For California residents

---

This page is for California residents. It describes rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. If you live elsewhere, the Privacy Policy describes the rights available to you, and we honor any right your state’s law gives you whether or not it appears there.

---

We do not sell your personal information

The National Roof Certification and Inspection Association does not sell personal information. We never have. We do not intend to. There is no revenue line in this organization that depends on your data, and we are not building one.

That statement covers site visitors, property owners, real estate professionals, attorneys, insurers, lenders, members, member employees, and job applicants alike.

California law also defines “sharing” more broadly than most people expect. It reaches the disclosure of personal information to a third party for cross-context behavioral advertising, even when no money changes hands. Ad measurement and remarketing technologies can meet that definition.

We do share, and this is exactly what that means.

• We run the Meta Pixel on our public website. It reports your visit to Meta Platforms, Inc. so that we can measure our advertising and show adverts on Facebook and Instagram to people who have been here. That is sharing for cross-context behavioral advertising under California law, and we are naming it rather than filing it under analytics.
• The pixel has Meta’s Advanced Matching feature switched on. When you submit a form on our site it also sends Meta a hashed copy of the details that form collected. The field list is in the Cookie Policy and in section 04 of the Privacy Policy.
• We do not enable Google Analytics advertising features, remarketing audiences, or Google Signals.
• Apart from the Meta Pixel, the technologies listed in section 02 are configured as service-provider processing for our own purposes and not for cross-context behavioral advertising.

Sharing is still not selling. We receive no money, no credit, and no other value for it. It remains true that there is no revenue line in this organization that depends on your data.

The pixel loads only if you allow it. It sits in the Marketing category behind our consent banner, so refusing means it is never requested. If your browser sends a Global Privacy Control signal we record the opt-out on arrival and never ask you at all. Every opt-out route in section 03 applies to it in full. Property owner information inside InspectionPLUS® is not sent to Meta under any setting.

Property owner information inside InspectionPLUS® is never sold or shared, full stop. For that information the member inspector is the business and we act as the service provider. See section 02 of the Privacy Policy.

---

What we disclose, to whom, and whether it counts as selling or sharing

Third party	What it does for us	What it receives	Sale?	Sharing for cross-context behavioral advertising?
Google Analytics 4	Aggregate site and platform analytics	Truncated IP address, device and browser data, page and event data, a first-party analytics identifier	No	No. Advertising features, Google Signals, and remarketing audiences are disabled
Meta Platforms, Inc.	Advertising measurement, audience building, and remarketing on Facebook and Instagram	Page and event data, the _fbp and _fbc identifiers, IP address, and, through Advanced Matching, hashed email, telephone, name, gender, city, state, ZIP, country, date of birth, and an identifier we assign	No	Yes. Meta acts as an independent controller for its own advertising purposes
Google Tag Manager	Loads and gates our tags, enforces your consent choice	Page context needed to fire or suppress a tag	No	No
Hotjar	Session recording, heatmaps, on-site surveys	Masked interaction and page data, device data, truncated IP address. Keystrokes not recorded. Payment and password fields blocked	No	No
HubSpot	CRM, form capture, lifecycle and marketing email, attribution	Name, email, telephone, company, form content, email engagement, page attribution	No	No. Used for our own marketing to you, not for a third party’s advertising
Payment processor	Dues, program fees, event fees	Billing details and transaction data under PCI DSS. We never receive your full card number or security code	No	No
Hosting, email delivery, backup, security vendors	Run and protect the Services	Whatever the function requires, and no more	No	No
Credential and insurance verification sources	Verify member licensure and coverage	Member name, license number, business identifiers	No	No
NRCIA members	Fulfill an inspection request you submitted	Your name and contact details, because you asked to be contacted	No	No

Every provider above except Meta is bound by a written contract that prohibits retaining, using, or disclosing the information for any purpose other than performing the service for us, and that prohibits combining it with information from other sources except as the law permits. Meta is not a service provider to us. It receives the pixel data as an independent controller under its own terms, and it does combine that data with what it already holds. That is the difference between the Meta row and every other row in the table.

