01
What this record covers
This information describes the Rootsly website, direct Rootsly assessments, client-branded subdomain and widget journeys, staff accounts, reports, support, referrals and security operations.
It is a code-reviewed staging draft, not the effective public-pilot privacy notice. Applicable legal bases, controller wording, international-transfer wording, agreements and final contact details remain subject to professional review.
02
Expected responsibilities—not final legal classification
The working model expects a client company to be controller for homeowner data collected through its branded subdomain or widget, with Rootsly generally acting as its processor. Rootsly expects to be controller for direct Rootsly assessments and for platform staff, billing, fraud-prevention and security data.
After a homeowner specifically agrees to transfer minimum information to a named referral receiver, that receiver is expected to act as an independent controller for its own use. These classifications, the necessary data-processing and data-sharing terms, and the exact notices remain open for legal approval.
- A host name or logo never determines access or legal responsibility on its own.
- Each organisation receives a restricted view for its role; referral parties do not receive unrestricted access to a shared homeowner record.
- Rootsly routes a verified privacy work item to the organisation indicated by recorded evidence without claiming that operational routing finally decides the legal role.
03
Information used and deliberately left out
An assessment may use property selection and provider facts, homeowner corrections, household requirements, broad financial ranges, project scope, practical constraints, assessment results, report-delivery details and separately recorded choices.
Rootsly does not need income, credit history, detailed monthly expenditure, children's names, dates of birth or school applications for the MVP comparison. Ordinary client users and referral receivers do not receive detailed mortgage or financial answers by default.
- Staff accounts use verified email, role and security evidence.
- Operational records use internal identifiers and bounded audit summaries rather than placing personal answers in routine logs.
- Optional photos, support information and contact details are collected only for the separately explained purpose.
04
Purposes remain separate
Rootsly calculates and shows the core result before requesting contact details. A report request does not grant permission for sales contact, marketing or referral.
Report delivery, callback, appointment, photo sharing, feedback follow-up, marketing and transfer to a specifically named partner are separate choices with versioned wording and append-only evidence. A decline or later withdrawal does not erase the earlier record.
05
Retention is provisional and safe-off
The working proposal is to anonymise unconverted identifiable assessments and leads after 24 months of inactivity, with an approved shorter client period allowed. Converted-customer records would follow the relevant client policy and agreement, while justified anonymous aggregates and a minimal suppression record may remain.
That schedule is not approved. The current retention control plane is deliberately unable to erase homeowner identity by age. Temporary exports expire automatically, already-requested photo removal can run independently, and final schedules for reports, referrals, consent, audit, security, complaints and offboarding remain under review.
- A report-link expiry is not the same as deleting the underlying report record.
- Historical decision, consent, disclosure and transfer evidence is never silently overwritten.
- Production deletion cannot be enabled without an approved decision, professional-review reference and named releaser.