1. Who we are
Roffik LLC (“SalesThumb,” “we,” “us”) operates the SalesThumb platform at salesthumb.com, a multi-tenant software-as-a-service product for service businesses. This Privacy Policy explains how we handle personal information.
2. The two roles we play
SalesThumb processes data in two distinct roles, and your rights depend on which applies:
- Controller — for data we collect about you directly, including account information for shop owners and their staff, billing data, support correspondence, and product telemetry.
- Processor — for data shop owners enter into SalesThumb about their customers, vehicles, appointments, invoices, and so on. The shop is the controller; we process that data only on the shop’s instructions.
If you are a customer of a shop using SalesThumb and want to exercise rights against your data, please contact that shop directly. We will assist them in fulfilling your request.
3. What we collect
Account & identity
- Name, email address, phone number, hashed password.
- Shop name, address, vertical, business hours.
- Profile photo (optional).
Billing
- A payment-processor customer identifier and the last four digits of the most recent card. We never receive or store full card numbers.
- Subscription plan, billing history, and invoices.
Product usage
- Pages viewed, features used, error events. Used to debug, plan the roadmap, and bill metered usage where applicable.
- IP address, user-agent, device type, referrer. Retained 30 days for abuse and security investigation.
Customer-of-a-shop data
- When a shop uses SalesThumb, it enters customer information, vehicle details, photos, payment data, warranty registrations, and message history. We process this on the shop’s behalf.
Voice messages
- The SalesThumb mobile app’s team walkie-talkie feature records short voice messages and uploads them to our storage so teammates can play them back. These are stored, not processed on-device only.
Google Business Profile reviews
- If a shop connects its Google Business Profile, we periodically sync that shop’s reviews (reviewer name, profile photo, rating, and review text) so the shop can see and reply to them from SalesThumb. This is a read-only mirror of what Google already shows publicly — we do not collect this directly from reviewers, and it refreshes automatically from Google on a regular cycle.
Facebook, Instagram & Meta Ads (if connected)
- If a shop connects its Facebook Page or Instagram account, we receive and store the content of Messenger and Instagram direct messages exchanged with that Page, together with the Meta-provided scoped identifier for the sender (a per-app, per-page ID — not your public Facebook or Instagram profile), so the shop can read and reply from its SalesThumb inbox. On connect we may import up to the last 30 days of that Page’s conversation history.
- If the shop runs Meta Lead Ads, form submissions — such as the name, email, phone number, and any custom fields a person enters in the shop’s lead form — are delivered to us through Meta’s webhook and stored as a customer record and inbox message for the shop to follow up.
- We store the shop’s Meta access tokens encrypted at rest and use them only to send and receive messages and retrieve lead data on that shop’s behalf. We request only the permissions needed for messaging and lead retrieval, and we do not post to Facebook or Instagram on the shop’s behalf. As with other customer-of-a-shop data, we act as the processor here and the shop is the controller.
4. How we use it
- To provide, secure, and improve the SalesThumb service.
- To bill you and prevent fraud.
- To send transactional email (receipts, security alerts).
- To send product update emails to shop owners (you can opt out from any such email; opting out doesn’t affect transactional messages).
- To respond to support requests.
- To comply with law, court orders, and lawful requests.
5. Who we share it with
We share personal information only with vendors who help us run the service, all under contract:
- Vercel — application hosting (US).
- Neon — managed Postgres database (US, AWS us-east-1).
- Cloudflare R2 — file storage (global edge).
- Rainforest Payments — processes payments between shops and their customers (card data, payouts).
- Rainforest Pay — bills SalesThumb’s own subscription plans to shop owners (same processor as merchant/customer payments above).
- Twilio — SMS sending and receiving.
- Your configured email provider — transactional email is sent via SMTP using the mailbox you (or we, on your behalf) configure — typically Google Workspace. We do not route email through a separate third-party email-delivery vendor.
- Meta (Facebook & Instagram) — if a shop connects its Facebook Page or Instagram account, SalesThumb receives and sends messages through Meta’s Messenger and Instagram APIs. Lead Ad form submissions are also received via Meta’s webhook infrastructure. Messages and lead data are stored in SalesThumb so the shop can manage conversations from one inbox.
- Inngest — scheduled background jobs.
- Google — where analytics are enabled on salesthumb.com, Google Analytics receives standard web-analytics data (pages viewed, referrer, approximate location from IP address, device/browser type) to help us understand aggregate traffic.
- Microsoft — where analytics are enabled on salesthumb.com, Microsoft Clarity receives that same usage data plus session recordings and heatmaps — a replay of mouse movement, clicks, scrolling, and on-screen content during a visit — so we can see how the site is actually used, not just that it was used.
