Privacy policy

Who is responsible for your data

The controller of the personal data described in this policy is MLJ, SASU, the company that publishes slabtoroof.com and the SlabToRoof service. Company registration details, including the SIREN, the VAT number and the registered office, are published on the legal notice page. The publication director, Jimenez Julien, handles privacy requests personally and can be reached at jimenezjulien42@gmail.com. This policy covers the marketing website only. Information you later store inside the SlabToRoof application as a paying customer, such as inspection reports, client records and field photographs, is governed by the customer agreement described in our terms of service, where you remain the owner of that content.

What the contact form collects

There is exactly one form on this website, the demo and quote request form in the contact section of the home page. When you submit it, the following named fields are transmitted and stored:

• name, the full name you type, so we know who we are replying to.
• email, your work email address, used to send the reply and nothing else.
• company, your inspection business name, so we can prepare a relevant example.
• role, your role in the business, chosen from a fixed list of inspection job titles.
• size, how many inspectors work in your business, chosen from a fixed list.
• request, what you are asking for: a demo, early access or a quote.
• message, the free text you write about your current report workflow.
• consent, the record that you ticked the box allowing us to reply and store the message.
• form-name, subject and recipient, three hidden routing fields that tell the form processor which site the message came from and where to deliver it.
• bot-field, an anti spam field that stays empty for human visitors and is discarded.

The form processor also records technical metadata attached to any web submission, including the date and time, the originating IP address and the browser user agent string. That metadata exists to filter automated spam and is not used to build a profile of you.

Why we are allowed to process it

For visitors in the European Union and the United Kingdom, the legal basis is your consent under Article 6(1)(a) of the GDPR, given by ticking the consent box, together with our legitimate interest under Article 6(1)(f) in answering a commercial request that you initiated. Where you ask for a quote and we go on to prepare one, processing is also necessary for steps taken at your request before entering into a contract under Article 6(1)(b). For visitors in the United States, we process the information to respond to the request you made and, where state law requires it, on the basis of your affirmative submission of the form.

How long submissions are kept

Form submissions are kept for 24 months from the date they arrive, then deleted. If the exchange turns into a paying subscription, the record moves into our customer file and is kept for the life of the account plus the retention period required by French commercial and tax law. If you tell us you are not interested, or ask for deletion, we remove the submission within 30 days and keep only a minimal suppression record so that we do not contact you again by accident.

Who processes the data with us

Form submissions are received, processed and stored by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, United States, which hosts this site and runs Netlify Forms. Netlify acts as our processor and stores submissions on infrastructure it controls. Replies are sent from a standard email account, which means the content of your message also sits in an inbox until it is deleted according to the schedule above. We do not sell personal data, we do not share it with advertising networks, and we do not pass inspector or agent contact lists to anyone.

Cookies and tracking

This website sets no advertising cookie, no remarketing pixel and no third party analytics cookie. There is no session cookie either, because nothing on the marketing site requires you to log in. Two fonts, Rokkitt and Asap, are requested from Google Fonts, which means your browser makes a request to a Google server that can see your IP address for the duration of that request. If you prefer to avoid that request entirely, a content blocker or a privacy focused browser will suppress it and the site will simply render in the fallback typefaces.

International transfers

MLJ, SASU is established in France. Netlify, our host and form processor, stores data in the United States. Transfers of personal data from the European Economic Area to the United States are made under the European Commission standard contractual clauses incorporated into our agreement with Netlify, together with the additional technical measures Netlify applies, including encryption in transit and at rest. If you would like a copy of the transfer safeguards that apply to your submission, ask us and we will send the relevant summary.

Your rights in the United States

Residents of California, Colorado, Connecticut, Utah and Virginia have the right to know what personal information we hold about them, to obtain a copy of it, to correct it, to delete it, and to opt out of its sale or of targeted advertising. We do not sell personal information and we do not use it for targeted advertising, so there is nothing to opt out of, but the request will still be honored and answered in writing. California residents may also designate an authorized agent to make a request on their behalf and are entitled not to receive discriminatory treatment for exercising these rights. To use any of them, write to jimenezjulien42@gmail.com with the email address you used on the form. We answer within 45 days and will tell you if we need a short extension.

Your rights in the European Union

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, and data portability. Where processing rests on consent, you may withdraw that consent at any time without affecting the lawfulness of what we did before the withdrawal. Requests go to the same address and are answered within one month. If you believe we have handled your data badly, you may lodge a complaint with your national supervisory authority; in France that is the Commission Nationale de l'Informatique et des Libertes, at cnil.fr.

Children's privacy

SlabToRoof is a professional tool sold to licensed home inspectors and their businesses. The site is not directed to children, and we do not knowingly collect personal information from anyone under 16 years of age. If you believe a child has submitted the form, write to us and we will delete the record promptly.

Security

The site is served only over HTTPS, with strict transport security, content type protections and a referrer policy set at the edge. Access to form submissions is limited to the publication director. Passwords protecting those accounts are unique and stored in a password manager with two factor authentication enabled. No system is perfect, and if a breach ever affected your data we would notify you and the relevant authority within the deadlines the law sets.

Changes to this policy

If this policy changes in a way that affects how your information is used, we will update the date at the top of this page and, where the change is significant, describe it in a short note here. The current version was published on March 2, 2026 and replaces every earlier version.