We do not disclose personal information to any third party for that third party’s own direct marketing purposes.

Mobile numbers and SMS opt-in consent are never shared with any third party or affiliate for marketing purposes, under any circumstance.

---

How to opt out anyway

We do not sell. We do share, through the Meta Pixel described in section 01. Tell us to treat you as opted out and we will record it and honor it without argument or verification burden. Use whichever route you prefer.

Route 1: Global Privacy Control, the fastest one

We honor the Global Privacy Control and comparable opt-out preference signals automatically. Turn it on in a browser or extension that supports it, including Firefox, Brave, DuckDuckGo, and the Privacy Badger extension, and our sites treat it as a valid opt-out request the moment you arrive. We do not ask you to prove anything, we do not ask you to create an account, and we do not ask you to confirm twice.

We do not respond to legacy “Do Not Track” headers, for which no common industry standard was ever adopted.

Route 2: our cookie preference center

Open Manage cookie preferences in the footer of any page, or go straight to nrcia.com/cookie-preferences. Refuse the Analytics and Marketing categories, or refuse everything non-essential in one click. Refusing is as prominent and as easy as accepting. Withdrawal takes effect immediately.

Route 3: tell us directly

• Email: legal@nrcia.org, subject line “Do Not Sell or Share My Personal Information.” Include your name and the email address associated with you.
• Phone: (888) 687-7663
• Mail: National Roof Certification and Inspection Association, Attn: Privacy Request, 1421 N Wanda Rd, Suite 120P, Orange, CA 92867

We process opt-out requests within 15 business days and confirm in writing.

Route 4: at the provider

• Google Analytics opt-out add-on: tools.google.com/dlpage/gaoptout
• Google ad settings: myadcenter.google.com
• Hotjar: hotjar.com/policies/do-not-track
• Meta ad preferences: accountscenter.facebook.com/ad_preferences, where you can turn off activity received from businesses like us
• Meta off-Facebook activity: accountscenter.facebook.com/info_and_permissions

Note: browser and device controls apply per browser and per device. A choice made in one browser does not carry to another browser, another device, or a private browsing session. Blocking strictly necessary cookies may prevent form submission, member portal sign-in, and InspectionPLUS® authentication from working.

---

Your full California privacy rights

Right to know

Request disclosure of the categories and the specific pieces of personal information we have collected about you, the sources it came from, the business or commercial purpose for collecting it, the categories of third parties it was disclosed to, and the categories disclosed for a business purpose.

The Privacy Policy, section 12 contains the full category-by-category disclosure for the preceding 12 months, so you can read most of the answer before you ask.

Right to delete

Request deletion of personal information we collected from you. We delete it and direct our service providers to do the same, subject to the exceptions California law allows, which include completing a transaction you requested, detecting security incidents, complying with a legal obligation, and exercising or defending legal claims.

The exception that matters here: we retain certification records and the inspection evidence supporting them for the life of a certification plus 10 years, because a LeakFREE® certificate is relied on by buyers, lenders, and insurers, and destroying the evidence behind a live certificate would defeat the certificate and harm the person holding it. If you ask us to delete a live certification record, we will tell you plainly that we cannot and why, rather than quietly declining.

Full retention schedule: Privacy Policy, section 09.

Right to correct

Request correction of inaccurate personal information we maintain about you. Tell us what is wrong and what it should say, and we will correct it or explain why we cannot.

Right to opt out of sale or sharing

Covered in section 03. We do not sell. We do share for cross-context behavioral advertising through the Meta Pixel, so this right applies to you in the ordinary way, and we will record and honor your opt-out.

Right to limit the use of sensitive personal information

The only sensitive personal information we collect is account login credentials, and we use it for one purpose: authenticating you. We do not use it to infer characteristics about you, we do not use it for advertising, and we do not disclose it for any purpose that would trigger a right to limit. We do not collect Social Security numbers, driver’s license or government identification numbers, precise geolocation, racial or ethnic origin, religious or philosophical belief, union membership, the contents of your private communications, genetic data, biometric data, health information, or information about your sex life or sexual orientation.

