---

How the National Roof Certification and Inspection Association uses cookies and similar technologies, the lawful basis for each category, and how to give, refuse, or withdraw your consent at any time.

This Cookie Policy forms part of, and should be read with, our Privacy Policy.

---

Scope

This Cookie Policy (“Policy”) applies to the digital properties operated by the National Roof Certification and Inspection Association (“NRCIA,” “the Association,” “we,” “us,” “our”), a national standards organization with its principal place of business at 1421 N Wanda Rd, Suite 120P, Orange, California 92867.

It covers:

• nrcia.org and its subdomains
• inspectionplus.net and the InspectionPLUS® platform
• The member portal and any authenticated member, inspector, or administrator area

Together, the “Sites.”

The Sites, the InspectionPLUS® platform, and the NRCIA marks are owned by Field Gate FLP and operated by NRCIA under license. Where this Policy says “we,” it means NRCIA acting under that license, and it includes Field Gate FLP as the owner of the technology described.

This Policy does not apply to any third-party website, platform, or service linked from the Sites, including member business websites. Those properties are controlled by others and governed by their own policies.

Capitalized terms not defined here carry the meaning given in our Privacy Policy, which is the authoritative statement of how we collect, use, disclose, and protect personal information. Where this Policy and the Privacy Policy address the same subject, the Privacy Policy governs.

---

What cookies and similar technologies are

A cookie is a small text file a website asks your browser to store on your device. On a later visit the site reads that file and recognizes the browser. That is how a site remembers a preference, keeps you signed in, or measures how it is being used.

Throughout this Policy, “cookies” is shorthand for cookies and for the related technologies that do comparable work:

• Pixels and tracking tags, small pieces of code that report an event back to a provider
• Software development kits embedded in mobile applications
• Local storage and session storage, browser storage that behaves like a cookie but is not one
• Session recording and heatmap scripts, which reconstruct how a page was used
• Device and browser identifiers stored on or read from your device

Cookies are first-party when set by the domain you are visiting and third-party when set by another domain, such as a provider we engage. They are session cookies when they expire as soon as you close your browser and persistent cookies when they remain for a defined period or until deleted. All of these are covered here.

---

Our lawful basis

We place cookies that are strictly necessary to deliver a service you requested without asking for consent, as applicable law permits, including Article 5(3) of the ePrivacy Directive as implemented in the European Economic Area and the United Kingdom and comparable provisions elsewhere. These cannot be switched off through our preference center because the Sites cannot be provided without them.

For every other cookie, we rely on your prior, freely given, specific, informed, and unambiguous consent.

We do not set non-essential cookies before you give that consent. We do not treat scrolling, continued browsing, or the absence of an objection as consent. We do not use pre-ticked boxes. We do not use interface design intended to steer your choice, and the button that refuses is as prominent, as legible, and as easy to reach as the button that accepts.

Where cookie data constitutes personal data or personal information, our processing of it is additionally governed by the lawful bases described in the Privacy Policy.

---

How we obtain, record, and honor your consent

On your first visit, and again whenever the categories described here materially change, we present a consent notice before any non-essential cookie is set. From that notice you can:

• Accept all categories
• Reject all non-essential categories
• Open the preference center and decide category by category

Your decision is recorded in a first-party cookie stored on your own device, together with the version of the category schema you were shown and the date and time of your choice. We retain that record so we can honor your decision on later visits and, where required, demonstrate that consent was obtained. Because the record lives on your device rather than tied to an account, clearing your browser storage clears it, and we will ask again.

You may change or withdraw your decision at any time using Manage cookie preferences on this page and in the site footer. Withdrawal is as straightforward as the original grant and takes effect immediately. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew.

---

Categories we use

The categories we operate, their purposes, the providers behind them, and the specific cookies you may encounter are set out in the table at the end of this Policy. That table is generated from the same configuration that drives our preference center, so what you read and what you control always correspond.

We disclose only technologies actually deployed on the Sites. Where we introduce a new cookie or provider, this Policy and the preference center are updated together, and we obtain fresh consent where the change is material or affects a category you previously refused.

Some cookies serve more than one purpose. Where a cookie could reasonably fall into more than one category, we classify it in the more protective category, so refusing that category prevents the cookie from being set at all.

---

Session recording, and the limits we put on it

We use Hotjar to record sessions and build heatmaps, so we can see where a page confuses people and fix it. Session recording is intrusive when it is done carelessly, so here is exactly what we do and do not capture.

Hotjar loads only if you consent to the Analytics category. If you refuse, no script loads and no recording exists.

When it does load:

• Keystrokes in form fields are not recorded. Text you type into an input is masked in your browser before anything is transmitted.
• Payment fields, password fields, and every field we designate sensitive are blocked entirely, not masked. Nothing from them leaves your device.
• Recordings capture the shape of a session: page views, cursor movement, scrolls, clicks, rage clicks, errors, and the time between them.
• IP addresses are truncated before storage. We do not use Hotjar to identify an individual visitor.
• Recordings and heatmap data are retained for 365 days or less and then deleted automatically.
• Hotjar processes this information as our service provider, on our documented instructions, under a written contract that forbids using it for any purpose of its own.

