Privacy Policy

SurfaceMeasure is operated by CJessop Company, LLC, a Georgia limited liability company (“SurfaceMeasure,” “we,” “us,” or “our”). We provide a tool for measuring flat outdoor surfaces from satellite imagery and turning those measurements into quotes. CJessop Company, LLC is the controller of the personal information described here.

This policy covers surfacemeasure.io, the SurfaceMeasure web application, our hosted quote pages, and the emails we send (together, the “Service”). It does not cover any third-party site or service you reach from ours, or what a contractor does with a quote after they send it to you.

Two different people read this page, and the answers differ. If you are a contractor with a SurfaceMeasure account, Sections 2 through 8 are about you. If you are a homeowner or property manager who was sent a surfacemeasure.io/q/… quote link, Section 9 is written for you.

Account information. Your email address and password when you sign up. Passwords are stored only as salted hashes by our authentication provider — we never see or store the plain text. If you sign in with Google, we receive your email address, name, and profile picture from Google instead of a password.

Business profile and branding. Anything you add for your quotes: company name, contact name, phone number, email, logo image, accent color, and your default rates and line items. You choose whether to provide this; without it, quotes simply render unbranded.

Measurement data. The property addresses you search, the shapes you trace, the resulting square footage, the surface type, and any names or notes you attach to a saved measurement.

Quote and customer information. When you build a quote, we store what you enter about the job — including your customer’s name, the property address, the scope of work, pricing, and a snapshot of your business details as they read at the time. We also generate and store a PDF of the finished quote. Section 8 explains this in detail, because it is information about someone other than you.

Payment information. Paid plans are processed by Stripe. Card numbers are entered on Stripe’s own pages and never reach our servers. Stripe returns limited details we use to run your account — customer and subscription identifiers, plan, status, trial and renewal dates, the date Stripe will next retry a declined charge, the type of payment method and when it was added, and the brand and last four digits of your card.

Referral information. If you invite someone, we store your invite code, who signed up with it, and whether a reward has been applied. An invited user’s email address is not shown to the person who invited them.

Support and other communications. Messages you send us, and the email address you send them from. Our contact form asks for your name, email address, message, and, if you choose to give it, a phone number.

Usage, device, and log data. Collected automatically: IP address, browser and device type, operating system, referring page, pages and screens viewed, features used, timestamps, and error diagnostics. Our hosting provider keeps standard server logs, including IP addresses, for security and troubleshooting.

Advertising identifiers. If you arrive from an ad, we store the click identifier that came with you (for example Google’s gclid or Meta’s fbclid) so we can tell which advertising actually produces customers.

We do not collect government identifiers, financial account numbers, precise device geolocation, biometric data, health data, or any other category treated as “sensitive personal information” under US state privacy laws — and we do not ask you for them.

We use the information above to:

• provide, operate, and maintain the Service, including saving and displaying your measurements and quotes;
• create, secure, and authenticate your account, and detect fraud or abuse;
• process payments, manage subscriptions and trials, and apply referral rewards;
• generate quote PDFs and serve hosted quote links to the people you send them to;
• send service and transactional email — account, billing, trial, and security notices;
• send product and marketing email you can unsubscribe from at any time;
• respond to support requests and honor privacy requests;
• understand how the Service is used, find where people get stuck, and improve the product;
• measure and improve our advertising, including reporting conversions to Google; and
• comply with law, enforce our Terms of Service, and establish or defend legal claims.

We do not use your measurements, quotes, or customer details to train machine learning models, and we do not sell them or make them available to other users.

Legal bases (if you are in the UK, EU, or another region that requires one). We rely on: performance of a contract, for everything needed to run your account and deliver the Service; legitimate interests, for security, fraud prevention, product analytics, and direct marketing to existing customers; consent, for advertising and non-essential cookies where consent is required, and for marketing email where required — withdrawable at any time; and legal obligation, for tax, accounting, and responding to lawful requests.

