Roots Privacy Policy
See also: Terms of Service · GLBA Privacy Notice
1. Introduction and Scope
This Privacy Policy ("Policy") is issued by Wealth Building Technologies, LLC, doing business as Roots ("Roots," "we," "us," or "our"). Securities are offered by a separate entity, Roots Real Estate Investment Community I, LLC (the "Issuer"); see Section 2 for more information.
This Policy explains how Roots collects, uses, shares, and protects personal information. As used in this Policy and in our Terms of Service:
the "Platform" means our websites (including www.investwithroots.com and www.rentwithroots.com, and any other site that posts this Policy (the "Websites")), our mobile applications (the "Apps"), and the underlying technology through which we deliver the Services; and
the "Services" (or "Service") means the products, features, and functionality Roots makes available to you through the Platform, including access to invest, the Roots Growth rewards program, and rent reporting.
This Policy applies when you use the Platform, engage with the Services, or otherwise interact with us directly or indirectly. It also applies to personal information we may collect from job applicants.
2. Financial-Privacy Laws and the GLBA/CFIPA Exemption
The Platform is used to open and service investments offered by the Issuer. To open and service an investment account, the Issuer collects financial information such as your Social Security Number, bank account and financial information, income, net worth, accreditation status, and transaction history (collectively, "nonpublic personal information" or "NPI").
To the extent the Issuer is a "financial institution" subject to the federal Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations (such as the SEC's Regulation S-P) and the California Financial Information Privacy Act ("CFIPA"), NPI is collected, used, and shared in accordance with the Issuer's GLBA financial privacy notice, and that information may be exempt from the CCPA/CPRA and similar state consumer-privacy laws. In that case, the consumer-privacy rights described in Section 9 would not apply to that exempt investor financial information.
In all events, we handle investor financial information consistent with applicable law.
The Issuer's GLBA financial privacy notice is available at investwithroots.com/legal/glba-notice, and you can request a copy at any time using the contact details in Section 15.
3. Personal Information We Collect
Depending on how you use the Platform and Services, we may collect the following categories of personal information.
Identifiers — name, email address, postal address, phone number, date of birth, account identifiers, and online identifiers (such as device IDs and a unique analytics identifier).
Financial information / NPI (financial information collected on behalf of the Issuer; see Section 2 regarding GLBA/CFIPA and Regulation S-P) — Social Security Number or other tax identifier, bank account and routing information, linked-bank credentials and tokens, income, source of income, net worth, home-ownership and employment status, accreditation status, beneficiary information, and investment and transaction history.
Commercial information — products and services purchased or considered, including subscriptions, rewards points, and reward redemptions.
Internet and network activity — pages viewed, features used, time spent, referring/exit pages, clicks, and other usage and interaction data, including information captured by cookies, pixels, and session-replay technologies.
Device and connection data — IP address, browser and operating-system type, device identifiers, and related technical data, including data used for fraud scoring.
Geolocation data — approximate location derived from IP address, and (in our mobile apps) device location where you permit it.
Authentication and security data — login activity, sign-in method (password, magic link, Google sign-in), two-factor verification data, and login/session logs (including IP, device, and approximate geo-location for fraud prevention).
Audio, electronic, visual, or similar information — audio recordings of customer or support calls.
Professional or employment-related information — including business contact information and education or employment history collected from job applicants.
Sensitive personal information — Social Security Number and financial-account information, and precise login/geolocation data. We use sensitive personal information only to provide the Platform and the Services, verify identity, prevent fraud, and meet legal obligations — not to infer characteristics about an individual.
User contributions and communications — content you post and your communications with our support team.
Inferences — limited inferences we draw from the above (for example, eligibility or engagement signals).
4. How We Collect Personal Information
We collect personal information: (a) directly from you when you use the Platform or Services, such as when you create an account, invest, link a bank account, complete a challenge, contact support, or apply for a job; (b) automatically through cookies, pixels, web beacons, SDKs, session-replay tools, and server logs; and (c) from third parties, such as identity-verification, bank-linking, fraud-prevention, analytics providers, and any linked accounts you may use to access our services such as your Google account.
5. How We Use Personal Information
We use personal information to:
create and manage your account and process investments and transactions;
verify your identity and prevent fraud and other prohibited activity (KYC/AML);
operate the Roots Growth program, including issuing and tracking Points and Rewards, and processing redemptions;
provide the rent-reporting and credit-building features you sign up for;
comply with tax (IRS), securities, and other legal and regulatory requirements;
send account notices, investment information, and (where permitted) marketing communications and surveys; measure, analyze, and improve the Platform and Services, including through analytics and A/B testing;
protect the security and integrity of the Platform and Services and our users;
establish, exercise, or defend legal claims, and respond to legal process;
maintain accurate business, accounting, and audit records;
evaluate job applicants for employment; and
otherwise as described to you at the point of collection or with your consent.
We may also combine, aggregate, or anonymize personal information in such a way that you may not reasonably be re-identified, and may use such anonymized information for any purpose permitted by law. In that case, we commit not to attempt to re-identify the information.
6. How We Share Personal Information
We share personal information with the categories of recipients below, for the business purposes described. We list representative service providers for transparency and illustration; they are subject to change.
Service providers, such as:
Payments and banking — to process payments, transfers, and bank linking: Plaid, Dwolla, and Stripe.
Identity verification, KYC, and e-signature — to verify identity, screen for compliance, and execute documents: Dropbox Sign and our identity-verification and document providers.
Communications — to send email, SMS, and push notifications: SendGrid, Twilio, and OneSignal.
Customer support — to operate support and messaging: Intercom and Zendesk.
Rent reporting and credit building — to report rent payments to credit bureaus so you can build credit if you opt-in to the service: Array (self-reported rent reporting that you can opt into) and Boompay (which we use to report rent payments on behalf of Roots residents if you opt-in).
Analytics and advertising — to measure usage, diagnose errors, run experiments, record sessions, and deliver and measure advertising: Amplitude, PostHog (including session replay), Mouseflow (session replay), Google Tag Manager (which may load Google Analytics, Google Ads, and the Meta/Facebook pixel), HubSpot, and Optimizely. Some of this activity may be considered a "sale" or "sharing" of personal information under state privacy laws, because these third parties may use the personal information they collect not only to provide analytics and advertising services to Roots but also for their own purposes — see Sections 8 and
Affiliates — entities under common control with us, including the Issuer, for the purposes described in this Policy.
Legal, safety, and compliance — law enforcement, regulators, and others where required by law or to protect against fraud, harm, or illegal activity.
Corporate transactions — in connection with a merger, acquisition, financing, bankruptcy, or sale of assets, including related diligence.
Consent — otherwise, with your consent.
7. Cookies, Pixels, and Session-Replay Technology
We, and third parties acting on our behalf, use tracking technologies such as cookies, local storage, web beacons/pixels, SDKs, and session-replay technologies (which can record page interactions such as clicks, scrolling, and form activity) to operate the Platform, remember your preferences, measure performance, run experiments, prevent fraud, and support advertising and attribution. We mask or suppress sensitive fields in session-replay recordings where feasible.
We may use some or all of the following types of cookies:
Strictly Necessary cookies. Required for the operation of the Platform; these cannot be turned off.
Functional cookies. These provide enhanced functionality and personalization.
Performance and analytics cookies. Set by us or by third-party partners to count visits and traffic sources so we can measure and improve performance, and to understand which pages are most and least popular and how visitors move around the Platform.
Targeting and advertising cookies. Set by us or by our third-party advertising partners. They are used to track your online activity and deliver personalized advertisements, and may be used by third parties to build a profile of your interests and show you relevant ads on other sites. These cookies may make advertising more relevant, limit how often you see an ad, and help measure campaign effectiveness, including across devices and over time.
You can control many of these technologies through your browser and device settings (for example, blocking cookies, limiting your mobile advertising identifier, or using privacy browser extensions), and through the opt-out choices described in Section 9. Some features may not function properly if you disable certain technologies. You can opt out of Google Analytics by downloading Google's Opt-Out Browser Add-on, and you can opt out of personalized advertising by Google at https://adssettings.google.com.
8. "Sale" and "Sharing" of Personal Information
Some U.S. state privacy laws define a "sale" of personal information broadly (any disclosure for valuable consideration) and define "sharing" to include disclosing personal information for cross-context behavioral (targeted) advertising. Because we use third-party analytics and advertising technologies (see Sections 6 and 7), our use of those technologies may be considered a "sale" or "sharing" of certain identifiers, commercial information, and internet-activity data under these laws. Depending on your state of residency, you may have the right to control the “sale” or “sharing” of your personal information using the choices described in Section 9.
We do not knowingly sell or share the personal information of anyone we know to be under 16.
9. Your Privacy Rights and Choices
The rights in this Section 9 apply only to the extent your personal information is not exempt from the applicable comprehensive privacy law pursuant to a GLBA exemption (see Section 2) or otherwise. To the extent permitted by law, we reserve the right to decline to honor a request.
9.1 California Residents (CCPA/CPRA) — Opt-In Approach
Subject to the GLBA/CFIPA exemption (see Section 2), California residents have the right to: know/access the categories and specific pieces of personal information we have collected, the categories of sources, the categories of personal information sold, shared, or disclosed and the purpose, and the categories of third parties to whom personal information has been sold, shared, or disclosed; obtain a portable copy of your personal information; delete personal information; correct inaccurate personal information; opt out of profiling and automated decision-making; opt out of the sale/sharing of personal information; limit the use of sensitive personal information; and not be discriminated against for exercising these rights.
California's "Shine the Light" law also permits California-resident users of our Websites to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes.