You can also opt out of Hotjar independently of our banner at hotjar.com/policies/do-not-track.

---

Third-party providers

Some cookies are set by providers we engage to operate and improve the Sites. Where a provider processes personal information solely on our documented instructions and for no purpose of its own, it acts as our processor or service provider, and we impose contractual obligations consistent with applicable data protection law.

Where a provider determines its own purposes for the information it collects, it acts as an independent or joint controller for that processing, and its own notice governs. We do not control, and are not responsible for, cookies set by such a party beyond the gating we apply on the Sites.

One provider is different, and we would rather say so here than bury it in a table. The Meta Pixel reports your visit to Meta Platforms, Inc., and Meta uses that information for its own advertising purposes as well as for ours. For that processing Meta acts as an independent controller and its own notice governs what it does with the data. Every other provider named on this page is contractually barred from using information collected through cookies on the Sites to build profiles for its own advertising.

We do not sell personal information collected through cookies. We do share it, in the specific sense California law gives that word, through the Meta Pixel. See the Do Not Sell or Share My Personal Information page for what that means and how to opt out.

---

Effect of refusing or withdrawing consent

If you refuse a category, the technologies in it are not loaded and the associated cookies are not set. If you withdraw a category you previously permitted, we stop loading those technologies and delete the corresponding cookies we are technically able to remove from your device. Cookies set on a third-party domain that we cannot access must be removed through your browser or that provider’s own controls, and section 09 explains how.

Refusing non-essential categories will not prevent you from using the Sites, finding an accredited member, requesting an inspection, or contacting us. We will not degrade any service, charge a different price, or treat you less favorably because you exercised a privacy choice.

Strictly necessary cookies cannot be disabled through our preference center. If you block them at the browser level, parts of the Sites, including secure areas of the member portal, InspectionPLUS® authentication, and the recording of your cookie choice, may fail to function. We provide the Sites on the basis that such cookies are permitted, and we are not liable for loss of functionality resulting from suppressing them.

---

Managing cookies through your browser or device

Independently of our preference center, most browsers let you view the cookies stored on your device, delete them individually or in bulk, block cookies from particular sites, and block third-party cookies generally. These controls are provided by your browser vendor, not by us. Their operation and effectiveness are outside our control and we make no representation about how they behave.

Browser-level controls apply per browser and per device. A choice recorded in one browser does not carry to another browser, another device, or a private browsing session.

Direct opt-outs for the providers we use:

• Google Analytics: tools.google.com/dlpage/gaoptout
• Google ad settings: myadcenter.google.com
• Hotjar: hotjar.com/policies/do-not-track
• HubSpot: clear the hubspotutk cookie through your browser, or use our preference center

Global Privacy Control. Where the Sites detect a Global Privacy Control signal or a comparable opt-out preference signal transmitted by your browser or extension, we treat it as a valid request to opt out of the sale or sharing of personal information to the extent applicable law requires, including the California Consumer Privacy Act as amended by the California Privacy Rights Act. We apply the signal automatically and we do not ask you to prove anything. We do not respond to legacy “Do Not Track” headers, for which no common industry standard was ever adopted.

---

Retention

Session cookies persist only for the duration of your browsing session. Persistent cookies remain for the period stated in the table below or by the provider, unless you delete them sooner.

• Our record of your cookie choice is retained for 180 days, after which we ask you to confirm your preferences again. We may ask sooner where the categories described here materially change.
• Hotjar session recordings and heatmap data: 365 days or less.
• Google Analytics event and user data: 14 months.

We do not retain cookie identifiers longer than necessary for the purpose for which they were collected, or for such longer period as is required to establish, exercise, or defend legal claims or to comply with a legal obligation.

---

Cookies and your privacy rights

Information collected through cookies may constitute personal data or personal information under the laws that apply to you. Where it does, it is handled in accordance with our Privacy Policy, including the rights described there.

Depending on your jurisdiction, those rights may include the right to access the personal information we hold about you, to correct inaccurate information, to request deletion, to obtain a portable copy, to object to or restrict certain processing, and to withdraw consent previously given.

Residents of California may additionally have the right to know the categories of personal information collected and disclosed, the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising, and the right not to be retaliated against for exercising these rights. See Do Not Sell or Share My Personal Information.

Refusing or withdrawing consent to non-essential cookies through our preference center is one way to exercise a choice of this kind on the Sites.

If you are in the European Economic Area or the United Kingdom and consider that our use of cookies does not comply with applicable law, you have the right to lodge a complaint with your national supervisory authority. We would appreciate the chance to address your concern directly first.

---

International transfers

We are established in the United States, and information collected through cookies is processed in the United States and, where a provider operates internationally, in other jurisdictions. Where such a transfer involves personal data originating in the European Economic Area or the United Kingdom, we implement an appropriate transfer mechanism as applicable law requires, which may include Standard Contractual Clauses together with supplementary measures where necessary. Further detail is in the Privacy Policy.

---

Children

The Sites are directed to businesses, professionals, and adult property owners. They are not directed to children. We do not knowingly use cookies to collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of any consumer under 16. If you believe a child has provided information to us through the Sites, contact us using the details in section 15 and we will delete it.