We use cookies, local storage, and similar technologies for three purposes. Blocking the first will break the Service; blocking the others will not.

• Strictly necessary. Keeping you signed in, remembering your session, protecting forms, and storing in-progress work and preferences on your device.
• Analytics. Understanding which features are used and where people get stuck. We use Google Analytics 4 and PostHog.
• Advertising. Measuring which ads produce customers, and showing ads. We use Google Ads. Google sets its own cookies and receives information about your visit, and may combine it with data it already holds about you.

Be aware: we do not currently show a cookie consent banner. Analytics and advertising technologies load when you visit the site, subject only to the browser signals described in Section 5. We would rather tell you that here than imply a choice we do not yet offer. If you would prefer we did not collect this, Section 5 lists every control that does work today.

Session replay. When you are signed in to an account, PostHog may record anonymized re-creations of how a screen was used — clicks, scrolls, and navigation. Visitors who are not signed in are not recorded. We configure it deliberately: every input and text area is masked, so passwords, email addresses, property searches, rates, and quote fields are never captured; property addresses, job names, and customer details in the interface are explicitly excluded; console logs, network request bodies, and map imagery are not recorded at all; and billing happens on Stripe’s own pages, which we never record. Replays are tied to a random identifier and your internal account ID — never your email address. PostHog processes this on our behalf on servers in the United States.

What our analytics never receives. By design, we strip street addresses, raw search text, map coordinates and traced geometry, customer names, emails and phone numbers, quote recipients, notes, file contents, and payment data from every analytics event before it leaves your browser. This is enforced in code, not by policy alone.

• Global Privacy Control and Do Not Track. Our product analytics honors your browser’s Do Not Track setting and does not record you at all when it is enabled. We also accept a Global Privacy Control signal as a valid opt-out of the advertising sharing described in Section 7. We are building automatic recognition of that signal; until it ships we act on it when you tell us, so the controls below are the ones that take effect immediately.
• Browser and device settings. You can block or delete cookies, and most browsers offer a tracking-protection mode that blocks analytics and advertising scripts outright. Blocking strictly necessary cookies will sign you out and prevent the Service from working.
• Advertising opt-outs. Use Google Ads Settings and the Google Analytics opt-out add-on. Industry-wide opt-outs are available at YourAdChoices and the NAI.
• Marketing email. Every marketing email has an unsubscribe link, and we honor it permanently. You will still receive transactional messages about your account, billing, and security — those are not marketing and cannot be unsubscribed from while you have an account.
• Your account data. You can edit your business profile and delete individual measurements and quotes from within the app, and delete your entire account from Account settings. Section 11 explains exactly what deletion removes.

We do not sell your personal information for money, and we do not share your measurements, quotes, or customer details with anyone except the providers below, who process data on our behalf under contract and may not use it for their own purposes:

• Supabase — authentication, database, and file storage (United States).
• Vercel — application hosting, delivery, and server logs (United States).
• Stripe — payment processing, subscriptions, and the billing portal.
• Google Maps Platform — maps, satellite imagery, and address search (see Section 10).
• PostHog — product analytics and session replay (United States).
• Google — Analytics 4 and Google Ads measurement (see Section 7).
• Loops — sending our product, lifecycle, and marketing email. Loops receives your email address, your account ID, and account facts such as plan, signup date, and measurement counts. Loops also delivers messages sent through our contact form to our inbox, so it receives what you enter there.
• Slack — an internal notification to our own team when a new account is created, which contains your email address and how you found us; when one account turns out to hold two subscriptions, when an old checkout link is reopened by an account that has subscribed before, or when a subscription is still active after its account was deleted, which names the Stripe subscriptions involved and a shortened account number, never your email or card; and when a trial is set to cancel, which contains your email address, the reason you picked when cancelling, and how many measurements you made and the largest one's size and type. None of them goes to anyone outside the company.

