Privacy Policy

1. Who we are and information we collect

Bright Shield UV is a project preparing to offer residential HVAC UV-light installation and maintenance services in North Carolina. In this policy, “we,” “us,” and “our” refer to the business operating under the Bright Shield UV name. Our Customer Service Team handles privacy questions at brightshielduv@gmail.com.

If you contact us by email, we receive your email address and the information you choose to provide, and use it to respond to your inquiry. When the planned commercial services become available, information provided for estimates, bookings, installations, maintenance, warranties, claims, or support may include your name, phone number, email address, installation address and ZIP code, selected services and prices, appointment date and arrival window, necessary installation notes, service history, communications, and consent records. We may also process technical information needed to operate and protect the website, such as IP addresses, browser and device information, and request logs. Analytics and advertising measurement are addressed separately in Section 7.

2. How we use information

For the current informational website, we use information to respond to inquiries and support website operation and security. For the planned commercial services, we intend to use information as needed to prepare estimates; arrange installations through the website or through Amy and a secure booking form; confirm, manage, or cancel appointments; provide installation and maintenance services; handle warranties, claims, and customer support; and maintain the installation history needed for an ongoing service relationship and future UV-bulb replacements. Information may also support website operation, improvements to the customer experience, security, prevention of misuse or fraud, and applicable legal and tax obligations.

In the planned Amy-assisted booking flow, the conversation helps identify the requested service and appointment time. The customer enters booking contact details and the installation address in the form. A phone number used to deliver that form may differ from the contact number entered for the installation. An appointment is confirmed only when the booking system confirms it, not merely because a form was sent or submitted.

When services launch, we may also use email for service communications. Promotional emails about new products or services are planned only with the appropriate consent and an unsubscribe option. This policy does not announce an active promotional email campaign. Unsubscribing from promotional email does not itself cancel a service appointment or request deletion of customer records.

3. Planned text messages and your choices

This informational website does not initiate text messages. The booking and maintenance messaging arrangements below describe planned services, not an active booking feature of this site.

Bright Shield UV does not use SMS for advertising. Providing a phone number does not automatically authorize text messages.

Under the approved launch flow, Amy will ask for verbal permission for three booking-related messages: a link to the form, a confirmation after the appointment is confirmed, and a reminder approximately 24 hours before installation. That permission will be recorded for the authorized number. Website bookings will retain a separate operational-text consent choice. If the form lists a different contact number, permission for the original number does not automatically apply to that other number. The three-message permission flow must be in place before it is used with customers.

You can decline or withdraw permission for booking confirmation and reminder texts without canceling an already confirmed appointment. Amy’s form delivery requires permission to send the initial text; customers who do not want that text will be able to use the separate website booking option once it is available. A failed or undelivered text does not cancel a confirmed appointment. Message timing depends on the appointment and delivery conditions, and message and data rates may apply.

Reply STOP to opt out of texts, or contact our Customer Service Team for help or other applicable opt-out requests. Reply HELP for messaging assistance. We respect applicable messaging opt-outs. Opting out of messages is separate from canceling an appointment or requesting deletion of personal information.

Under the planned booking service, appointment confirmations will include a secure management link. Cancellation will be available through that link up to 12 hours before the start of the arrival window, using Eastern time. Sending CANCEL by text does not complete an appointment cancellation. If you cannot access the link, contact the Customer Service Team.

After launch, we plan to offer future maintenance, UV-bulb replacement, and periodic service reminders by SMS. The installation receipt will provide a specific, optional written authorization for these messages, separate from the signature accepting completed work. Booking-message consent will not be treated as permission for this later program. The replacement-reminder system is not yet operational and will not be presented as an active service before it is implemented.

4. Amy, call recordings, and transcripts

Amy is the automated virtual assistant intended to help answer calls and arrange bookings when the integrated booking service launches; Amy is not a human representative. This informational website does not start calls or recordings. Depending on the services enabled, Vapi and its associated telephone, voice, and transcription providers may process call audio, conversation content, call-related information, and transcripts to operate the assistant.

The approved plan is to provide a recording notice at the beginning of the call and obtain any consent required before recording. Audio recordings are intended for quality review and handling claims. Conversation transcripts are intended to support customer-service review, including analysis with locally operated AI to improve the customer experience. This planned local analysis does not mean that the live call and transcription services operate entirely on local equipment.

Planned retention is 12 months for audio recordings and 30 days for transcripts, except when a pending claim or an applicable legal obligation requires longer retention. Access is intended to be restricted to authorized administration. These planned retention periods and access limits will apply when the recording service launches. Recording, storage, and deletion controls must support them before that service is offered; this policy does not represent them as active controls on this informational website.

5. Storage and service providers

The prelaunch site is prepared for static hosting on Cloudflare Pages. When serving the site, the hosting provider may process technical request information, including IP addresses, to deliver and protect it. Email inquiries are processed through Gmail. The booking integrations described below are being prepared for later use; this informational site does not connect visitors to them. Local or simulated development does not mean a live customer integration is available. Providing information to a supplier for an operational purpose is different from giving it to another business for its own marketing.

Cloudflare D1: D1 is planned as the primary database for customer information, contact details and addresses, bookings and installations, services and prices, consent records, necessary operational records, and maintenance history as that functionality is introduced.

Google Calendar: The planned integration uses OAuth authorization from the business’s Google account to check availability and create, read, update, and cancel installation events in its designated calendar. Customers will not be asked to authorize access to their own Google calendars. Availability and event information will be used to coordinate appointments, avoid scheduling conflicts, and keep booking records consistent. The prelaunch website itself does not read or write calendar events.

