CCPA / CPRA · 2026 amendments · Legal
California Privacy Notice (CCPA / CPRA)
Specific rights and disclosures for California residents under the CCPA / CPRA as amended effective January 1, 2026. We honor the same SLA for residents of all 19 US states with active comprehensive privacy laws, plus Texas (which has no revenue threshold).
Effective: May 27, 2026 Version: v2-2026-05 Applies to: California residents (and operationally: all US states with active privacy laws)
In plain language
- You have the right to know, delete, correct, opt out of sharing, and limit use of sensitive data.
- We do not sell personal information to data brokers.
- We share contact info with one installer partner per request - you may opt out via the link in the footer.
- We honor Global Privacy Control (GPC) signals automatically. If your browser sends GPC, we treat that as your opt-out.
- Requests honored within 45 days, no fee.
↳ The plain-language summary is not a substitute for the full
document below. If they conflict, the full document controls.
1. Categories of personal information collected
In the past 12 months, we have collected the following categories of personal information from California residents:
Identifiers. Name, email, phone, IP address.
Customer records. Address, electric utility, monthly bill.
Internet activity. UTM parameters, landing URL, browser user-agent.
Geolocation. Approximate location derived from your provided address (not precise GPS).
Inferences. Estimated home characteristics for installer matching (e.g., predicted system size based on bill + roof age + state averages).
2. Sources of personal information
Directly from you - when you submit the quote-request form.
From your browser - IP address, user-agent, referrer, Global Privacy Control signal (if your browser sends one).
From service providers - Cloudflare Turnstile (anti-bot verification only; no PII shared).
3. Purposes of collection
Matching you with a solar installer in your area.
Sending you confirmation and follow-up communications.
Complying with TCPA, CASL, CCPA/CPRA, and other applicable laws.
Detecting and preventing fraud and abuse.
Automated decision-making. We use simple deterministic routing rules (coverage check + daily cap check) to choose which installer partner receives your lead. We do not use machine-learning scoring, opaque algorithms, or any decisioning that materially affects your access to credit, housing, insurance, or employment.
4. Sale, sharing, and disclosure
"Sale" under CCPA. When you submit a quote request, your personal information is shared with one installer partner who pays us a per-lead referral fee. The CPPA treats this exchange-for-value as a "sale." You have the right to opt out - see §7.
"Sharing" under CPRA. Sharing in the CPRA sense means cross-context behavioral advertising (e.g., passing your data to ad networks for retargeting). We do not share for that purpose. We do not run ad campaigns, do not use ad-network pixels, do not maintain ad-targeting profiles.
Sensitive personal information. We do not collect SSN, driver's license, financial account numbers, precise geolocation, racial/ethnic data, religious beliefs, biometric identifiers, health information, or sexual orientation. The right-to-limit-use-of-sensitive-PI therefore does not apply to us.
5. Your California rights (CCPA / CPRA)
Right to know what personal information we have collected, used, disclosed, or sold/shared.
Right to delete personal information (subject to legal retention - see Privacy Policy §4).
Right to correct inaccurate personal information.
Right to opt out of sale/sharing. Use the "Do Not Sell or Share My Personal Information" link in our footer, or send a GPC signal from your browser. Either method is honored within 15 business days.
Right to non-discrimination for exercising any of these rights.
Right to limit use of sensitive personal information (not applicable - we do not collect any).
Children under 16. Sale or sharing of PI of consumers under 16 requires opt-in consent. Children under 13 require verified parental consent. We do not knowingly process PI of children under 16.
6. Global Privacy Control (GPC) - mandatory 2026
As of January 1, 2026, California (and Colorado, Connecticut, and others) require us to honor browser-issued GPC signals as a valid opt-out from sale and sharing.
What this means for you: if you visit our Site with a GPC-enabled browser (Firefox, Brave, certain extensions for Chrome/Safari/Edge), your visit is automatically treated as an opt-out request. You do not need to take any further action.
When you opt out via GPC, we display an "opt-out request honored" indicator and your details are flagged in our database to prevent future sale/sharing. Existing inquiries you submitted before the GPC signal was sent are NOT automatically un-routed - to delete those, use the deletion request process.
Important. Closing a cookie banner is NOT consent to sale or sharing. Per the 2026 CPPA amendments, that pattern is explicitly classified as a dark pattern and is invalid.
7. "Do Not Sell or Share My Personal Information"
You may opt out of the sale or sharing of your personal information at any time by:
1. Using the "Do Not Sell or Share" link in our footer (or your browser's GPC signal - see §6).
2. Emailing privacy@solarinstallquotes.com with subject "Do Not Sell or Share."
3. Calling our toll-free DNC line: {TODO-LEGAL: 888 number TBD}.
Honor SLA: within 15 business days for sale/sharing opt-outs; 45 days for access/deletion/correction requests (one 45-day extension allowed if request is complex).
No fee, no retaliation. Exercising any right does not affect the quality of service you receive.
8. How to exercise your rights (access / delete / correct)
Email: privacy@solarinstallquotes.com. Include the email + phone you used to submit your quote request so we can verify your identity.
Toll-free phone: {TODO-LEGAL: 888 number TBD - CCPA requires either a toll-free phone OR an interactive web form. If web-form-only, link the form here.}
Authorized agents. You may use an authorized agent. We require a written authorization signed by you. The agent must also verify their identity. We may contact you to confirm the authorization is genuine.
Verification. For deletion requests, we verify your identity to a "reasonable degree of certainty" via the email + phone on file. For sensitive requests we may ask for additional verification.
9. Risk assessment
{TODO-LEGAL: Operator action - under the Jan 1, 2026 CCPA amendments, processing activities started on or after that date require a documented risk assessment. Lead routing started before Jan 1, 2026 so this section is informational; if processing materially changes (new partner classes, AI-driven scoring, new data categories), assess and document before launch.}
We have documented the data flows and privacy controls for our lead-routing process. The risk assessment covers: PI categories collected, processing purposes, third-party sharing (single installer partner), security safeguards (TLS 1.3, D1 encryption-at-rest, signed Worker auth), retention periods, and the rights exercise process described above.
10. Contact
TechCreationsLabs LLC Privacy Office
Privacy Officer: Eric Bradshaw
Email: privacy@solarinstallquotes.com
Mail: {TODO-LEGAL: California-designated address required for CCPA contact}
Last updated May 27, 2026
· version v2-2026-05
Questions? privacy@solarinstallquotes.com