We may also disclose information when we believe in good faith it is required by law or valid legal process; to investigate suspected fraud, security incidents, or violations of our Terms; to protect the rights, safety, or property of anyone; or in connection with a merger, acquisition, financing, or sale of assets — in which case we will require the recipient to honor this policy or give you notice before your information becomes subject to a different one.

We have never exchanged personal information for money. But some US state privacy laws — California’s in particular — define “sale” and “sharing” broadly enough to include ordinary advertising measurement. We would rather be precise than reassuring, so here is exactly what happens:

• The Google Ads tags on our site send Google information about your visit — pages viewed, actions taken, your IP address, and its own cookie identifiers.
• When you subscribe, we send Google Ads your email address so it can match the conversion to an ad click (a feature Google calls enhanced conversions). Google hashes the address on receipt.

Under California law that conduct is likely a “share” for cross-context behavioral advertising, and may be treated as a “sale” under some other state laws, even though no money changes hands. The categories involved are identifiers and internet activity.

To opt out, use the advertising opt-out tools in Section 5, or email us at Contact@SurfaceMeasure.io with the subject “Do Not Sell or Share My Personal Information” — we will apply it to your account and confirm when it is done. Both take effect right away. We also accept a Global Privacy Control signal as a valid opt-out, and are building automatic recognition of it as described in Section 5.

We do not knowingly sell or share the personal information of anyone under 16, and we do not offer financial incentives in exchange for personal information.

A quote contains someone else’s details — a name, a property address, a price. We handle that information only to run the Service for you, and this section sets out how.

Our role. For customer information you enter, you are the controller (or “business”) and we act as your processor (or “service provider”). We use it only to provide the Service to you and as your instructions and applicable law allow. We do not sell it, use it for our own advertising, contact your customers for our own purposes, or combine it with data from other sources.

What we store. The customer name and property address you enter, the scope and pricing of the job, a snapshot of your business details as they read when the quote was created, and a generated PDF of the quote. For hosted quotes we also record whether and when the link was opened and whether it was accepted.

Your responsibilities. You are responsible for having the right to enter your customers’ information and for giving them whatever notice their local law requires. Enter only what a quote genuinely needs; the field for a customer name is not a place for anything sensitive.

Requests from your customers. If one of your customers asks us directly to access or delete their information, we will refer them to you and assist you in responding, unless the law requires us to act ourselves.

Deletion. Delete a quote and its stored PDF goes with it. Delete your account and every quote, measurement, and stored file we hold for you is removed as described in Section 11.

If you received a link like surfacemeasure.io/q/…, the quote was prepared by an independent contractor who uses SurfaceMeasure. That contractor decides what the page says and who receives the link. We host it for them.

The link is unguessable and the page is not indexed by search engines, but anyone who has the link can open it. When you open the page or press Accept, we record that it was opened or accepted and tell the contractor — that is the point of the link. Like the rest of our site, the page also loads the analytics and advertising technologies described in Section 4.

Pressing Accept tells the contractor you are interested. It is not a contract with SurfaceMeasure, and we are not a party to any agreement between you and the contractor.

To correct or remove your details, contact the contractor whose name is on the quote — they control the information and can delete it. If you cannot reach them, email us at Contact@SurfaceMeasure.io and we will help.

Maps, satellite imagery, and address search come from Google Maps Platform. When you use those features, Google receives information necessary to serve them, including your IP address and the locations you look at.

By using the Service you acknowledge and agree to be bound by the Google Maps/Google Earth Additional Terms of Service, which incorporate the Google Terms of Service. Google’s handling of your information is governed by the Google Privacy Policy, not by this one.

The one exception is the interactive demo, which also appears on the screen that starts your trial. Its aerial photo of a sample parking lot is North Carolina’s public orthoimagery from NC OneMap, stored on and served from our own site, so viewing it sends nothing to Google or to NC OneMap. Using the demo is counted in our product analytics like the rest of the site (Section 4).

