Privacy Policy

Version 1.0 · Effective date: October 7, 2026 · Last updated: October 7, 2026

Rook LLC (“Rook,” “we,” “us,” or “our”) provides software that home-service businesses use to communicate with their customers, manage appointments, and support related service activities. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through Rook, rooksync.com, and related services.

“Personal information” means information that identifies, relates to, or can reasonably be linked to an identifiable individual.

We do not sell personal information, share it for targeted advertising, or use client or customer content to train artificial-intelligence models.

1. Who This Policy Covers

This Policy applies to:

• Clients and account users: businesses using Rook and their authorized owners, staff, and view-only users.
• Clients’ customers: people who text, call, chat with, request services from, schedule appointments with, or receive invoices from a business using Rook.
• Website visitors and other contacts: people who visit our website, submit information through available forms, or communicate directly with Rook.

A client’s customers do not need to create a Rook account.

Home-file users: homeowners and people they authorize to view a home file, when that planned feature becomes available. Use requires the separate homeowner notice and terms; communicating with a business alone does not create a home file.

2. Our Role and the Client’s Role

For customer information that a client provides or that Rook processes to deliver services on the client’s behalf, the client determines the purposes of processing. Rook acts as the client’s processor or service provider under the applicable agreement and processing instructions.

Rook determines the purposes of processing information used for its own account administration, billing, website operation, support, security, and legal obligations and acts as a controller where applicable.

The client’s privacy notice explains its own collection and use of customer information. This Policy explains Rook’s handling of that information. When a privacy request concerns information controlled by a client, we coordinate with that client and assist it in responding.

For the optional home-file service described below, Rook determines how it operates the homeowner-facing file and acts as controller where applicable. This is separate from our processing of a business's ordinary customer records on that business's behalf. Businesses remain responsible for their original service records and the lawfulness of information they contribute.

3. Information We Collect

We collect the following categories of information, depending on the services and features used:

Client and account information. Business and user names, email addresses, telephone numbers, business addresses, account roles, support communications, and configuration information, including services, approved price ranges, hours, policies, service areas, technicians, and introductory or signature text. Supabase handles password authentication and stores password hashes; readable account passwords are not available to Rook personnel.

Customer communications and service information. Names, telephone numbers, text and chat messages, submitted photos, property and job addresses, appointment details, stated preferences, customer and property history, invoice descriptions and amounts, payment status, and related service records.

Photos are stored through our messaging provider. Rook retains links and descriptions and may transmit relevant photos to its AI provider for analysis.

Consent and communications records. Messaging permissions, the source and time of consent, opt-out and re-enrollment records, delivery status, and records of communications and automated actions.

Call metadata. Telephone numbers, call times, duration, whether calls were answered, and key presses used to request missed-call text-back. Rook does not record telephone conversations.

Imported information. Customer lists, contact information, job histories, and other fields contained in files clients upload. We identify the source of imported records and do not supplement them with information purchased from data brokers.

Connected-account information. When an integration is available and enabled, calendar event times, titles, locations, phone numbers extracted from event notes, and relevant invoice or payment information. We also process authorization tokens or other credentials necessary to maintain an authorized connection.

Technical and operational information. IP addresses, browser and device information, sign-in and security events, service-action records, diagnostic information, and limited usage information needed to operate and support Rook. This includes whether a Rook-generated payment link was opened.

Home-file information, when enabled: property addresses, completed-work dates and descriptions, equipment details, warranty terms, selected photos, contributing business names, appended corrections, and records of acceptance, authorized access and transfers. We separately process the homeowner's phone number and verification information to secure access; phone numbers are not included in the work records or transferred property history.

We obtain information directly from individuals, from clients and their authorized users, from enabled integrations, and through operation of the service.

4. Payment Information and Sensitive Information

Payments are handled by the business’s selected payment provider or payment arrangement. Rook does not receive customer payments for the business’s work and does not request or store full payment-card numbers. When Rook’s own paid subscriptions become available, its payment provider will process card information directly; Rook may receive limited billing and transaction information.

Rook is not designed to collect Social Security numbers, government identification numbers, medical information, biometric identifiers, or continuous background-location information. Addresses supplied for service requests may be used to determine service coverage, travel time, or relevant weather conditions.

Please avoid sending sensitive information or account credentials through ordinary messages, photos, or imported files. Free-form communications may contain information we did not request.

Gate and lock codes stored in designated access-instruction fields are subject to restricted access and excluded from AI inputs and automated customer replies. Information included in ordinary messages or photos may be processed by AI.

We do not request the main password for an external account. Certain integrations may require an app-specific credential, such as an Apple app-specific password, or an authorization token.

5. How We Use Information

We use personal information to:

• Answer customers’ questions and communicate client-approved service information and price ranges.
• Check service areas, determine available appointment times, and schedule, confirm, reschedule, or cancel visits.
• Send authorized reminders, job updates, follow-ups, invoice notices, and payment reminders.
• Refer emergencies, complaints, refund requests, and requests for human assistance to the client.
• Maintain relevant customer and property context, including stated preferences and previous work.
• Authenticate users, administer accounts, provide support, control usage, and maintain service reliability.
• Detect and prevent fraud, unauthorized access, abuse, and other misuse.
• Administer client billing when paid subscriptions become available.
• Comply with applicable law, resolve disputes, and enforce agreements.

