---

This Privacy Policy explains what personal information the National Roof Certification and Inspection Association collects, why we collect it, who we give it to, how long we keep it, and what you can tell us to do with it. We do not sell personal information. We do not trade it. We delete it when it has served the purpose it was collected for, and we delete it sooner if you ask us to.

---

Who we are

The National Roof Certification and Inspection Association (“NRCIA,” “the Association,” “we,” “us,” “our”) is a national standards organization. We establish and set the standard for roof inspection and certification, we train and credential member inspectors, and we administer the LeakFREE® certification. We do not perform inspections, write inspection reports, repair roofs, or certify properties ourselves. Members do that work as independent professionals.

Ownership and license. All NRCIA marks, programs, and platform technology, including LeakFREE®, Forensic ROOF®, InspectionPLUS®, Mr. RoofCheck®, RoofGUARD™, ForensicGUARD™, DisasterGUARD™, and E3GUARD™, are owned by Field Gate FLP and licensed to NRCIA. Field Gate FLP is the owner of the underlying intellectual property and of the InspectionPLUS® platform. NRCIA is the licensed operator that runs the standard, the programs, and the member relationship. Where this Policy says “we,” it means NRCIA acting under that license, and it includes Field Gate FLP where Field Gate FLP holds or processes the information described.

Where this Policy applies. This Policy governs:

• nrcia.org and its subdomains, including all public marketing pages and forms.
• inspectionplus.net and the InspectionPLUS® platform, including web and mobile access.
• The member portal and any authenticated member, inspector, or administrator area.
• Email, SMS, telephone, and in-person communications with the Association.
• Events, training, webinars, and continuing education we run or host.

Together these are the “Services.”

---

The two roles we play, and why it matters to you

Read this section before the rest. It determines which rights you have and who you exercise them against.

When NRCIA is the business making the decisions

For visitors to our websites, prospective members, members, member employees, event attendees, vendors, and job applicants, NRCIA decides what personal information is collected and why. In privacy law terms we are the business under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the controller under other state privacy laws and, where it applies, the General Data Protection Regulation. Sections 03 through 14 of this Policy describe that relationship. Your rights run against us.

When NRCIA is only holding a member’s records

When a member inspector performs an inspection at a property, that member collects information about the property and the property owner or occupant, and uploads it into InspectionPLUS®. Inspection reports, photographs, addresses, contact details, scheduling records, and certification records belong to that engagement between the member and their client.

For that information, the member is the business or controller. NRCIA and Field Gate FLP are the service provider and processor. We hold and process the records on the member’s documented instructions so the member can run their practice, so the standard can be verified, and so certifications can be issued and honored. We do not use property owner information for our own marketing. We do not sell it. We do not combine it with information from other members to build profiles for advertising.

If you are a property owner or occupant and you want a copy of an inspection record, a correction to it, or its deletion, contact the member inspector or the inspection company that performed the work. They control that record. If you do not know who that was, or if they will not respond, write to legal@nrcia.org and we will identify the member and route your request. Where a member instructs us to delete or export their records, or where the law requires us to act directly, we will.

Certification records are a limited exception. A LeakFREE® certification is a written statement issued to the marketplace and relied on by buyers, sellers, lenders, and insurers. We retain the certification record and the inspection evidence that supports it for the life of the certification plus the period described in section 09, because deleting the evidence behind a live certification would defeat the purpose of the certificate and would remove the record a relying party may need. Deleting a certification record on request is not something we can do while the certificate remains in effect, and we will say so plainly rather than quietly refusing.

---

Information we collect

Information you give us

What	Where it comes from	Why we have it
Name, email address, telephone number, company name, job title, mailing address	Contact forms, inspector search, quote and inspection requests, event registration, membership enrollment	To answer you, to route you to a member, to enroll and service you
Membership and accreditation records: license numbers, insurance certificates, training and continuing education records, examination results, credential status	Enrollment and program administration	To verify eligibility, to accredit, to maintain the standard
Payment information: billing name, billing address, last four digits and expiration of a payment card, transaction history	Dues, program fees, event fees	To bill you, to keep tax and financial records
Account credentials: email address and a hashed password, multi-factor settings	Member portal and InspectionPLUS®	To authenticate you and secure the account
SMS and mobile consent records: mobile number, the date and text of your opt-in, opt-out records	Enrollment forms, keyword opt-ins	To send the messages you asked for and to prove you asked
Content you send us: messages, complaints, dispute submissions, survey answers, testimonials, photographs and files you upload	Email, forms, portal, support	To handle the matter you raised
Job applications: resume, work history, portfolio, references	Careers submissions	To evaluate you for a role

We do not ask for and do not want Social Security numbers, driver’s license numbers, government identification numbers, precise geolocation of individuals, biometric data, health information, union membership, religious belief, or political affiliation. If you send one of these to us unsolicited, we delete it rather than file it, unless a law requires us to keep it.