We keep your account, measurements, quotes, and stored files for as long as your account is open, because those are what you came for. After that:

• Deleting your account cancels any active subscription immediately, deletes your stored logos and quote PDFs, and deletes your profile — which removes your measurements and quotes with it — and then deletes your login. This is irreversible and there is no recovery window, so export anything you want to keep first.
• Billing and tax records are retained by us and by Stripe for as long as tax, accounting, and financial regulations require, typically seven years. These records survive account deletion because the law requires it.
• Email records — your address and suppression status — are retained by our email provider after account deletion only as needed to keep honoring an unsubscribe.
• Analytics and advertising data held by Google and PostHog, and by Meta for visits before September 25, 2026 (when we removed the Meta Pixel), is retained under each provider’s own schedule and is not deleted by deleting your account. Use the opt-outs in Section 5, or Meta Ad Preferences for Meta, or ask us and we will submit what deletion requests those providers support.
• Server logs and backups roll off on their own cycle, generally within 90 days for logs. A deleted record may persist in an encrypted backup until that backup expires; it is not restored to the live Service.

We use technical and organizational measures appropriate to a service of this size: encryption in transit (HTTPS everywhere), encryption at rest by our database and storage providers, row-level access rules so one account cannot read another’s data, hashed passwords, unguessable capability tokens for hosted quotes, secrets kept out of the browser bundle, and payment card handling delegated entirely to Stripe.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for the activity under your account. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law and without undue delay.

Depending on where you live, you may have the right to know what personal information we hold and how we use it; to access a copy or receive it in a portable format; to correct inaccuracies; to delete it; to opt out of targeted advertising and of the “sale” or “sharing” described in Section 7; to limit the use of sensitive personal information (we collect none); to withdraw consent; and not to be discriminated against for exercising any of them.

How to make a request. Do most of it yourself from Account settings, or email Contact@SurfaceMeasure.io. We will verify your request against the email address on your account, or by other reasonable means if you do not have one. An authorized agent may act for you with written permission we can verify.

Our timeline. We acknowledge requests promptly and respond within 45 days, extendable once by another 45 days where the law allows and we tell you why. Requests are free unless they are manifestly unfounded or excessive.

If we say no. You may appeal by replying to our decision with the word “Appeal.” A different person will review it and answer within 45 days with a written explanation. If your appeal is denied, residents of Virginia, Colorado, Connecticut, and other states with a similar right may complain to their state Attorney General; California residents may contact the California Privacy Protection Agency.

A note for contractors: rights requests we receive about information you entered — your customers’ names and addresses — are forwarded to you, because that information is yours to control (Section 8).

We are based in the United States and our providers process data in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the US, which may not offer the same protections as your home country.

Where a transfer mechanism is legally required — for example for personal data from the UK, EU, or Switzerland — we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, which our providers incorporate into their terms. You may request more detail at Contact@SurfaceMeasure.io. If you are in the UK or EU, you also have the right to complain to your local supervisory authority.

The Service is intended for use in the United States. We do not target it at the EU or UK and do not offer it in any language other than English.

The Service is a business tool for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18, and accounts require you to be 18 or older. If you believe a child has given us information, email Contact@SurfaceMeasure.io and we will delete it promptly.

We may update this policy as the product changes. We will always update the “Last updated” date above. If a change materially affects how we use information you already gave us, we will give notice by email or in the app before it takes effect, and where the law requires consent, we will ask for it. Continuing to use the Service after a change takes effect means the updated policy applies to you.

Previous version: September 7, 2026. Available on request at Contact@SurfaceMeasure.io.

Questions, requests, or complaints about privacy go to Contact@SurfaceMeasure.io, or through our contact page. Write “Privacy” in the subject line and we will route it correctly.

CJessop Company, LLC
Roswell, Georgia, United States
SurfaceMeasure · surfacemeasure.io