- Anthropic — powers optional AI features (photo-to-quote suggestions, inspection damage-note drafting, AI-drafted message replies, and similar assistive tools). Photos and text you or your customers submit through these features may be sent to Anthropic’s API to generate the AI output; it is not used to train Anthropic’s models.
We do not sell personal information. We do not share it with advertisers or data brokers.
Public display on shop-controlled signage. If a shop enables the optional “before/after” slide on SalesThumb’s digital-signage feature, job photos from that shop’s appointments are shown, without login, on the TV screen the shop pairs to that feature. The shop chooses whether to enable this slide and controls how many recent photos rotate through it; SalesThumb does not currently screen individual photos before they appear on signage. If you have concerns about a specific photo, contact the shop directly.
6. International transfers
We are a US company and our infrastructure is primarily in the United States. If you are in the European Economic Area, the UK, or another jurisdiction with data-export restrictions, your information will be transferred to the US under Standard Contractual Clauses where required.
7. How long we keep it
- Account data — for the life of your account. Canceling your subscription disables access but does not delete anything automatically; deletion happens only on an explicit request (see Deletion requests).
- Backups — 7-day rolling point-in-time recovery window.
- Invoices and payments — kept as your financial/business history; there is no automatic deletion today. Personal-identifying fields on quotes and invoices (signatures, notes) are automatically redacted 540 days after creation, independent of any request.
- Failed-login and security logs — 90 days.
8. Your rights
You can:
- See what we have about you — export from Settings → Data export in the app, or email info@roffik.com.
- Correct inaccurate information by editing it in the app.
- Request deletion of your account or data, or an export, at salesthumb.com/privacy/delete-my-data.
- Object to processing or restrict it, subject to our legal obligations.
- File a complaint with your local data-protection authority.
If you left a Google review for a business that uses SalesThumb: that review lives on Google Business Profile, not in a SalesThumb account you created. We only mirror what Google already displays publicly, and it refreshes automatically from Google’s own data. To edit, remove, or manage a review, use Google’s own tools for reviewers (Google Maps or Google Search); a removal on Google will be reflected here on our next sync.
If you messaged a business on Facebook or Instagram that uses SalesThumb, or submitted one of its Meta Lead Ad forms: the resulting messages and lead details are stored in that shop’s SalesThumb inbox. You can request deletion of that data through Facebook’s data-deletion request flow (which notifies our automated deletion endpoint) or directly at salesthumb.com/privacy/delete-my-data. On a valid request we delete the stored Messenger and Instagram messages associated with your Meta identifier.
9. California & US state privacy
California, Colorado, Connecticut, Virginia, Utah, Texas, and a growing list of states grant residents specific privacy rights. We honor those rights as written for each state. We do not sell personal information as defined under the CCPA, CPRA, or equivalent state law. We do not engage in “sharing” for cross-context behavioral advertising.
10. Children
SalesThumb is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, email info@roffik.com and we will delete it promptly.
11. Cookies
We use first-party cookies for authentication and to remember preferences. We do not use third-party advertising cookies. Where enabled, salesthumb.com may run two analytics tools: Google Analytics, which collects aggregate usage data, and Microsoft Clarity, which is more sensitive — it records individual browsing sessions and builds heatmaps rather than only aggregate statistics. See “Who we share it with” above for what each receives. On your first visit to our marketing site you can choose Accept or Reject in the cookie banner, and change that choice anytime via the “Cookie preferences” link in the footer — your choice governs both tools together. Inside the SalesThumb product itself, after you sign in, product-usage analytics is covered by your acceptance of our Terms of Service at signup rather than a separate in-app banner; Microsoft Clarity specifically is never active there regardless of that acceptance, since its session-recording/heatmap capture can include on-screen customer information that goes beyond aggregate usage analytics.
12. Changes to this policy
We’ll post material updates here at least 30 days before they take effect, and email account holders if the change affects their data. The current version is always available at this URL.
13. Text messaging (SMS)
If you provide a mobile number and opt in, SalesThumb (and shops using SalesThumb, on their own behalf) may send you text messages such as account alerts, appointment confirmations and reminders, and service updates. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out at any time, or HELP for help.
We do not sell your mobile information, and we do not share your mobile number or SMS opt-in consent with third parties or affiliates for their own marketing or promotional purposes. Mobile information is shared only with the messaging providers (such as Twilio) that deliver these messages on our behalf, and only as needed to comply with law. Opting out of texts does not affect transactional account or security messages required to operate your account.
14. Contact
Privacy questions: info@roffik.com.
EU representative: contact us first; we’ll route the request appropriately.