---

Changes to this Policy

We may amend this Policy to reflect changes in the technologies we use, in our operations, or in applicable law. The effective date and the date of last revision appear at the top of this page, and the version identifier is maintained in our records.

Where an amendment materially alters the categories of cookies we use or the purposes for which they are used, we present the consent notice again rather than rely on a choice you made against an earlier version. Continued use of the Sites following a non-material amendment constitutes acknowledgement of the amended Policy.

---

How to contact us

Requests to exercise a privacy right are acknowledged within 10 business days and answered within 45 days.

---

Categories we use

Cookie categories, what each is for, and the cookies each sets.

Strictly necessary, always active

Required for the Sites to work, to keep authenticated sessions secure, and to remember your cookie choice. These cannot be switched off.

Cookie	Provider	Purpose	Type	Duration
nrcia_cookie_consent	NRCIA, first party	Stores your category choices and the schema version you were shown	Persistent	180 days
nrcia_session	NRCIA, first party	Maintains your session across pages	Session	Browser session
ip_plus_auth	InspectionPLUS®, first party	Authenticates a signed-in member or administrator	Persistent	30 days, or until sign-out
csrf_token	NRCIA, first party	Protects forms against cross-site request forgery	Session	Browser session
Load balancing and security cookies	Hosting and security vendors	Route traffic, block abuse and bot traffic	Session or persistent	Up to 12 months

Analytics, consent required

Help us understand how visitors move through the Sites so we can improve them. Reported in aggregate.

Cookie	Provider	Purpose	Type	Duration
_ga	Google Analytics 4	Distinguishes browsers for aggregate analytics	Persistent	13 months
_ga_<container-id>	Google Analytics 4	Maintains analytics session state	Persistent	13 months
_hjSessionUser_<site-id>	Hotjar	Recognizes a returning browser for session sampling	Persistent	365 days
_hjSession_<site-id>	Hotjar	Maintains the current recording session	Session	30 minutes
_hjFirstSeen, _hjIncludedInSessionSample	Hotjar	Sampling and first-visit flags	Session or persistent	Session to 365 days

Google Tag Manager loads and gates these tags and enforces your consent choice. The container itself sets no analytics cookie and stores no personal information of its own.

Marketing and attribution, consent required

Measure how our campaigns perform and connect a form submission to the visit it came from.

Cookie	Provider	Purpose	Type	Duration
hubspotutk	HubSpot	Links a form submission to the visitor record	Persistent	6 months
__hstc	HubSpot	Visit and source attribution	Persistent	6 months
__hssc	HubSpot	Tracks the current session for attribution	Persistent	30 minutes
__hssrc	HubSpot	Detects whether the visitor restarted the browser	Session	Browser session
_fbp	Meta	Identifies your browser to the Meta Pixel so a visit can be attributed to an advert and audiences can be built	Persistent	3 months
_fbc	Meta	Stores the click identifier from the Meta advert you arrived through	Persistent	3 months
fr	Meta	Set on facebook.com rather than by us. Meta uses it to deliver and measure advertising	Persistent	3 months

The Meta Pixel. We run Meta’s advertising pixel on the public website. It loads on every page and reports the visit to Meta Platforms, Inc., which lets us measure what our advertising does and show adverts on Facebook and Instagram to people who have been here. California law calls that sharing for cross-context behavioral advertising. It is not a sale, and no money changes hands, but it is sharing and we name it as such.

Advanced Matching. The pixel also has Meta’s Advanced Matching feature switched on. When you submit a form on our site, the pixel takes the values you entered in the fields below, hashes them in your browser, and sends the hashed values to Meta so it can match you to a Meta account. It sends only the fields a given form actually asks for.

• Email address
• Telephone number
• First and last name
• Gender
• City, state, and ZIP or postal code
• Country
• Date of birth
• An external identifier we assign to you

Hashing is not the same as anonymising. A hashed email address still identifies you to anyone holding the same address, which is the entire point of the feature, so we treat it as personal information and so should you.

The Meta Pixel is off until you allow it. Like every other non-essential cookie on this site, it sits behind the consent banner. Refuse the Marketing category and the pixel is never requested at all, rather than requested and asked to behave. Change your mind at any time through Manage cookie preferences in the footer of any page, or at nrcia.com/cookie-preferences, and withdrawal takes effect immediately.

Functional, consent required

Remember choices you make so you do not have to make them twice.

Cookie	Provider	Purpose	Type	Duration
nrcia_prefs	NRCIA, first party	Stores display and notification preferences	Persistent	12 months
Form pre-fill tokens	HubSpot	Pre-fills fields you already gave us	Persistent	6 months

---

Manage cookie preferences

Checking your current preference…

---

NRCIA marks, programs, and platform technology are owned by Field Gate FLP and used under license. LeakFREE®, Forensic ROOF®, InspectionPLUS®, and Mr. RoofCheck® are registered trademarks of Field Gate FLP. RoofGUARD™, ForensicGUARD™, DisasterGUARD™, E3GUARD™, and Think Like a Raindrop™ are trademarks of Field Gate FLP.