Privacy Policy

1. Who We Are

CallBack HVAC ("we," "us," or "our") is a call-outcome and lead-follow-up SaaS platform built for HVAC businesses. We help HVAC companies track supported call outcomes and, after express one-text consent, send a service-request message through a configured provider. Our contact email is hello@callbackhvac.com.

2. Information We Collect

From HVAC company accounts (B2B customers):

• Email address and password (via Supabase Auth)
• Company name and business phone number
• Notification email address
• Twilio credentials (Account SID and Auth Token — encrypted at rest using AES-256-GCM)
• Business hours settings and auto-text message templates

From callers (end consumers):

• Phone number (from the incoming call)
• Call timestamp and outcome (missed, answered, or abandoned)
• SMS replies sent to the HVAC company's number

3. How We Use Your Information

• To route inbound calls to the HVAC company's forwarding number
• To send a consented service-request text after a supported call outcome when provider and account readiness checks pass
• To populate the HVAC company's lead dashboard
• To track SMS reply threads between the HVAC company and callers
• To process subscription billing via Stripe
• To send account-related notifications to the HVAC company

4. SMS Data and Third-Party Sharing

Mobile opt-in data, SMS consent, and phone numbers collected through the CallBack HVAC SMS program are not shared with third parties or affiliates for marketing or promotional purposes.

We use Twilio to send and receive SMS messages on behalf of HVAC companies. Twilio's privacy policy governs their handling of message data. We do not sell caller phone numbers or SMS content to any third party.

5. Caller Opt-Out

Callers can opt out at any time by replying STOP. A START message does not by itself authorize a new service-request text unless provider opt-in state and fresh message-specific consent are verified. For help, reply HELP or email hello@callbackhvac.com.

Local suppression records are retained while the caller remains opted out. A verified provider START event may remove the matching company-specific suppression row, but it does not authorize a new service-request text without fresh message-specific consent.

6. Data Retention

Using Delete in the dashboard soft-archives an individual lead; it does not erase the record. Lead, message, consent, opt-out, and audit evidence may be retained for operational, provider, compliance, or legal requirements. You may request account deletion by emailing hello@callbackhvac.com, subject to those required retention obligations.

7. Security

Third-party credentials (Twilio Account SID and Auth Token) are encrypted using AES-256-GCM before storage. We use Supabase for authentication with industry-standard JWT session management. We do not store plaintext passwords.

8. Cookies and Tracking Technologies

CallBack HVAC uses cookies and similar tracking technologies to operate the Service and understand how visitors use our website.

We use Google Analytics 4 (GA4) to collect aggregated, anonymized data about site usage, including pages visited, time on site, referral sources, device type, and general location (city/region level). Google Analytics uses first-party cookies (such as _ga and _ga_*) to distinguish unique visitors. This data helps us improve the Service. Google's privacy policy is available at https://policies.google.com/privacy. You can opt out of Google Analytics by installing the browser add-on at https://tools.google.com/dlpage/gaoptout.

We use PostHog on public-facing pages to understand page navigation and non-sensitive clicks. Authentication, checkout, onboarding, and private account routes are excluded from PostHog autocapture. Session replay and copied-text capture are disabled, and form values are not sent. See PostHog's privacy policy for more information.

We also use essential cookies required for authentication, session management, and Stripe payment processing. These cannot be disabled without breaking core Service functionality.

We do not sell your personal data or use cookies for third-party advertising.

You can control cookies via your browser settings. Disabling non-essential cookies will not prevent you from using the Service but may affect our ability to improve it.

9. Your Rights

You have the right to access, correct, or delete your personal information. Contact us at hello@callbackhvac.com with any requests.

10. Changes to This Policy

We may update this policy. Material changes will be communicated by email. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact

Questions? Email us at hello@callbackhvac.com.