We may use aggregated or de-identified information to understand service performance and improve Rook. We apply reasonable safeguards against identification and do not attempt to reidentify that information, except where permitted by law to test or maintain de-identification safeguards.

Where additional consent is legally required for particular processing, we obtain that consent or assist the responsible client in doing so. This Policy does not itself constitute consent to receive texts or authorize unrelated uses of information.

Provide optional home files, verify authorized access, display completed-work records, manage homeowner-directed sharing, handle corrections and deletion, and transfer selected property history to a verified successor homeowner.

6. Artificial Intelligence

Rook uses Anthropic’s Claude to process relevant messages, photos, conversation context, confirmed business information, preferences, and appointment details. AI-supported functions include drafting responses, describing visible photo content, extracting information from job updates, suggesting business facts from a client’s website, and answering support questions.

We limit AI inputs to information reasonably needed for the task. Designated access-code fields are excluded. Rook does not authorize training on client or customer content or submit that content as training-enabled feedback.

Our commercial AI arrangement does not use ordinary service inputs and outputs for model training. AI providers may nevertheless retain information for service delivery, security, abuse prevention, or legal obligations under the applicable agreement.

Rook identifies itself as the business’s AI assistant in customer-facing conversations. Requests for a person are routed to the client. Software controls and client settings govern permitted actions, approved prices, appointment availability, and sending permissions.

7. How We Disclose Information

We disclose personal information only as reasonably necessary for these purposes:

• To the relevant client and its authorized users: to manage customer communications and service records.
• To service providers: to support hosting, authentication, messaging, AI, maps, weather alerts, email, monitoring and backups. Providers processing information on our behalf are subject to appropriate contractual restrictions. Our current provider and subprocessor list is available at https://rooksync.com/subprocessors.
• To client-enabled integrations: to exchange information with connected calendar, payment, or CRM services. These platforms may also process information under their own terms and privacy notices.
• For legal and protective purposes: to comply with law or valid legal process, obtain professional advice, investigate misuse, or protect rights, security, and safety.
• For business transactions: in connection with a merger, acquisition, financing, reorganization, or asset sale, subject to confidentiality protections, applicable law, platform restrictions, and any required consent.

Authorized Rook personnel may access information as needed for support, administration, security, or legal compliance. Contact us for information about our current providers and subprocessors.

Home-file information is also disclosed to people the homeowner authorizes and, following an approved transfer, to the verified successor homeowner. A participating business's account gives it access only to its own contributed records. The restrictions in Section 8 apply to mobile information and messaging consent.

8. Text Messaging and Consent Information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except service providers that deliver messages for us.

Reply STOP to stop texts from that business, HELP for assistance, or START to request re-enrollment, subject to applicable consent requirements. Website submissions do not override a text-message opt-out. Stopping texts does not delete service records or cancel appointments. Our Messaging Terms explain message categories and consent requirements.

Home-file acceptance, sharing or transfer does not enroll anyone in texts or transfer another person's consent. Any later maintenance reminders require a separate approved opt-in naming the sending business and describing those reminders.

9. Connected Calendars and Other Accounts

Clients choose which integrations to enable. Rook requests only the permissions needed for the enabled feature.

For connected calendars, Rook reads availability, event times, titles, and locations; retains only phone numbers from event notes; and creates, updates, or cancels appointments it booked. It does not modify the client’s other events. Relevant appointment information may be processed by our AI provider to answer customer questions.

Rook’s use and transfer of Google API information will adhere to the Google API Services User Data Policy, including its Limited Use requirements and applicable restrictions on transfers and human access.

Clients may disconnect through available settings or the provider. Disconnection stops future access; previously stored information remains subject to this Policy’s retention and deletion provisions.

Facebook and Instagram messaging is built but remains disabled pending Meta approval. When enabled by a client, Rook receives names, message text, photos and Meta-assigned identifiers from Meta, together with connection credentials needed for authorized access. We use this information to manage the client's customer conversations, provide AI-assisted replies and arrange services on the client's behalf. When Meta notifies us that a message has been unsent, we delete its content, attachments and related summaries from our active systems; backups follow Section 11. Request deletion at https://rooksync.com/data-deletion. Meta and the client may hold separate copies under their own privacy practices. Social-platform permission does not itself authorize SMS contact.

Optional home files. This feature is planned and not currently available. If launched, a participating business may add a completed-work record only after it enables the feature and the homeowner accepts our separate notice and terms. Records contain the address, work date and description, equipment details, warranty terms, selected photos and business name. They exclude messages, phone numbers, price discussions and internal notes. Verification and contact details are maintained separately for access and administration.

The homeowner can view the property's records, choose who sees them, hide a record from shared views or delete the file. Hidden records remain stored until deleted with the file or removed for a lawful reason. Each business accesses only its own contributed records through its account. There is no public search by address. A code sent to the homeowner's U.S. phone number verifies control of that number; additional checks may be needed to establish authority over the property.

