The questions you'd ask
before you upload anything.
A CRM for this trade ends up holding Social Security numbers, call recordings, bank links and the homeowner record behind every deal you've signed. Who can read them, which vendors touch them, how long they are kept, and who is on the hook when a call goes wrong — all of it is answered in the documents below, in the words that bind us, not in a sentence on a marketing page.
Every answer, and where it is written down
Terms of Service
The full agreement governing use of the platform — accounts, fees, acceptable use, telephony/TCPA, prospecting/FCRA, indemnification, and arbitration.
Read the Terms →Privacy Policy
What we collect, how we use it, our two roles (controller vs. processor), retention windows, your state privacy rights, and the Google & Microsoft data-use disclosures.
Read the Policy →Data Processing Addendum
Our service-provider commitments, sub-processor terms, 72-hour breach notice, audit rights, and the Annex II security measures and Annex III sub-processor list.
Read the DPA →Security
Field-level AES-256-GCM encryption of SSNs, stored email & OAuth tokens; TLS in transit; role-based access with least privilege; row-level per-org tenant isolation; audit logging of sensitive access; and signed-URL object storage — no raw file keys.
See Annex II measures →Sub-processors
Our main sub-processors are Cloudflare and AWS (hosting, storage, AI call transcription), Telnyx (calls and SMS), Anthropic (AI), Google and Microsoft (email, calendar, push notifications), Apple (iOS push), CARTO (maps) and Stripe (payments). Others, such as Moov and DealMachine, run only where a feature is enabled. The complete list, and what each one touches, is in Annex III of our DPA.
See the full list →OAuth & data use
Connect Google or sign in with Microsoft — with strict limits on what that access is used for.
Google API Services · Limited Use Microsoft Identity · Sign-In
Gmail data is never used to train AI and only powers the feature you asked for; Microsoft is sign-in only. Details in Section 9 and Section 9A of the Privacy Policy.
Read the disclosures →The parts that change what you're liable for
Nobody reads twenty-six sections before signing up, and the ones that matter are the ones that put risk on you — because you control the calls, the data and the contracts. Here they are in plain language, each linked to the exact provision so you can check the wording against this summary.
- You indemnify & hold us harmless for third-party claims arising from your use of the Services and your data. Terms § 19.
- TCPA & call-recording compliance is yours. You are responsible for consent, do-not-call scrubbing, and two-party-consent rules on every call. Terms § 10.
- FCRA responsibility is yours. Prospecting & skip-traced data is not a consumer report and may never be used for credit, insurance, employment, or housing eligibility. Terms § 11.
- The Services are provided "AS IS." We disclaim implied warranties to the extent the law allows. Terms § 20.
- Liability is capped at the fees you paid in the prior twelve months, with no indirect or consequential damages. Terms § 21.
- Disputes go to binding arbitration in El Paso County, Colorado, with a class-action and jury-trial waiver (30-day opt-out). Terms § 24.
Questions about privacy, security, or the terms?
One Roof Labs, LLC
Attn: Legal / Privacy / Compliance
655 S Sierra Madre Street, Colorado Springs, CO 80903
compliance@onerooflabs.com