Information collected automatically

• Device and browser data: browser type and version, operating system, device type, screen size, language.
• Usage data: pages viewed, time on page, referring and exit URLs, clicks, scroll depth, form interactions, search terms used inside our own site.
• Approximate location: derived from IP address at the city or region level. We do not collect precise GPS location from website visitors.
• IP address: collected for security, fraud prevention, abuse investigation, and analytics.
• Session activity recordings and heatmaps: through Hotjar, described in section 05, and set only after you consent.
• Advertising measurement: the Meta Pixel records that you visited a page and, where a form you submit contains them, sends Meta a hashed copy of your email address, telephone number, name, gender, city, state, ZIP or postal code, country, date of birth, and an identifier we assign you. The full account is in the Cookie Policy.
• Cookies and similar technologies: described in full in our Cookie Policy.

Information from other sources

• Members and member companies submit information about their employees and authorized users to set up accounts.
• Service providers listed in section 05 return analytics, form attribution, and delivery data to us.
• Public and licensed sources, including state contractor licensing databases and insurance carriers, are used to verify credentials, licensure, and coverage that members represent to us.
• Referrals, where a member, partner, or client passes along your contact details in connection with an inspection or a request you made.

---

How we use information

We use personal information to:

1. Run the standard. Accredit members, verify credentials and insurance, administer RoofGUARD™, ForensicGUARD™, DisasterGUARD™, and E3GUARD™, issue and maintain LeakFREE® certifications, conduct audits and quality review, and administer discipline under the Member Agreement Policy.
2. Operate InspectionPLUS®. Provide reporting, estimating, scheduling, certification issuance, and record storage to members.
3. Answer you. Respond to inquiries, connect a property owner or agent with an accredited member, and support members and their clients.
4. Bill and collect. Process dues, program and event fees, issue receipts and invoices, maintain the records tax and financial law requires.
5. Communicate. Send transactional and service messages, renewal and price change notices required by law, credential and program updates, and, where you have opted in, marketing email and SMS.
6. Improve. Understand which pages and flows work, find and fix errors, test improvements, and measure whether our campaigns reach the right people.
7. Secure. Detect and prevent fraud, credential misuse, mark misuse, account takeover, scraping, and abuse of the Services.
8. Comply and defend. Meet legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims, including claims that involve a certification.

We do not use personal information to train AI systems on identifiable data. AI is a drafting and organizing tool inside our operation. It never issues a certification, never determines an inspection finding, and never replaces the credentialed professional whose judgment the standard depends on. Where we use AI-assisted tooling on member or property owner content, it operates on the member’s own records for that member’s benefit, and the output is reviewed by a person before it goes anywhere.

Legal bases, where GDPR or a similar law applies: performance of a contract, our legitimate interests in operating and securing the Association and its standard, compliance with a legal obligation, and your consent for non-essential cookies, marketing email, and SMS. Where we rely on consent you may withdraw it at any time, and withdrawal does not affect processing carried out before you withdrew.

---

Who we share information with, and who we do not

We do not sell personal information. We have not sold personal information. We do share personal information for cross-context behavioral advertising, in the sense California law gives that word, through the Meta Pixel on our public website. No money changes hands. What the pixel collects, what Advanced Matching adds to it, and how to stop it are set out in the Cookie Policy and on the Do Not Sell or Share My Personal Information page.

Service providers

Each provider below processes information on our documented instructions, for our purposes only, under a written contract that prohibits retaining, using, or disclosing the information for any other purpose. Non-essential providers load only after you consent through the cookie banner.

