Privacy Policy

Effective date: [EFFECTIVE DATE — FINALIZE BEFORE PRODUCTION]

This Privacy Policy explains how [LEGAL OPERATOR NAME — FINALIZE BEFORE PRODUCTION], operating as Oravien (“Oravien,” “we,” “us,” or “our”), collects, uses, discloses, stores, and otherwise processes personal information in connection with Oravien.

This Policy applies to our public website, the Oravien application, missed-call recovery services, messaging features, account and billing systems, and related services (collectively, the “Service”).

Oravien is primarily a business service used by roofing contractors. As a result, we may process information relating both to our business customers and to homeowners or other individuals who communicate with those businesses.

1. The Information We Process

The information Oravien processes depends on how you interact with the Service.

A. Account and User Information

When a contractor, business owner, or authorized user creates or uses an Oravien account, we may process information such as:

• name;
• email address;
• account identifiers;
• authentication information;
• account status;
• login and security information;
• support communications; and
• information associated with authorized users of the account.

Authentication credentials may be managed through our authentication provider rather than being stored directly by Oravien.

B. Business Information

We may collect information a business provides when configuring Oravien, including:

• business name;
• business phone number;
• service area;
• business contact information;
• booking preferences;
• booking links where applicable;
• estimate availability or timing preferences;
• service notes;
• notification phone number;
• phone setup information;
• recovery settings; and
• other information used to configure the Service.

C. Homeowner and Lead Information

When someone calls or communicates with an Oravien customer, we may process information associated with that interaction.

This may include:

• name;
• telephone number;
• call information;
• call timestamps and status;
• SMS messages and replies;
• job or project type;
• property location or service location;
• requested or preferred timing;
• information volunteered during the conversation;
• qualification status;
• whether the location is within the contractor’s service area;
• recovery stage;
• Ready for Estimate status;
• communication preferences;
• opt-out or suppression status; and
• related lead and conversation information.

Oravien is designed to collect information relevant to determining whether a missed-call opportunity should be handed back to the contractor. Customers should not use Oravien to intentionally collect unnecessary sensitive information.

D. Call and Messaging Metadata

When Oravien communicates through telephone or SMS providers, we may process technical and delivery information such as:

• originating and destination phone numbers;
• receiving business number;
• call or message identifiers;
• message direction;
• timestamps;
• delivery status;
• provider status codes;
• delivery or failure information;
• opt-out events; and
• records needed to prevent duplicate messages or enforce communication suppression.

SMS records are used by the Service to maintain conversation state, delivery history, and the Recovery Inbox.

E. Qualification and Recovery Information

The Service may derive structured information from homeowner communications.

This may include:

• job type;
• location;
• preferred timing;
• service-area status;
• qualification facts;
• recovery status;
• whether additional information is required; and
• whether an opportunity has reached Ready for Estimate.

Derived information may be generated through deterministic software rules, automated interpretation, or other processing used to operate the recovery system.

F. Billing Information

If a customer activates a paid Oravien subscription, we may process information such as:

• subscription status;
• plan;
• billing status;
• payment-provider customer identifiers;
• transaction records;
• invoices;
• cancellation status; and
• other information necessary to administer the subscription.

Payment-card information is processed by our payment provider. Oravien does not need to directly store full payment-card numbers.

G. Technical and Usage Information

When someone uses Oravien or visits our websites, we and our infrastructure providers may receive technical information such as:

• IP address;
• browser and device information;
• request and access logs;
• approximate technical location derived from network information;
• authentication events;
• application errors;
• security events;
• pages or features accessed; and
• diagnostic information.

We use this information primarily to operate, secure, troubleshoot, and improve the Service.

2. How We Collect Information

We may receive information:

• directly from Oravien customers and their authorized users;
• from homeowners or other individuals who call or message an Oravien customer;
• automatically through use of the websites and application;
• from telecommunications and infrastructure providers;
• from payment, authentication, geographic, and other service providers; and
• through automated processing of information already provided to the Service.

3. How We Use Information

We use personal information to operate and provide Oravien.

This includes using information to:

• create and administer accounts;
• authenticate users;
• configure business settings;
• process missed calls;
• initiate eligible recovery communications;
• receive and organize homeowner responses;
• determine what information has been provided;
• identify what information is still required;
• evaluate locations against contractor service areas;
• determine recovery and qualification status;
• identify opportunities that are Ready for Estimate;
• display conversations and lead details to the contractor;
• send contractor notifications;
• administer subscriptions and billing;
• respond to support requests;
• prevent duplicate communications;
• enforce opt-outs and communication suppression;
• detect fraud, misuse, or security threats;
• troubleshoot and maintain the Service;
• comply with legal obligations; and
• improve the reliability and functionality of Oravien.