For California residents, we apply an opt-in approach to the sale/sharing of personal information for cross-context behavioral advertising: third-party analytics and advertising-related sharing is off by default, and we enable it only where you have affirmatively opted in. (Note: the in-product opt-in control is being implemented; until it is live, you may exercise this choice using the contact methods below, and we honor opt-out preference signals as described in Section 9.3.)
9.2 Residents of Other U.S. States — Opt-Out Approach
Subject to the GLBA exemption (see Section 2), if you are a resident of another U.S. state with a comprehensive privacy law (for example, Virginia, Colorado, Connecticut, Texas, and others), you may have the right to access, correct, delete, and obtain a portable copy of your personal information; to obtain a list of third parties to whom your personal information has been disclosed; to withdraw consent to processing of sensitive personal information; to opt out of profiling and automated decision-making; to opt out of targeted advertising and the sale of personal information; and to appeal our response to a request, including to your state Attorney General.
For Platform visitors that are not based in California, third-party analytics and advertising-related sharing is on by default, and you may opt out at any time through our cookie preference center (once available) or, where applicable, by enabling a recognized opt-out preference signal (Section 9.3).
9.3 Global Privacy Control and Do Not Track
Where required by law, we honor the Global Privacy Control (GPC) and similar browser-based opt-out preference signals as a valid request to opt out of sale/sharing for the browser or device that sends the signal. Your request may apply only to the browser from which you submit it. Because no common "Do Not Track" standard exists, we do not respond to DNT signals.
9.4 GLBA/CFIPA Financial-Privacy Choices
To the extent NPI is governed by GLBA/CFIPA (Section 2), your choices regarding sharing with affiliates and nonaffiliated third parties are described in the Issuer's GLBA financial privacy notice, which controls for that information. Note that the consumer rights choices set forth in this Policy may not apply to NPI.
9.5 Marketing Choices
You can opt out of marketing emails using the unsubscribe link in those emails or by contacting us. You can opt out of marketing SMS/text messages by replying STOP or by contacting us. You may not be able to opt out of transactional or legally required communications about your account or investments.
9.6 Financial Incentives
Through Roots Growth and related programs, we may offer rewards, Points, discounts, or other benefits in exchange for, or in connection with, the collection or use of certain personal information — for example, rewards for opting into SMS/text messages, for referring others, or for completing surveys. Under the CCPA and other state privacy laws, these may be considered "financial incentives" or the like.
Participation is entirely voluntary and requires your opt-in. You may withdraw at any time using the methods in Sections 9.5 and 9.7; withdrawing may end your eligibility for the associated reward as described in our Terms of Service. The material terms of each offer are presented when it is made available to you. Any difference in the price, rate, or benefit you receive is reasonably related to the value of your personal information to us, which we estimate in good faith based on the expense we incur in providing the offer.
9.7 How to Exercise Your Rights
Because Roots operates exclusively online, you may exercise your privacy rights and choices, in addition to the methods described above, by contacting us at support@investwithroots.com or using the details in Section 15. For certain requests, we will verify your identity (and residency) before acting, and we will respond within the timeframe required by law (generally 45 days, extendable as permitted). You may use an authorized agent to submit a request as permitted by law. We will not discriminate against you for exercising your privacy rights.
Note: Even after a deletion request, we may retain and continue to use information as described in Section 10 (Data Retention) — including, without limitation, information we are required or permitted to keep for tax, securities, KYC/AML, fraud-prevention, legal-claim, accounting, audit, or backup purposes.
10. Data Retention and Security
We retain the personal information described in this Policy for as long as needed to satisfy the purposes for which it was originally collected or for which there is a legitimate business purpose as set forth in this Policy. We determine the retention period for each category of personal information based on: (i) the length of time we need to retain the information to achieve the business or commercial purpose for which it was obtained, (ii) any legal or regulatory requirements applicable to such information, (iii) internal operational needs, and (iv) the need for the information based on any actual or anticipated investigation or litigation.
We employ commercially reasonable administrative, technical, and physical safeguards designed to protect the security of personal information. Sensitive data, including Social Security Numbers and bank-account information and linked-account tokens, is encrypted at rest. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
11. Children's Privacy
The Platform and Services are intended for adults 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 18, and we will delete such information if we discover it.
12. International Users
We operate in the United States. By using the Platform or Services, you acknowledge and agree that your personal information may be transferred, stored, and/or processed by us or our service providers in a country other than your country of residence, including the United States, where laws regarding the processing of personal information may be less stringent than those of your country of residence.
13. Third-Party Websites
The Platform may contain links to other websites. This Policy does not apply to third-party websites, and you should review the privacy policy and terms of any website you visit to determine how that operator handles personal information collected through its website.
14. Changes to This Policy
We may update this Policy from time to time. Changes are effective when posted, and the "Last Updated" date above reflects the most recent revision. Where required by law, we will provide additional notice of material changes.
15. Contact Us
Wealth Building Technologies, LLC d/b/a Roots Email: support@investwithroots.com or invest@investwithroots.com Phone: 404-965-4162
