What we collect, and what we do with it.What we collect, and what we do with it.

When you ask for a quote

The quote form asks for your name and phone number, and optionally your ZIP code, the kind of floor you want, a description of the space, a message, and a photo. We store this so we can call you back and prepare a quote. The lead is saved before any email is sent, so a mail problem never loses your request.

We also record which page of our site the request came from and, if you arrived from an advert or a link with tracking tags, the campaign named in that link. This tells us which of our pages and adverts are worth keeping. It is not used to identify you beyond the request itself.

If you ask for a quote through one of our forms on Facebook or Instagram, Meta passes us what you entered there (your name, phone number, email address and ZIP code, and your answers about the space and timing) along with which of our adverts you came from. We treat it exactly like a request made on our site. We text you only if you ticked the box agreeing to texts on that form.

Photos

A photo you attach to a quote is used only to prepare that quote. It is stored privately, is not published anywhere, and is viewed only by the people quoting and installing your floor.

The floor visualizer

The visualizer’s sample rooms run entirely in your browser and send us nothing. If you upload a photo of your own room, it is stored privately so the visualizer can measure it and so you can come back to it. Uploaded rooms are deleted automatically after 30 days unless you go on to request a quote on that room, in which case it is kept for a year alongside the quote so our installer can look at it.

A shared visualizer link is created only when you choose to share, and it makes a still image of your room visible to anyone who has the link. You can ask us to revoke a shared link at any time.

Measuring our adverts

We advertise on Google and on Facebook and Instagram, and our site carries the Google Ads tag and the Meta Pixel so we can tell which adverts lead to a request for a quote. They tell Google and Meta that a page was viewed, that a quote request or booking went through, or that a phone or text link was tapped. They do not send your name, phone number, email address or anything else you type into a form. Both set cookies in your browser, and Google and Meta may connect what they receive to an account you hold with them, under their own privacy policies. You can turn off ad personalisation in your Google and Meta account settings, and blocking third-party cookies or using a content blocker stops both.

We also use Google Analytics to see how people find and use the site: which pages are visited, where visitors came from (for example a Google search), roughly where they are, what kind of device they use, and which buttons and links they use, such as a phone link or the floor visualizer. It sets its own cookies and does not receive your name, phone number, email address or anything you type into a form. Google’s opt-out browser add-on, blocking cookies, or a content blocker stops it.

Our own systems also tell Google and Meta when an advert led to a quote request, a booked estimate or a job. For Google, that is the code Google added to the link you clicked, with the date and the value of the job, and nothing about you. For Meta, it is a scrambled (hashed) copy of the email address and phone number you gave us, which Meta can match to its own users but cannot turn back into your details, sent with the same kind of information; if you filled in a form on Facebook or Instagram, it is the reference number Meta gave that form. We do this so we can tell which adverts bring real customers, and we send nothing else. Our reporting system also reads our own advertising accounts at Google and Meta for what our adverts cost and how often they were shown and clicked; that information is about our adverts, not about you.

What we don’t do

We don’t sell or rent your details, and apart from the scrambled email address and phone number described above, we don’t share what you type into a form with any advertiser. Our own site analytics count visits and measure how fast pages load without cookies or identifiers.

When you call or text us

Our phone number is run through a business phone service, Quo. It keeps the record of calls and text messages to and from that number so that whoever picks up next can see what was already said. If we don’t answer, the call is passed to an automated assistant, Retell, that can answer questions and book an estimate.

The assistant tells you at the start of the call that the call is recorded, and it records, transcribes and summarises the calls it handles. Calls answered by a person are not recorded. We keep the recording, the transcript and the summary so we can quote accurately and settle any question about what was agreed.

If you have agreed to text messages, you can stop them at any time by replying STOP, and that reply switches them off for you straight away. Agreeing to texts is never a condition of getting a quote.

Where it lives

Our site and its storage run on Cloudflare. Quote notifications are sent to us by email through Resend. Our phone number, its texts and its call records run through Quo, and calls the automated assistant answers are handled by Retell. Appointments are kept on Google Calendar, as described above. To sort the calls and texts that come in (a request for a quote from a sales call, for example), their transcripts and summaries are read by an automated classification service, TypeSafe, reached through Cloudflare, which does not keep them after answering. When we reply to a text, our team can have a draft of the reply written by Anthropic’s Claude, also reached through Cloudflare; it is given your first name, the job you asked about and your recent messages, and a person reads every draft before anything is sent. All of them act only on our instructions. When you upload a room to the visualizer, the photo is analysed by a machine-learning service to find the floor; the photo is sent for that analysis and not kept by that service beyond it.

Google account data

Our internal business system (Concept Floor CRM) connects to Google accounts that belong to our business, for two purposes and nothing else. It does not ask for, and cannot reach, email, contacts, Drive or anything else in those accounts.

Google Calendar. We use the calendar to check when our estimators are free, to add and remove the estimate appointments you book with us, and to keep two appointment calendars, one per estimator, in step with our own records.

Google Ads. We connect our own Google Ads account, with Google’s Google Ads permission, to read what our adverts cost and how often they were shown, clicked and led to a call or quote request, and to tell Google Ads when a click on one of our adverts became a quote request, a booked estimate or a job (the click code Google added to the link, the date and the value of the job, and nothing about you). We use this only to report on and improve our own advertising. We do not change campaigns, budgets or billing through this connection.

Customers never sign in with Google, and we never access a customer’s Google account.

We do not sell, rent or trade Google user data, we do not use it for advertising, and we do not transfer or disclose it to anyone. The one exception is Cloudflare, which hosts our systems and stores the data only on our instructions. It is never used to train machine-learning models, and no person reads it except our own staff when scheduling or reviewing our advertising. We would share it only if required by law. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

The tokens Google issues to us are stored encrypted at rest in our private database. They are never sent to a web browser and are used only by our server. Only signed-in staff can reach the scheduling system, and only an owner can connect or disconnect the calendar or the Google Ads account. Access can be revoked at any time from the Google account’s security settings. Disconnecting either connection in our system deletes its stored tokens immediately.

How we protect it

Everything you send us travels over encrypted HTTPS connections, and it is encrypted at rest where it is stored. Photos, call recordings and quote details are stored privately and are never published. Our internal systems sit behind a sign-in that only our own staff can pass, and each service we use gets only the access it needs to do its job. Secrets such as API keys are kept out of our code and out of anything a browser can see. We keep data only as long as the next section says, and we delete it when you ask.

How long we keep it

Quote requests are kept for as long as we might reasonably need to serve you, including any warranty period on work we do. Call recordings and transcripts are kept for a year. Uploaded visualizer rooms follow the 30-day and one-year rules above. Anonymous site events are kept for reporting.

Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email info@conceptfloorandepoxy.com or call (619) 514-3107 and we’ll do it promptly. If you are a California resident, these are your rights under the CCPA and CPRA, and we honour them for everyone.

Changes

If this page changes in a way that matters, the date at the top changes with it.

Back to the home page