Right to non-discrimination and no retaliation

We will not deny you service, charge you a different price, provide you a lower quality of service, or treat your membership, accreditation, credential standing, or directory placement any differently because you exercised a privacy right. We operate no financial incentive program tied to your personal information, so there is nothing to compare against and nothing to lose.

Right to know about automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you. Accreditation decisions, certification decisions, and disciplinary decisions are made by people, on published standards, with the process set out in the Member Agreement Policy.

---

Authorized agents

You may designate an authorized agent to submit a request on your behalf. The agent must provide:

• Written authorization signed by you, or a valid power of attorney under California Probate Code sections 4000 through 4465.
• Proof of the agent’s own identity.

We may also contact you directly to confirm that you authorized the request and to verify your identity, unless a power of attorney applies.

An opt-out request submitted by an agent, including a Global Privacy Control signal, does not require verification of your identity. We honor it.

---

How we verify you

Verification protects your information from someone pretending to be you. What we ask for depends on the request and the sensitivity of the information involved.

• Opt-out requests: no verification. We honor them as submitted.
• Right to know, delete, or correct: we match the information you give us against information already in our records, usually your name and the email address on file.
• Requests involving sensitive information, or deletion of a member or account record: we require a confirming reply from an email address already on file, and we may ask one additional question drawn from your existing record.

We will never ask you for a Social Security number, a payment card number, a bank account number, or an account password to verify a privacy request. If anyone claiming to be NRCIA asks you for one, it is not us. Report it to legal@nrcia.org.

If we cannot verify you to the standard the law requires, we tell you why and, where possible, tell you what would let us proceed.

---

Timing, frequency, and appeals

• We acknowledge a request within 10 business days.
• We respond substantively within 45 calendar days. Where a request is complex we may extend once by a further 45 days, and we tell you before the first period expires.
• Opt-out requests are processed within 15 business days.
• Requests to know are free and available twice in any 12-month period, consistent with California law. Opt-out and deletion requests are not subject to that limit.
• There is no charge, unless a request is manifestly unfounded or excessive, in which case we tell you before doing any work and you can withdraw it.

Appeals. If we decline a request in whole or in part, our response states why and how to appeal. Send an appeal to legal@nrcia.org with “Privacy Appeal” in the subject line. We respond within 45 days.

If you are not satisfied, you may contact the California Privacy Protection Agency at cppa.ca.gov or the California Attorney General at oag.ca.gov/privacy. We would rather you gave us the chance to fix it first.

---

Shine the Light, California Civil Code section 1798.83

California Civil Code section 1798.83 gives California residents the right to request, once per year, information about personal information disclosed to third parties for those third parties’ direct marketing purposes.

We do not disclose personal information to third parties for their direct marketing purposes. There is nothing to report, and there will not be. Requests or questions: legal@nrcia.org, subject line “Shine the Light.”

---

Notice of financial incentive

We do not offer financial incentives, price differences, or service-level differences in exchange for personal information. No loyalty program, no data-for-discount trade, nothing. This section exists so you know the answer without having to wonder.

---

Minors

We do not knowingly collect personal information from anyone under 16. We do not sell or share the personal information of any consumer, of any age, because we do not sell or share personal information at all. If you believe a minor has provided information to us, write to legal@nrcia.org and we will delete it.

---

Contact

This page is linked from the Privacy Policy and from the footer of every page on our sites, as California law requires. For the full picture of what we collect and why, read the Privacy Policy. For the technology detail, read the Cookie Policy.

Privacy requests are acknowledged within 10 business days and answered within 45 days.

---

NRCIA marks, programs, and platform technology are owned by Field Gate FLP and used under license. LeakFREE®, Forensic ROOF®, InspectionPLUS®, and Mr. RoofCheck® are registered trademarks of Field Gate FLP. RoofGUARD™, ForensicGUARD™, DisasterGUARD™, E3GUARD™, and Think Like a Raindrop™ are trademarks of Field Gate FLP.

© 2026 Field Gate FLP. All rights reserved.