The intended customer-event fields are the customer’s name, appointment date and arrival window, selected service, installation address, and an internal booking reference. This is the planned launch configuration, not a statement that the development integration already enforces that limit. Phone numbers, email addresses, prices, and consent records are intended for the primary booking database rather than customer calendar entries. The data sent to Calendar must match this description before live customer scheduling begins. Relevant contact information may still be processed by messaging and other providers for the purposes described here.

Google stores the calendar events in the authorized account. The booking backend is intended to process availability and event identifiers and retain the related booking and synchronization records. Access to Google account data is limited to the scheduling purposes described above; it is not used for advertising. The account holder can revoke the integration’s Google access through their Google Account permissions. Revocation stops future authorized access but does not itself delete existing calendar events or previously stored booking records. Requests concerning those records can be sent to our privacy contact; retention and deletion are described in Sections 8 and 12.

Cloudflare R2: Private storage in R2 is planned for Amy’s audio recordings. This planned recording storage is not a feature of the current informational website.

Twilio: Twilio is the planned provider for booking messages and related telephone services when those functions are enabled. Messaging involves processing recipient numbers, message content, replies, and delivery information. A message may contain a link to the booking form or appointment-management page.

Vapi and associated providers: Vapi and its associated providers are intended to support the automated assistant, voice processing, and transcription described in Section 4. Email and analytics providers may process information when their services are activated. Each future service will be enabled only with data practices consistent with this policy; no particular storage region or certification is represented here.

We may also disclose information when reasonably necessary to comply with applicable law, respond to lawful requests, handle claims, or protect lawful rights and security.

6. No sale or independent third-party marketing

Bright Shield UV does not sell personal information or sell, rent, or share customer contact lists with third parties for their own advertising or independent commercial campaigns. Operational processing by the service providers described above does not authorize those providers to use our contact lists for their own marketing. The planned advertising-measurement tools in Section 7 require a separate review of their actual data sharing and settings before activation so that their use remains consistent with this policy.

7. Functional storage, cookies, and planned analytics

The current informational pages do not include analytics or advertising scripts, booking forms, or application code that stores booking data in your browser. The future booking website is intended to use browser session storage to keep forms and booking requests consistent, remember messaging choices during a session, and maintain access to a request or appointment-management page. Pending form information may be stored temporarily in the browser to allow a safe retry. Restricting browser storage may affect these functions. A booking hold or an expiring access link is not a promise that all related records are deleted when it expires.

We plan to use tools such as Google Analytics 4 and Meta Pixel to measure website traffic, conversions, and advertising results. These tools may use cookies or similar technologies and process technical identifiers and website interactions, depending on their configuration. They are planned tools; this policy does not claim that they are currently installed or active.

Before enabling tracking, we will review the data sent to each provider, applicable notices and consent requirements, opt-out choices, and controls for changing preferences. Where consent is required, the relevant tracking must wait for that consent. Provider settings and data sharing must also be consistent with our policy against sharing information for third parties’ independent marketing. Browser cookie controls are available, but do not replace any consent or privacy controls required for the tools we enable.

8. Retention and customer history

We retain inquiry information as needed to respond and follow up, subject to applicable obligations. When commercial services launch, we intend to retain the information needed to maintain the service relationship, installation and maintenance history, warranties, claims, and future replacements, subject to appropriate retention limits and applicable legal and tax obligations. Retention depends on the type of information, its operational purpose, and any unresolved claim or legal requirement. Different record categories may require different retention periods.

The approved planned periods for Amy are 12 months for audio and 30 days for transcripts, with the exceptions described in Section 4. The recording service will require storage and provider settings that support those limits before launch. Other records and provider copies will be subject to the retention purposes above; backup and provider deletion processes may take additional time. We do not promise that every copy can be removed immediately when a request is received.

9. Security and access

The current informational website has no customer booking account or payment form. For the planned booking service, safeguards include protected management links, authorization checks, and protection of stored customer information. These planned safeguards do not imply that a production booking system is already operating.

The approved access model limits administrative access to customer data to the person responsible for Bright Shield UV. An installation technician will receive only the information needed to perform the service, without administrative access to D1 or direct access to Google Calendar. Production access controls and the handling of recordings must be verified before launch.

We aim to use reasonable administrative, technical, and organizational safeguards appropriate to the information we handle. No Internet transmission or electronic storage system can be guaranteed completely secure.

10. Children

The website is not directed to children under 13, and Bright Shield UV does not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact our Customer Service Team so we can address the matter appropriately.

11. Third-party websites and services

Links to third-party websites may be provided for convenience. Those sites have their own privacy practices for information they collect directly. Integrated service providers also process information as described in Section 5; a link to a provider’s policy does not replace our explanation of how we use that provider. Please review relevant third-party policies when using their services.

12. Privacy requests and contact

Contact the Bright Shield UV Customer Service Team at brightshielduv@gmail.com with privacy questions or requests to access, correct, or delete personal information where applicable. We may need to verify your request before acting on it. Some records may need to be retained for legal or tax obligations, pending claims, or other legitimate retention needs.

Canceling an appointment changes the service booking. Unsubscribing from SMS or promotional email changes communication preferences. Requesting deletion concerns personal information. These are separate actions, and one does not automatically carry out the others. Deletion requests will be reviewed with the relevant business records, providers, and backup arrangements in mind; we do not promise immediate removal of every record or copy.

13. Changes to this policy

We may update this policy as services, technologies, contact details, or applicable requirements change. The effective or last-updated date will identify the applicable published version. If a future corporate privacy email replaces the current address, the published contact information will be updated. Material changes to data practices will be accompanied by any notices or renewed consent required for those changes.