Roper Privacy Policy

Roper is a sales outreach platform operated by Roper Software Systems Inc. This Privacy Policy applies to the Roper web application, APIs, and the Roper Chrome extension (together, the “Service”), and to www.useroper.com.

For contact data you import into Roper (your leads and prospects), you are the data controller and Roper acts as a processor on your instructions, as described in our Terms of Service. This policy covers the personal information Roper collects and controls — primarily information about you, our user.

• Account information. Name, email address, and authentication details, managed through our authentication provider (Clerk). We never see or store your password.
• Customer Data. Lead lists, contact records, sequences, templates, notes, and message content you create or import into the Service.
• Connected email account data. If you connect a Gmail or Microsoft (Outlook / Microsoft 365) account, the data described in Sections 3 and 4.
• Payment information. Payments are processed by Stripe. Roper does not receive or store your card number.
• Usage and device data. Log data such as IP address, browser type, pages viewed, and actions taken in the Service, used for security, debugging, and product improvement.

3.1 Scopes we request. Roper requests the following Google OAuth scopes:

• Send email on your behalf (gmail.send) — to send the outreach emails you compose and schedule through Roper from your own Gmail address.
• Read your email (gmail.readonly) — solely to detect replies to emails sent through Roper, so that follow-up sequences stop automatically and replies appear in your Roper dashboard.
• Manage calendar events (calendar.events) — to create and read calendar events when meetings are scheduled through the Service.
• Your email address (userinfo.email) — to identify which Google account is connected.

3.2 What we access and store. We store: (a) OAuth access and refresh tokens (never your Google password); (b) your Gmail address; (c) copies of the emails you send through Roper; and (d) replies received in the threads of emails sent through Roper — including sender, subject, timestamps, and message body — so we can show them to you and stop sequences. Roper does not read, scan, or store your general inbox. Reply detection is limited to conversation threads that Roper itself initiated.

3.3 Limited Use disclosure. Roper's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Roper:

• only uses Google user data to provide and improve the user-facing features described above;
• does not use Google user data for advertising, or sell it to data brokers or any other party;
• does not allow humans to read your Google user data, except (a) with your explicit consent for a specific message (e.g., a support request), (b) as necessary for security or abuse investigation, (c) to comply with applicable law, or (d) in aggregated, anonymized form for internal operations;
• does not use Google user data to train or improve generalized artificial intelligence or machine-learning models.

3.4 Revoking access. You can disconnect your Google account at any time in Roper's settings, or revoke Roper's access directly at myaccount.google.com/permissions. Upon disconnection we delete the stored OAuth tokens; you may also request deletion of stored reply data as described in Section 7.

4.1 Permissions we request. Roper requests the following Microsoft Graph delegated permissions: Mail.Send (send mail as you), Mail.ReadWrite (create drafts and read replies to emails sent through Roper), User.Read (your basic profile, to identify the connected mailbox), and offline_access (refresh tokens so you stay connected).

4.2 What we access and store. We store OAuth access and refresh tokens (never your Microsoft password), your Outlook email address, copies of emails sent through Roper, and replies received in conversations Roper initiated (sender, subject, timestamps, and message body). Roper does not read, scan, or store your general inbox.

4.3 Our commitments. Microsoft user data is used only to provide the features above. We do not use it for advertising, do not sell it, do not permit human access except in the narrow cases listed in Section 3.3, and do not use it to train AI models.

4.4 Revoking access. Disconnect your Microsoft account in Roper's settings, or revoke access at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work/school accounts).

We use the information described above to:

• provide, operate, and secure the Service (send your sequences, detect replies, schedule meetings, enrich contacts);
• process payments and manage subscriptions and credits;
• provide support and communicate with you about the Service;
• monitor aggregate usage to prevent abuse and improve the product; and
• comply with legal obligations.

AI features (message generation and voice) are powered by third-party AI providers and operate on the lead data and instructions you supply — not on your Gmail or Microsoft mailbox data.

6.1 Subprocessors. We use the following categories of service providers, bound by contracts that limit their use of your data to providing services to us:

• Hosting & infrastructure: Vercel (application hosting), Supabase (database)
• Authentication: Clerk
• Background job processing: Inngest
• Payments: Stripe
• AI providers: OpenAI (text generation), ElevenLabs (voice)
• Data enrichment: People Data Labs, Apollo.io, Evaboot

6.2 Legal and corporate. We may disclose information if required by law or legal process, to protect the rights and safety of Roper or others, or in connection with a merger, acquisition, or sale of assets (in which case this policy continues to apply to previously collected data).

6.3 No sale. Roper does not sell your personal information, and does not share Google or Microsoft user data with data brokers, advertisers, or AI training pipelines. Optional Data Co-op sharing of contact-validation signals (never mailbox data) is described in the Terms of Service and is off by default.

7.1 Retention. We retain your information for as long as your account is active or as needed to provide the Service. OAuth tokens are deleted when you disconnect an email account or delete your Roper account.

7.2 Deletion. When your account is terminated, Customer Data is available for export for 30 days (as described in the Terms of Service), after which we delete it from active systems, subject to routine backup cycles and legal retention requirements. You may request deletion of your account and associated data — including stored Gmail/Outlook reply data — at any time by emailing support@useroper.com. We honor verified deletion requests within 30 days.

We use commercially reasonable technical and organizational safeguards: all data is encrypted in transit (TLS) and at rest by our infrastructure providers, Customer Data is logically isolated per user/organization using database row-level security, OAuth tokens are stored server-side and never exposed to the browser, and access to production systems is restricted. No system is perfectly secure; please use a strong, unique password and keep your credentials safe.

Depending on where you live (e.g., under GDPR, UK GDPR, or CCPA/CPRA), you may have rights to access, correct, export, delete, or restrict processing of your personal information, and to object to certain processing. To exercise any of these rights, email support@useroper.com. We will verify your request and respond within the timeframe required by applicable law. We do not discriminate against you for exercising your rights.

If you are a prospect or lead whose information was imported into Roper by one of our customers, please direct requests to that customer (the data controller); we will assist them in honoring your request.

The Service is for business use by adults. It is not directed at children under 18, and we do not knowingly collect personal information from children.

We may update this policy from time to time. For material changes we will provide notice by email or in-app notice at least 15 days in advance and update the “Last Updated” date above. Continued use of the Service after the effective date constitutes acceptance.

Questions about this policy or our data practices: