Privacy Policy

This Privacy Policy explains how Frosty's HVAC LLC ("Frosty's HVAC," "we," "our," or "us") collects, uses, shares, and protects information across:

• our public website at frostyshvac.com
• our customer portal at portal.frostyshvac.com
• our internal operations platform at frosty-saas.vercel.app
• our mobile applications, where applicable
• our text and email communications with you

If you are a residential customer of Frosty's HVAC, this policy describes how we handle the information we collect about you when we provide HVAC services. If you are an employee, contractor, or staff member, this policy describes how we handle your work-related data.

1. Who we are and how to reach us

For privacy questions, email info@frostyshvac.com with the subject line "Privacy".

2. Information we collect

2.1 Information about customers (people who purchase HVAC services)

When you become a Frosty's HVAC customer — whether by phone, through our website contact form, by referral, or in person — we create a record that may include:

• Identifying details: first and last name, mailing address (street, city, state, ZIP), email address, phone number
• Service property details: notes about your home or the equipment we service
• Equipment information: manufacturer, model number, serial number, tonnage, installation date, refrigerant type, and photographs of equipment data tags
• Service history: every visit, diagnosis, part replaced, and recommendation we make on your equipment
• Photos and video: before-and-after photos, photos of equipment and receipts, and brief audio-video clips a technician may record during a service call to document work performed
• Frosty Club membership status: whether you are a member, your tier, and your billing date
• Communication preferences: whether you have agreed to receive transactional emails, marketing emails, or text messages, and any unsubscribe records
• Lead source: how you found us (online search, referral, prior service, etc.)
• Payment information: Stripe Customer ID and tokenized payment-method references. We do not store your full card number, CVV, or bank-account number — those are held by Stripe
• Quote interactions: when you open a quote we email you, the IP address and browser used, and how many times you've viewed it
• Digital signatures: signatures you provide on a touchscreen or mobile device when authorizing service or accepting a quote
• Home warranty information: when applicable, your warranty company, contract number, and the status of warranty claims we file on your behalf
• Customer portal data (when the portal is active): login email, hashed password (managed by our authentication provider), portal session metadata (IP address, browser, last login timestamp), self-service edits to your profile, and service requests you submit

2.2 Information about visitors to our website

If you visit frostyshvac.com without becoming a customer, we may collect basic web traffic information (IP address, browser type, pages viewed) and any information you voluntarily provide through a contact form.

2.3 Information about employees, technicians, and contractors

Staff accounts on our internal platform include name, email address, hashed password, role, phone number, employment classification (W-2 or subcontractor), pay rate, commission percentage, time-clock entries linked to specific job IDs, audit-log entries showing who changed what and when, and photos or video clips uploaded during the workflow.

2.4 Information we do not collect

We do not collect: Social Security numbers, dates of birth, driver's-license numbers, government-issued ID numbers, full bank-account numbers, full payment-card numbers, health data, biometric data (fingerprint or face data), or any data about minors.

3. How we use information

We use the information we collect to:

• Schedule, dispatch, perform, and document HVAC services at your property
• Communicate with you about appointments, estimates, invoices, and service follow-ups
• Process payments, refunds, and Frosty Club memberships
• Generate AI-assisted drafts of customer-facing emails, quotes, and review replies — always reviewed by a human staff member before sending or posting publicly where applicable
• Train our staff and improve our service quality, using internal data only — we do not authorize external AI vendors to train on your data
• File warranty claims with home warranty companies on your behalf, when applicable
• Send marketing or follow-up emails — only if you have opted in, and you can unsubscribe at any time
• Comply with legal obligations (tax records, license requirements, lawful requests from authorities)
• Protect our staff and customers, investigate suspected fraud, and enforce our terms of service

4. Audio and video recordings inside your home

Our technicians may capture short audio-video clips during a service call to document the work performed (for example, demonstrating that a part has been replaced or showing equipment in operation). When this happens:

• You will be physically present, and the technician will inform you that recording is taking place
• Recordings are stored in our secure systems and used for service documentation, training, dispute resolution, and warranty support
• You may ask the technician to stop recording at any time
• Texas is a one-party-consent state for recording; if your service is performed outside Texas, additional consent rules may apply, and we will follow them

5. Photographs

Our technicians take photographs of HVAC equipment, data tags, receipts, and the work area before and after a service. These may incidentally include parts of your home. We retain these photos as part of your service record. We do not publish photographs of your home publicly without your written permission.

6. AI and automated processing

We use third-party artificial-intelligence services to:

• Read text from photographs of equipment data tags and receipts (Anthropic Claude Vision)
• Draft customer-facing emails, quotes, and replies to public Google reviews (Anthropic Claude)
• Generate semantic-search embeddings of internal documents, such as our standard operating procedures and pricing materials (OpenAI text-embedding model)
• Search internal knowledge documents and answer staff questions during a service call (Google Gemini and Google Vertex AI Search)

When customer data — such as a service note, equipment photo, or public review text — is sent to one of these AI services, it is processed under the contractual terms of that service. We do not authorize these vendors to use your data to train their general-purpose models. A human staff member reviews any AI-generated content before it is sent to you or posted publicly under our company name.