Provider	What it does for us	What it receives	Consent required
Google Analytics 4	Aggregate site and platform analytics	Truncated IP address, device and browser data, page and event data, a first-party analytics identifier	Yes
Google Tag Manager	Loads and gates the tags above and below, and enforces your consent choice	Page context needed to fire or suppress a tag	No, container only; the tags it gates require consent
Hotjar	Session recording, heatmaps, on-site surveys and feedback	Masked interaction and page data, device data, truncated IP address	Yes
HubSpot	CRM, form capture, marketing and lifecycle email, attribution	Name, email, telephone, company, form content, email engagement, page attribution	Yes for the tracking cookie; the record you submit is processed under contract
Payment processor	Dues, program fees, event fees	Billing details and transaction data, handled under PCI DSS. We never receive or store your full card number or security code	No, strictly necessary to a purchase you initiated
Hosting, email delivery, backup, and security vendors	Run and protect the Services	Whatever the specific function requires, and no more	No, strictly necessary

Hotjar deserves its own paragraph, because session recording is intrusive if it is done carelessly. We configure Hotjar to suppress by default. Keystrokes in form fields are not recorded. Text you type into an input is masked before it leaves your browser. Payment fields, password fields, and any field we designate sensitive are blocked entirely. Recordings capture the shape of a session, not the contents of your private data. Recordings are retained for 365 days or less and then deleted automatically. If you refuse the analytics category, Hotjar does not load at all, and there is no recording to delete.

Members and the marketplace

• If you request an inspection or ask to be connected with an inspector, we pass your name and contact details to the member or members best placed to serve you, so they can contact you. That is the point of the request.
• Member business listing information, including business name, service area, credential status, and business contact details, appears in our public member directory. Personal home addresses and personal mobile numbers do not appear in the directory unless a member chooses to publish them as their business contact.
• Certification records may be confirmed to a party who presents a certificate number, so buyers, sellers, lenders, insurers, and attorneys can verify that a certificate is genuine and current.

Legal, safety, and corporate

• When the law requires it. In response to a subpoena, court order, warrant, or other lawful demand. We review every demand, we object to demands that overreach, and where we are permitted to notify you before producing your information we will.
• To protect people and rights. Where we believe in good faith that disclosure is necessary to investigate suspected fraud or credential misuse, to enforce our Terms of Use or Member Agreement Policy, or to protect the safety of any person.
• In a corporate transaction. If Field Gate FLP or NRCIA is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may transfer as part of that transaction. The recipient remains bound by this Policy for information transferred, or we will give you notice and a choice before any materially different use.
• With your direction. Anywhere else you tell us to send it.

What we never do

We do not disclose personal information to third parties for their own direct marketing, with one named exception: the Meta Pixel described in section 05 and in the Cookie Policy, which Meta also uses for its own advertising purposes. We do not rent or trade mailing lists. Mobile numbers and SMS opt-in consent are never shared with any third party or affiliate for marketing purposes, and no third party or affiliate receives them for that purpose under any circumstance.

---

Cookies, tracking, and your controls

Non-essential cookies are set only after you give consent through our banner or preference center. Refusing is presented as plainly as accepting. You can change or withdraw your choice at any time through Manage cookie preferences, and withdrawal takes effect immediately.

The Meta Pixel is included in that. It sits in the Marketing category and does not load unless you allow it. Manage every category through Manage cookie preferences in the footer of any page or at nrcia.com/cookie-preferences. You can also use the Meta controls under Route 4 on the Do Not Sell or Share My Personal Information page, or write to us and we will record and honor your opt-out against your record rather than your browser.

We honor the Global Privacy Control and comparable browser opt-out preference signals as a valid opt-out of sale or sharing, and we apply the signal without asking you to prove anything. We do not respond to legacy Do Not Track headers, for which no common standard was ever adopted.

The full category list, the specific providers, the individual cookies, and their durations are in the Cookie Policy, which forms part of this Policy.

---

Google user data and the InspectionPLUS® calendar sync

InspectionPLUS® offers an optional Sync with Google Calendar feature. If you turn it on:

• You authenticate through Google. We never receive, never see, and never store your Google account password.
• We receive your Google account email address, your calendar list, and permission to read and write inspection appointments on the calendar you select.
• We use that access for one purpose: placing, updating, and removing your inspection appointments on your calendar.
• NRCIA’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it except as necessary to provide the feature, to comply with law, or as part of a merger or acquisition with your notice, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where the data has been aggregated and made anonymous.
• Google user data is retained only while your account is active. Turn off the sync, revoke access at myaccount.google.com/permissions, or close your account, and we remove Google user data within 30 days, except where a longer period is required by law.
• To request removal directly, write to legal@nrcia.org.