We may also use aggregated or de-identified information to understand and improve the Service where that information no longer reasonably identifies an individual.

4. Missed-Call Recovery and SMS Communications

A core function of Oravien is helping a business respond after an eligible inbound call goes unanswered.

Depending on the customer’s configuration, Oravien may facilitate a recovery SMS to the caller and process subsequent replies.

The purpose of these communications is to continue the interaction initiated with the business, gather relevant details about the requested service, and determine whether the opportunity should be returned to the contractor.

Oravien customers are responsible for using the Service in accordance with applicable telecommunications, electronic-messaging, privacy, consumer-protection, and consent requirements.

[COUNSEL REVIEW REQUIRED BEFORE PRODUCTION: legal basis and disclosures for the initial automated recovery SMS following a missed inbound call, including Canadian and U.S. recipients.]

5. Opt-Outs and Communication Suppression

Individuals may request that SMS communications stop.

Oravien may detect and record recognized opt-out instructions and use that information to prevent additional homeowner-facing messages.

Suppression information may include:

• telephone number or a protected representation of the number;
• suppression status;
• date and time;
• source interaction;
• reason or event type; and
• technical records necessary to enforce the preference.

Suppression information may be retained longer than ordinary conversation information when reasonably necessary to ensure that an opt-out continues to be respected.

A communication preference or suppression record cannot be overridden merely because a lead later appears interested or reaches another recovery stage.

6. Automated Interpretation

Oravien uses automated software to interpret homeowner communications and convert replies into structured information used by the recovery system.

For example, automated interpretation may help identify information such as job type, location, timing, or the meaning of a homeowner response.

Current Oravien recovery interpretation is performed through deterministic software rules and structured processing. Oravien does not currently send homeowner conversations to an external AI or large-language-model provider as part of the production recovery workflow.

Automated interpretation is not intended to independently make contractual or financial decisions about a homeowner.

It does not, by itself, authorize the Service to:

• quote prices;
• promise work;
• enter into contracts;
• guarantee availability;
• confirm work that has not been booked;
• override communication suppression; or
• commit the contractor to a particular action.

If Oravien later introduces an external AI or model provider that processes production homeowner information, we will update this Policy as appropriate before or when that processing is introduced.

7. Service-Area and Location Processing

Oravien may process a homeowner’s city, municipality, address, postal code, or other location information when provided during the recovery conversation.

Where geographic normalization or service-area evaluation is enabled, location information may be sent to a geographic service provider to normalize the location and determine whether the opportunity is within the contractor’s configured service area.

Depending on how the homeowner responds, the information submitted for geographic processing may include a full street address, city, postal code, or the text provided in response to a location question.

Normalized location information may include formatted address information, city, region, country, postal code, coordinates, provider identifiers, and service-area match information.

Location information is used for lead qualification and service-territory evaluation, not for tracking the homeowner’s real-time physical location.

8. Who We Share Information With

Oravien may disclose personal information where necessary to operate the Service.

Oravien Customers

Lead and homeowner information may be made available to the roofing business that received the original call and its authorized users.

This is a core purpose of the Service.

Service Providers

We use service providers to operate portions of Oravien.

Current infrastructure and product architecture includes providers for:

Twilio

Telephone and SMS communications, delivery information, phone-number functionality, and messaging infrastructure.

Supabase

Application database, data storage, authorization-related infrastructure, and backend services.

Clerk

Account authentication and identity management.

Stripe

Subscription payments, billing, and billing-portal services.

Vercel

Application and website hosting, deployment, and related infrastructure.

Google geographic services, where enabled

Location normalization, geocoding, and service-area evaluation.

We may add, replace, or remove service providers as the Service evolves.

Service providers are permitted to process information for purposes associated with providing their services to Oravien, subject to applicable agreements, terms, and law.

Legal and Safety Disclosures

We may disclose information where we reasonably believe disclosure is required to:

• comply with applicable law;
• respond to valid legal process;
• protect the security of Oravien;
• investigate fraud or abuse;
• protect the rights or safety of users, recipients, or others; or
• establish, exercise, or defend legal claims.

Business Transactions

If Oravien or the business operating Oravien is involved in a merger, acquisition, financing, restructuring, asset sale, or similar transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law.

9. Selling Personal Information

Oravien does not operate as a data broker.

Oravien does not sell customer or homeowner personal information for money and does not sell homeowner recovery data for third-party advertising purposes.

10. Our Role When Processing Homeowner Information

When a roofing contractor uses Oravien, the contractor generally controls the underlying customer relationship and determines the business purpose for collecting homeowner information.

Depending on applicable law and the particular processing activity, the contractor may therefore be considered the organization, controller, business, or other responsible party for that information, while Oravien may act as its service provider or processor.

For other information, such as Oravien account information, billing records, security information, and Oravien’s own business operations, Oravien may determine the purposes of processing directly.

The exact legal terminology varies by jurisdiction.

11. Data Retention

Oravien does not currently publish fixed retention periods for each category of personal information.

Information may be retained for as long as reasonably necessary to provide and secure the Service, maintain business and audit records, enforce communication preferences, resolve disputes, and satisfy legal obligations.

Different categories of information may be retained for different periods.

Suppression and opt-out records may be retained longer where necessary to ensure that an individual’s request not to receive communications continues to be respected.

Certain records may also remain in backups, provider systems, billing systems, or operational records for periods determined by technical, contractual, or legal requirements.

[COUNSEL REVIEW: determine whether Oravien should adopt and publish fixed retention periods before production.]

12. Data Location and International Processing

Oravien uses service providers that may process information in jurisdictions outside the province, state, or country in which an individual is located.

Information processed in another jurisdiction may be subject to the laws and lawful access requirements of that jurisdiction.

[VERIFY BEFORE PRODUCTION: provider production regions, cross-border processing, and any customer-configurable regional commitments.]

13. Security

Oravien uses administrative, technical, and organizational measures intended to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• authenticated account access;
• access controls;
• tenant and ownership controls;
• database authorization policies;
• protected server-side operations;
• webhook authentication and signature verification;
• restricted administrative functionality;
• monitoring and logging; and
• security practices used by our infrastructure providers.

No system can guarantee absolute security.

Customers are responsible for protecting their credentials and promptly notifying Oravien if they suspect unauthorized access.

14. Data Incidents

If we become aware of a personal-information breach, security incident, or unauthorized disclosure, we will investigate and respond as appropriate.

Where applicable law requires notification to affected individuals, customers, regulators, or others, we will provide those notifications in accordance with the applicable requirements.

Because Oravien may process homeowner information on behalf of contractors, we may also notify and coordinate with the applicable Oravien customer regarding an incident involving that customer’s data.

15. Access, Correction, Deletion, and Other Privacy Rights

Depending on where you live and the applicable law, you may have rights relating to your personal information.

These may include rights to request:

• access to information held about you;
• correction of inaccurate information;
• deletion of certain information;
• information about how your data is used or disclosed;
• withdrawal of consent where processing depends on consent;
• restriction of certain processing; or
• other rights provided under applicable privacy law.

Not every right applies in every circumstance.

We may need to verify your identity before fulfilling a request.

Homeowner Requests

If you are a homeowner or caller whose information was processed through Oravien on behalf of a roofing company, the roofing company may be primarily responsible for responding to your privacy request.

You may contact that business directly.

You may also contact Oravien at the privacy address below. Where appropriate, we may coordinate the request with the applicable contractor.

Certain information may need to be retained despite a deletion request, including records needed to maintain an opt-out or suppression preference.

16. Communications From Oravien to Customers

We may send Oravien customers administrative and transactional communications relating to:

• their account;
• billing;
• subscription status;
• security;
• Service changes;
• support;
• legal notices; and
• operation of the Service.

Where marketing communications are sent, customers may have separate unsubscribe rights in accordance with applicable law.

Unsubscribing from marketing messages may not prevent essential account, security, billing, or transactional communications.

17. Cookies and Similar Technologies

The authenticated Oravien application may use cookies or similar technologies that are necessary for:

• authentication;
• account sessions;
• security;
• routing; and
• operation of the Service.

The public Oravien marketing website does not currently use non-essential advertising or behavioral-tracking technologies implemented by Oravien.

If Oravien later introduces non-essential analytics, advertising, or other tracking technologies, we will update our disclosures and implement applicable controls where required.

Oravien does not use homeowner recovery conversations for third-party behavioral advertising.

18. Children

Oravien is a business service and is not directed to children.

Business account holders must be at least 18 years old.

We do not knowingly create Oravien accounts for children.

A homeowner interaction could incidentally involve a minor, but customers should not intentionally use Oravien to solicit personal information from children.

If you believe information about a child has been collected improperly, contact us using the information below.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

• Oravien;
• our data practices;
• service providers;
• technology;
• legal requirements; or
• other operational practices.

When changes are material, we will provide notice where required or appropriate.

The “Effective date” at the top of this Policy indicates when the current version became effective.

20. Contact Us

Questions, privacy requests, or concerns about this Policy may be directed to:

Oravien

Operated by: [LEGAL OPERATOR NAME — FINALIZE BEFORE PRODUCTION]

Privacy email: [PRIVACY EMAIL — FINALIZE BEFORE PRODUCTION]

Mailing address: [BUSINESS / LEGAL ADDRESS — FINALIZE BEFORE PRODUCTION]

Country: Canada

If you contact us regarding homeowner information associated with a particular roofing company, please provide enough information for us to identify the relevant interaction without sending unnecessary sensitive information.