remembers your language choice (English or Spanish)

As you use Vfane, we write entries to our own first-party event log: the type of event (for example, completing a step of the matching flow), the project ZIP code, project type, and urgency where relevant, and related technical detail. When an event is tied to a signed-in account, the log stores a one-way hash of the account identifier rather than the identifier itself, plus a flag for whether the session was anonymous. For visitors who are not signed in, the log instead stores a shortened one-way hash derived from the network (IP) address — not the address itself. Questions you ask the AI assistant enter this analytics log as one-way hashed fingerprints used for quality measurement and, when the assistant searches our knowledge base, as the individual search words drawn from your question.

We also record match impressions and profile views — when a contractor's profile appears in a homeowner's match results or gets viewed. Each record can include the session identifier, the contractor shown, the project and its ZIP code, the signed-in homeowner's account, and where the view came from. Contractors see this activity only in the anonymized forms described in Who Can See Your Information.

We do not use third-party analytics services, advertising trackers, or social-media pixels.

Anonymous accounts at least 7 days old whose projects never matched with a contractor are deleted automatically by a weekly cleanup — the account, its profile, and its projects. Entries already written to the event log are not deleted by that cleanup.

Vfane's AI assistant is powered by Anthropic, an AI provider: when you chat with the assistant, your conversation is sent to Anthropic to generate each response. Vfane also keeps its own log of assistant conversations — your messages and the assistant's responses, tied to your session — to operate, debug, and improve the assistant. Assistant conversations are not shown to contractors; at most, contractors see the anonymized topic labels described in Who Can See Your Information.

Vfane runs on a small set of service providers that process data to operate the platform: Supabase (database, sign-in, and file storage), Vercel (website hosting), Anthropic (AI assistant responses), and Resend (transactional email, such as lead notifications and review invitations).

Your data is stored on Supabase with Row Level Security policies, so each user can access only the data they are authorized to see. Sensitive files, such as COI documents, are stored in private buckets.

If a government agency or third party demands user data, we produce only what actually exists. We require valid legal process, we challenge demands that are overbroad or improper, and wherever the law allows, we notify the affected user before responding. We cannot produce information we never collected.

You can request deletion of your account and personal data at any time by emailing support@vfane.com. Deletion is currently handled as a request — there is no self-serve delete button yet — and we process requests within 30 days. We delete the personal data we can link to your account. AI-assistant conversation and safety logs are keyed to a session identifier rather than directly to your account; where Vfane's own records link a session to your account — for example, assistant use while signed in — we locate and delete those logs as part of your request. The same lookup covers our first-party event log: entries carrying your account's hashed identifier are deleted — or have that identifier severed — as part of the same request. Only for sessions we cannot link to you, such as signed-out use, may we be unable to find those logs unless you can provide the session identifier.

For contractors, uploaded documents (including COI files) are deleted within 90 days of account closure.

Anonymous accounts that never matched with a contractor are cleaned up automatically after 7 days, as described in Cookies and Analytics.

Some browsers send opt-out-of-sale signals such as Global Privacy Control. Vfane does not sell personal data and does not share it for cross-context behavioral advertising — as those terms are defined by state privacy laws, including Texas's and California's — so there is no sale or sharing for such a signal to stop.

If we become aware of a data breach that compromises your personal information, we will notify you as required by Texas law (Texas Business & Commerce Code Section 521).

Vfane is not designed for anyone under 18. We do not knowingly collect information from minors. If you believe a minor has provided us personal information, contact us and we will delete it.

This notice is written in English. The Spanish version is a translation provided for convenience; if the two versions conflict, the English version controls.

We may update this notice from time to time. If we make material changes, we will give notice in advance — by email or by a notice on the platform. Changes apply going forward from their effective date; no change applies retroactively.

Privacy questions: support@vfane.com