Businesses may append corrections to their own records. Rook does not rewrite their entries or verify completed work or warranties; necessary action to comply with law or protect others' rights remains permitted. Separately authorized records stay in the home file when a contributing business leaves Rook, until the homeowner deletes the file or lawful removal is required.

A homeowner may request transfer of selected work and equipment history to a verified buyer who accepts the terms. Prior homeowner names, contact details, access permissions and messaging consents do not transfer. Business attribution and the property address remain. Photos and descriptions are reviewed for personal details before transfer. This history may still be personal information; transfer does not make it public or anonymous.

Rook does not use home files for advertising, lead selling, recommendations steering homeowners to other businesses, or AI-model training. Maintenance reminders are not currently available and require a separate approved text consent before activation. Contact support@lunisolutions.com about home-file access, correction, deletion or transfer.

10. Browser Storage and Operational Tracking

Rook uses browser local storage for sign-in sessions, dashboard display preferences, and a random website-chat session identifier. The chat identifier expires after three days of inactivity; it does not contain a browser copy of the conversation. Chat messages are stored on our servers and are subject to Section 11. Clearing browser storage does not delete those server records.

We do not use advertising cookies or pixels, third-party analytics, or session replay. Limited operational tracking, including payment-link openings, supports invoice follow-up, security, and reliability. External payment pages and connected platforms follow their own privacy practices.

11. Retention and Deletion

We retain information for the disclosed purposes, subject to client instructions, permitted earlier-deletion requests, and lawful preservation requirements.

The periods above govern Rook-controlled copies and our deletion instructions to processors. Railway or another provider may retain limited separate technical or legal records under its own policy and lawful obligations; the 7-day log-access window does not establish its total retention. Original photos and separate home-file copies may therefore have different deletion dates. Minimal verification, consent, suppression or legal-preservation records are retained only as reasonably necessary for their permitted purpose.

The 90-day technical-copy limit does not determine retention of conversation histories, appointments, invoices, or other service records.

Account, billing, dispute, and compliance records are kept only as reasonably necessary. Minimal consent and opt-out records may be retained to document permissions and prevent unwanted re-contact.

We apply deletion instructions to providers processing information on our behalf. Backups remain restricted from ordinary use until removal, and deletion instructions remain effective after restoration. Providers may retain limited information for independent legal obligations.

12. Security and Incidents

Our safeguards include encryption in transit and of stored secrets and integration credentials; access controls; database-level client separation; password protections; optional two-step sign-in for business users and required two-step sign-in for Rook's administrators; expiring access links; rate limits; and monitoring.

Before diagnostic information is sent to Sentry, our code removes message text, phone numbers, email addresses and addresses. Sentry is additionally configured to scrub sensitive fields, avoid storing IP addresses and exclude personal details from alert emails. Two-step sign-in is required for everyone with access to Rook's Sentry account. Service records and action histories are maintained separately under Section 11.

No system is completely secure. We investigate incidents, take containment measures, and notify clients, affected individuals, and authorities as required by law and our agreements.

Rook operates in the United States, where its Supabase database is hosted. Other processing locations depend on the provider and configuration; contact us for details.

13. Your Privacy Requests and Choices

Email support@lunisolutions.com to submit a privacy request. Identify the business involved if your request concerns a client’s customer records. No Rook account is required. We coordinate requests concerning client-controlled information with that business.

Rook handles privacy requests concerning the home-file service directly. We may verify your identity and authority over the property and coordinate with a contributing business about an entry. Hiding a record does not delete it. Whole-file deletion removes the Rook-held home-file records on the schedule above; it does not erase a business's independent records or copies already downloaded by someone you authorized. Applicable privacy rights are not waived by retaining a record for property history.

Depending on applicable law and its coverage requirements, you may request access, correction, deletion, or a portable copy; withdraw consent; opt out of sale, targeted advertising, or profiling producing legal or similarly significant effects; and appeal a denial.

Rook does not sell personal information or use it for targeted advertising. Where required, we honor recognized opt-out signals, including Global Privacy Control, and accept requests from authorized agents or lawful representatives.

We request only information reasonably needed for verification and respond within applicable deadlines, generally 45 days. We explain permitted extensions. Requests are free except where law permits a fee.

To appeal Rook’s denial concerning information it controls, email the same address with “Privacy Appeal” in the subject line and explain your objection. We provide a written response within the applicable deadline and regulator complaint information where required.

We do not unlawfully discriminate for exercising privacy rights. Contact us for accessible formats or assistance.

14. Children and Minors

Rook’s business accounts are intended for adult business representatives. The service is not directed to children under 13, and we do not knowingly collect information directly from them.

Contact us if you believe a child provided information. We investigate, delete information where required, and apply applicable protections for minors.

15. Changes and Contact

We post updates with a revised date and notify affected users and clients of material changes. Before materially changing how previously collected information is processed, we obtain consent or provide an opportunity to withdraw consent where required.

Rook LLC
Mailing Address: 382 S 1130 W, American Fork, UT 84003
Email: support@lunisolutions.com