7. How we share information

We share information only as described below. We do not sell your personal information.

7.1 Service providers (subprocessors)

We rely on the following service providers to operate our platform. Each is bound by contractual confidentiality and data-protection obligations:

7.2 Other third parties

• Home warranty companies (e.g., American Home Shield) when you ask us to file a claim on your behalf
• Government authorities (city permitting departments, the Texas Department of Licensing and Regulation) when required to perform regulated work
• Tax and accounting professionals as required for tax compliance
• Legal authorities when required by valid legal process

7.3 Public content

When we reply to a public Google review you have left, the reply is visible publicly under our business name on Google. We do not include personal information in those replies beyond what you have already chosen to make public.

8. Mobile-app permissions

When our applications are packaged as mobile apps and installed on a device, those apps may request the following operating-system permissions:

Internal staff app (technician workflow):

• Camera — to capture before-and-after photos, scan equipment data tags, scan receipts, and record short documentation videos
• Microphone — only during a video-capture session
• Photos — to access existing photos when needed and to save captured photos to the device gallery
• Push notifications — for job dispatch, ETA pings, and team coordination

Customer app (when released):

• Push notifications — for appointment reminders and "technician en route" alerts
• Camera (optional) — only if you choose to attach a photo to a service request

We do not request access to location/GPS, contacts, microphone outside foreground video capture, biometric data, SMS messages, call logs, calendar, Bluetooth, NFC, or device sensors.

9. Cookies and similar technologies

Our applications use first-party session cookies that are necessary to keep you signed in. We do not use third-party advertising cookies or cross-site tracking cookies on our internal or customer-portal applications. Our marketing website (frostyshvac.com) may use limited analytics cookies — see that site's notice for details.

10. How long we keep information

We retain information as long as you are an active customer of Frosty's HVAC and for a reasonable period after, for these reasons:

• Financial records (invoices, payments, refunds): retained for at least seven (7) years to comply with IRS recordkeeping requirements
• Equipment and service history: retained indefinitely while we may need to support warranty or recurring service on equipment we have installed or serviced
• Marketing communication preferences: retained until you unsubscribe, then retained as a suppression record so we do not contact you again
• Audio/video clips and photos: retained on the same schedule as the corresponding service record

When you ask us to delete your data (Section 12), we honor the request for non-financial personal information and retain only what we are legally required to keep. See our Data Deletion page for the full process.

11. How we protect information

• All data in transit is encrypted using TLS
• Sensitive credentials, OAuth tokens, and API keys at rest are encrypted using AES-256-GCM
• Database access is controlled by row-level-security policies that prevent staff from seeing data outside their role
• Staff multi-factor authentication is enforced for administrative roles
• We maintain audit logs of changes to customer records and access to sensitive systems

No system is perfectly secure. If we ever experience a data incident affecting your information, we will notify you as required by Texas law and any other law that applies to you.

12. Your rights

12.1 Texas residents (Texas Data Privacy and Security Act)

If you are a Texas resident, you have the right to:

• Confirm whether we are processing your personal data and access that data
• Correct inaccurate personal data
• Delete personal data we have collected about you, subject to legal-retention requirements
• Obtain a copy of your personal data in a portable format
• Opt out of targeted advertising, the sale of personal data, and certain forms of profiling — we do not sell personal data and do not engage in those activities today, but you may exercise this right preemptively
• Appeal if we deny a request — we will respond to appeals within sixty (60) days

To exercise these rights, email info@frostyshvac.com with the subject line "Privacy Request" and describe the request. We will verify your identity before fulfilling the request, typically by confirming details we already have on file.

12.2 California residents

If you are a California resident, you have the rights described in the California Consumer Privacy Act, including the right to know, the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising. To exercise California rights, email info@frostyshvac.com with the subject line "Privacy Request — California."

12.3 All other residents

You can request access to or deletion of your personal information at any time by emailing info@frostyshvac.com.

12.4 Marketing opt-out

You can unsubscribe from marketing emails by clicking the "unsubscribe" link in any marketing email or by emailing us. Transactional emails (appointment confirmations, invoices) cannot be unsubscribed because they are required to provide the service.

13. Children's privacy

Our services are not directed to children under 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it.

14. Data outside the United States

We operate from Texas, United States. Our service providers are primarily based in the United States; some may process data in other regions under their standard data-protection terms. We do not use your personal data for purposes that require an international transfer beyond the standard operation of our service providers.

15. Changes to this policy

We may update this policy. When we do, we will update the "Last updated" date at the top. Material changes will be communicated to active customers by email at least thirty (30) days before they take effect.

16. Contact

See also our Data Deletion page.