---

Email, SMS, and telephone

Transactional and service messages. Renewal notices, price change notices, credential and program changes, invoices, security alerts, disciplinary notices, and answers to your inquiries. These are part of the service relationship and you cannot unsubscribe from them while that relationship is active.

Marketing email. Sent to people who opted in. Every marketing email carries a working unsubscribe link and a one-click list-unsubscribe header, and unsubscribes are processed immediately and in no event later than 10 business days. We comply with the CAN-SPAM Act and, for Canadian recipients, Canada’s Anti-Spam Legislation.

SMS. Sent only to mobile numbers that opted in, with the program, message frequency, and rate disclosure given at the point of opt-in. Reply STOP to end messages and HELP for help. Message and data rates may apply. As stated in section 05, SMS consent and mobile numbers are not shared with any third party or affiliate for marketing purposes.

Calls and recordings. We may record or monitor calls for training, quality, and dispute records where the law allows it, and we tell you at the start of the call when we do.

To unsubscribe from everything optional at once, write to legal@nrcia.org with “Unsubscribe” in the subject line.

---

How long we keep information, and when we delete it

We keep personal information for the shortest period that does its job. When that period ends, we delete it or irreversibly anonymize it. Deletion is scheduled and automated wherever the system allows it, not left to someone remembering.

Category	Retention
Website session and usage analytics	14 months, then deleted
Hotjar session recordings and heatmap data	365 days or less, then deleted automatically
Cookie consent records	180 days, then we ask you again
Contact and inspection request submissions that do not become a relationship	12 months, then deleted
Marketing contacts and email engagement	Until you unsubscribe or ask for deletion, then removed except for a suppression record
Suppression records, meaning the minimum needed to keep you unsubscribed	Kept indefinitely, because deleting it would let us email you again by mistake
Member and accreditation records	Duration of membership plus 7 years, for credential verification, audits, and defense of claims
Disciplinary records	7 years from final decision
Certification records and the inspection evidence supporting them	Life of the certification plus 10 years, reflecting the outside limit for latent construction defect claims in California
Property owner records inside InspectionPLUS®	On the member’s instruction, and on our default schedule above where the member gives none
Payment and financial records	7 years, as tax and financial law requires
Google user data from the calendar sync	Only while the account is active, then removed within 30 days
Job applications, unsuccessful	12 months, then deleted
Security and access logs	12 months

If a legal hold, an open dispute, a regulatory request, or an active claim applies to a record, we preserve that record until the matter closes and then apply the schedule.

---

Security

We use administrative, technical, and physical safeguards proportionate to the sensitivity of what we hold. That includes encryption in transit and at rest, access limited to the people whose job requires it, multi-factor authentication on administrative and platform accounts, logging and monitoring, vendor security review before onboarding, written data protection terms with every processor, backup and recovery testing, and a written incident response plan.

Passwords are stored using a salted one-way hash. We never store them in a form we can read, and we will never ask you for your password by email, by text, or by phone.

If a breach occurs that affects your personal information, we will notify you and the required authorities within the timeframes the law sets, and the notice will tell you what happened, what was affected, and what to do.

No method of transmission or storage is completely secure, and we do not claim otherwise. What we do claim is that we build to reduce the blast radius and that we tell you the truth when something goes wrong.

---

Your privacy rights

Depending on where you live, you may have the right to:

• Know and access the categories and the specific pieces of personal information we hold, where we got it, why we have it, and who we disclosed it to.
• Correct information that is inaccurate.
• Delete personal information we hold about you, subject to the exceptions in section 09 and in law.
• Obtain a portable copy in a structured, commonly used, machine-readable format.
• Opt out of sale or sharing. We do not sell. See section 06 and the California page for sharing.
• Limit the use of sensitive personal information. We collect sensitive personal information only where a service you asked for requires it, and we do not use it to infer characteristics about you.
• Object to or restrict certain processing, and to withdraw consent you previously gave.
• Not be retaliated against. Exercising a privacy right will never cost you service, price, quality, membership status, credential standing, or directory placement. That is a commitment, not a formality.

How to make a request. Email legal@nrcia.org with “Privacy Request” in the subject line, call (888) 687-7663, or write to the address in section 01.

