Privacy Policy

When you use solarinstallquotes.com (the "Site") to request solar installation quotes, we collect the following categories of personal information:

Identifiers. First name, last name, email address, phone number.

Address and property information. Street, city, state/province, ZIP/postal code, derived latitude/longitude, home type, roof age, monthly electric bill, electric utility.

Consent record. The disclosure version shown to you, a SHA-256 hash of the exact disclosure text, your IP address, browser user-agent string, and the timestamp at which you submitted consent.

Attribution data. UTM parameters, the landing URL you arrived on, and the HTTP referrer (if your browser provided one).

Cookies and similar technologies. A signed HMAC session cookie that ties partial quote-request progress to your browser for 24 hours. We do not use third-party advertising cookies.

We use the information you provide to:

Match you with a solar installer. We share your details with one installer partner from our published list, selected by your address.

Respond to your quote request. We send a confirmation email and may follow up about your request.

Operate the Site. Including security, fraud prevention, anti-bot verification (Cloudflare Turnstile), aggregate analytics, and error monitoring (Sentry).

Comply with law. Including TCPA, CASL, CCPA/CPRA, PIPEDA, Quebec Law 25, and any subpoenas or court orders we are legally required to honor.

Installer partner. One matched installer from our public installer partner page. The partner is selected by your state/province at the moment you submit. We never share with more than one installer per submission.

Service providers. Cloudflare (hosting, Turnstile anti-bot, D1 database, CDN), Resend (email delivery), Twilio (SMS verification), Sentry (error monitoring), Anthropic (the AI service powering our content-research routine - never receives consumer PII). Each is bound by data-processing agreements limiting their use of your information to providing services to us.

Legal compliance. Law enforcement, courts, or regulators when required by law.

What we never do. We do not sell your information to data brokers, lead aggregators, advertising networks, or any party not listed on our installer partner page.

We retain personal information in our database (Cloudflare D1) for the following periods:

Submitted quote requests. 4 years from submission, matching the TCPA statute of limitations. Consent records (timestamp, IP, user-agent, disclosure version hash) retained the full 4 years even if you delete your contact info, per FCC consent-retention expectations.

Partial (incomplete) quote requests. 24 hours from last activity, then automatically deleted.

Server logs. 30 days, then automatically deleted.

Depending on where you live, you may have the following rights:

Right to access. Request a copy of the personal information we hold about you.

Right to correct. Ask us to fix inaccurate information.

Right to delete. Ask us to delete your information (subject to the legal retention periods above for consent records).

Right to opt out. Stop further marketing contact from us or our partners - see our Do Not Call page.

Right to portability. Receive your information in machine-readable format.

Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a valid opt-out request from sale/sharing automatically - no further action needed on your part. (Mandatory in California, Colorado, Connecticut, and others as of January 1, 2026.)

California residents have additional rights under CCPA/CPRA (as amended effective January 1, 2026) - see our California Privacy Notice.

Texas residents. Under the Texas Data Privacy and Security Act (TDPSA), you have substantially similar rights to California residents. The TDPSA applies regardless of our revenue size, so we honor TX requests on the same SLA as CA.

Residents of other US states with active privacy laws (Virginia, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Utah - 19 states total as of May 2026) have substantially similar rights under their own statutes; the rights listed above apply.

Canadian residents have rights under PIPEDA and provincial privacy laws - notably Quebec Law 25 (in full force since September 2024), which gives Quebec residents additional rights including the right to be forgotten and the right to know about automated decision-making.

To exercise any right, email privacy@solarinstallquotes.com. We respond within 30 days (45 days for CA + states matching CCPA SLA; one 45-day extension allowed if request is complex). No fee.

We encrypt data in transit (TLS 1.3) and at rest (Cloudflare D1 storage encryption). Worker-to-Worker calls use signed authentication headers. We follow standard industry practices but cannot guarantee absolute security - no system can.

Our services are not intended for individuals under 18. We do not knowingly collect information from children under 16. If we learn we have, we will delete it.

Our servers are hosted on Cloudflare's global network. If you submit information from outside the US or Canada, that information may be transferred to and processed in either country. By submitting, you consent to this transfer.

We may update this Privacy Policy from time to time. The "Effective date" at the top of this page reflects the most recent change. Material changes (e.g. expanding which partners we share with) will be communicated by email to any subscriber whose consent is on record.

Privacy Officer (Quebec Law 25 designation). Eric Bradshaw, eric@techcreationslabs.com. The Privacy Officer is the named contact for Quebec residents exercising rights under Law 25, including data-access, correction, deletion, portability, right-to-be-forgotten, and questions about automated decision-making (we use automated lead routing - see §3).

General privacy questions: privacy@solarinstallquotes.com