Privacy Policy — RootControl

This Privacy Policy describes how ShelfControl LLC ("RootControl", "we", "us", or "our") collects, uses, and shares information about you when you use the RootControl software-as-a-service platform at rootcontrol.io and related applications (the "Service"). RootControl is operated by ShelfControl LLC, a Columbus, Ohio limited liability company.

If you are an end customer of a RootControl user (for example, a homeowner whose lawn care company uses RootControl), please see the "Customer Data" section below. Most of the data about you in our Service is controlled by the RootControl user you do business with, not by us.

1. Information We Collect

Information you provide directly

Account information: name, email, phone number, company name, billing address.
Payment information: processed by Stripe; we do not store full payment card numbers.
Customer and operational data you upload: information about your customers, properties, jobs, invoices, employees, vehicles, and equipment.
Communications: support requests, feedback, and any content you send to us.

Information we collect automatically

Usage data: features used, pages viewed, time spent, error logs.
Device data: IP address, browser type, operating system, device identifiers.
Location data: when you or your crews use mobile features (GPS punch-in, fleet tracking) we collect device location from devices that have granted permission.
Cookies and similar technologies: see Section 6.

Information from third parties

Authentication providers (e.g. Google sign-in).
Integration partners you connect (QuickBooks Online, Stripe Financial Connections, etc.).

2. How We Use Your Information

To provide, operate, secure, and improve the Service.
To process payments and send invoices.
To communicate with you about your account, the Service, and product updates.
To respond to support requests.
To send marketing communications (with your consent, where required).
To detect, prevent, and address fraud, abuse, security, or technical issues.
To comply with legal obligations.
To power AI features (lead scoring, estimate generation, contract drafting, supplier-invoice parsing) by submitting relevant data to AI service providers under appropriate data-processing agreements.

3. Customer Data and the Controller-Processor Relationship

When a RootControl user uploads or generates information about their own customers, employees, vendors, or operations within the Service ("Customer Data"), the user is the "controller" of that data and we act as a "processor" on their behalf. We process Customer Data only as necessary to provide the Service, as instructed by the user, and in accordance with our Data Processing Addendum (available upon request).

Some Customer Data is made publicly accessible at the controlling user's election (for example, customer reviews and job photos that an office user explicitly approves for display on the user's tenant brand site, and marketing campaigns the user chooses to send). Whether a particular item is published is controlled by the RootControl user, not by us.

If you are an end customer interacting with a RootControl-powered Client Hub or receiving communications generated by a RootControl user, you should direct privacy questions to the RootControl user you do business with. We will assist them in responding to your requests where required by law.

4. How We Share Information

We do not sell your information. We share information only as follows:

Service providers and subprocessors

Stripe: payment processing and ACH bank verification.
Mailgun: transactional email delivery (account, security, and product notifications).
MailerSend: outbound email delivery for users on plans that support sending from their own verified domain.
Twilio: SMS delivery, where enabled.
Google Maps Platform: address autocomplete, geocoding, and map rendering.
QuickBooks Online (Intuit): only if you enable the integration; data flows are user-initiated.
Anthropic: AI inference (Claude models) accessed via a managed in-cluster gateway, limited to data necessary to power AI features, under data-processing terms that prohibit training on our data.
National Weather Service (NOAA): weather and storm data used by Snow Ops; queries are limited to operational geographies and do not include personal information.

Business transfers

If RootControl or ShelfControl LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred subject to standard confidentiality protections.

Legal compliance

We may disclose information if required by law, valid legal process, or to protect the rights, property, or safety of RootControl, our users, or others.

5. Data Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit and at rest, daily backups, access controls, and regular security review. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Cookies and Tracking

We use cookies and similar technologies for essential functionality (authentication, security), first-party product analytics (understanding aggregate usage of the Service), and preferences. Product analytics are collected and stored on our own systems; we do not currently use third-party advertising or cross-site tracking. You can control cookies through your browser settings; some Service features may not function without essential cookies. Account-level and per-user opt-outs for first-party product analytics are available in your account settings.

7. Data Retention

We retain account and Customer Data for as long as your account is active. Upon cancellation, Customer Data is retained for 30 days to allow for account recovery and export, then deleted from active systems. Backup copies may persist for up to 90 days. We may retain certain information longer where required by law (for example, financial records).

8. Your Rights

Depending on your jurisdiction, you may have rights to:

Access the personal information we hold about you.
Correct inaccurate information.
Request deletion (subject to legal retention obligations).
Receive a portable copy of your data.
Object to or restrict certain processing.
Withdraw consent where processing is based on consent.

To exercise these rights, email hello@rootcontrol.io. We will respond within 30 days.

9. International Data Transfers

RootControl is operated from the United States, and your information is processed in the United States. If you access the Service from outside the U.S., you consent to the transfer of your information to the U.S. for the purposes described in this Policy.

10. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice. The "Last updated" date at the top reflects the most recent revision.

12. Contact Us

ShelfControl LLC
Columbus, Ohio
Email: hello@rootcontrol.io
Phone: (614) 984-3997