Verification. We confirm that you are who you say you are before we act, using information already on file. Sensitive requests may require a further confirming step from an email address we already hold. We will never ask you for a Social Security number, a payment card number, or a password to verify a privacy request.

Timing. We acknowledge within 10 business days and respond within 45 days. Where a request is complex we may extend once by a further 45 days and we will tell you before we do. There is no charge unless a request is manifestly unfounded or excessive, and we will say so before doing any work.

Authorized agents. You may use an authorized agent, who must provide written authorization signed by you. We may still verify you directly.

Appeals. If we decline a request in whole or in part, we tell you why and how to appeal. Send an appeal to legal@nrcia.org with “Privacy Appeal” in the subject line. We respond to appeals within 45 days.

California residents have additional detail and additional opt-out mechanics on our Do Not Sell or Share My Personal Information page.

---

Categories of personal information collected in the preceding 12 months

Stated using the categories in California Civil Code section 1798.140.

Category	Collected	Source	Business purpose	Disclosed to	Sold or shared
Identifiers: name, postal address, email, telephone, IP address, account identifiers	Yes	You, members, service providers	Service delivery, membership, communication, security	Service providers, members you asked to reach	No sale. Shared with Meta through the Meta Pixel and Advanced Matching
Customer records: signature, financial account information, billing details	Yes	You	Billing, collection, financial recordkeeping	Payment processor, accountants	No
Commercial information: memberships, programs, transactions, service history	Yes	You, our systems	Servicing the relationship	Service providers	No
Internet or network activity: browsing, search within our site, interaction with our content and ads	Yes	Automatic collection, analytics providers	Analytics, security, improvement	Analytics providers, Meta	No sale. Shared with Meta through the Meta Pixel
Geolocation, approximate only	Yes	IP address	Analytics, fraud prevention, routing to a local member	Analytics providers	No
Audio and visual: call recordings, photographs and video you or a member upload	Yes	You, members	Quality, dispute records, inspection evidence	Service providers, the member of record	No
Professional or employment information: license, insurance, credentials, employer, job applications	Yes	You, members, public and licensed verification sources	Accreditation, verification, hiring	Verification vendors, auditors	No
Education information: training and continuing education records	Yes	You, our programs	Accreditation	Service providers	No
Inferences: content and service preferences drawn from the above	Yes	Our systems	Improving what we send and show you	Service providers	No
Sensitive personal information: account login credentials	Yes	You	Authenticating you. Used for no other purpose	Service providers	No

We do not collect biometric information, precise geolocation of individuals, government identification numbers, health information, or information revealing racial or ethnic origin, religious belief, philosophical belief, union membership, sex life, or sexual orientation.

---

Children

The Services are directed to businesses, professionals, and adult property owners. They are not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not sell or share the personal information of any consumer under 16, because we do not sell or share personal information at all. If you believe a child has given us information, write to legal@nrcia.org and we will delete it.

---

Other jurisdictions and international transfers

We are established in the United States and we process information in the United States. Where a service provider operates internationally, information may be processed elsewhere.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we implement an appropriate transfer mechanism where one is required, which may include Standard Contractual Clauses together with supplementary measures. You may lodge a complaint with your national supervisory authority, and we would appreciate the chance to address the concern with you first.

State privacy laws in the United States differ in their details. Where a law that applies to you gives you a right this Policy does not describe, that right still applies and we will honor it. Write to legal@nrcia.org.

---

Third-party sites and services

Our Services link to sites we do not control, including member business websites, partner sites, and the sites of the providers in section 05. This Policy does not govern them. Read their privacy notices before you give them anything.

---

Changes to this Policy

We may update this Policy. When we do, we revise the “Last updated” date at the top and keep the prior version in our records. Where a change materially affects how we handle information already collected, we give prominent notice before the change takes effect, and where the change requires consent we ask for it again rather than relying on a choice you made against an earlier version.

Continued use of the Services after a non-material update means you acknowledge the updated Policy.

---

Contact

Privacy requests are acknowledged within 10 business days and answered within 45 days.

NRCIA marks, programs, and platform technology are owned by Field Gate FLP and used under license. LeakFREE®, Forensic ROOF®, InspectionPLUS®, and Mr. RoofCheck® are registered trademarks of Field Gate FLP. RoofGUARD™, ForensicGUARD™, DisasterGUARD™, E3GUARD™, and Think Like a Raindrop™ are trademarks of Field Gate FLP.