How we handle your information

What we collect and why

When you submit a quote request, we collect your name, phone number, optional email, ZIP code, requested service, questionnaire answers, preferred primary and secondary contact channels, and any project photos. We use these details to understand the project and follow up about the request.

We also record attribution details such as UTM source, medium, campaign, content and term, landing URL, referrer, permitted click IDs, and first- and last-touch information. The visitor IP address is used for request limiting and is recorded with the consent record; the user-agent is recorded with that record as well.

Where information is stored

The website is hosted on Vercel. Quote records are stored in Supabase Postgres in the United States, in the us-east-1 region. Project photos are stored in a private Supabase Storage bucket and are accessed through short-lived signed links; the bucket is not public.

Cloudflare provides the domain's DNS, forwards email sent to our privacy address, and stores the deletion ledger described below in Cloudflare R2 object storage. That ledger holds record identifiers, the operator who acted, a photo count, and timestamps; it does not hold names, phone numbers, or photos. Our hosting provider keeps standard server logs, including IP addresses, for a limited period as part of operating the site.

Supabase, Vercel, and Cloudflare act as service providers processing data for the site. Operators use Supabase Auth, with an httpOnly, Secure, SameSite=Lax session cookie that expires after 30 minutes of inactivity and no later than 12 hours.

Retention and deletion

Quote information, including names, phone numbers, questionnaire answers, photos, and the SMS consent record, is stored with the quote request. If you ask us to delete the request, the consent record is deleted with it. We have adopted a 24-month retention period as our policy, but automatic deletion at that point is not implemented today; records are currently deleted when a person requests deletion. A deletion process removes project photos before the related database record and records the deletion in a chained ledger outside the database.

To request a copy of your information or request deletion, email info@sunmarpro.com. Include enough information for us to identify the request. We may need to verify that the request is yours.

SMS consent

SMS consent is optional. If you check the SMS consent box, the system stores whether consent was granted, the exact text accepted, its version, the time, the visitor IP address, and the user-agent as evidence of that choice.

I agree to receive texts from SunMar Pro about my project, including estimate and scheduling follow-up. Consent is optional and is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help.

No SMS, email, or WhatsApp messages are sent today because no messaging provider is connected. The consent is still recorded and remains valid for the stated purpose; sending can begin only after a provider is connected. Phone numbers and SMS consent records are never sold, and are not shared with third parties or affiliates for their marketing or promotional purposes. When messaging is enabled, reply STOP to opt out or HELP for help. You may also contact info@sunmarpro.com with an opt-out request.

What does not happen

We do not sell your personal information. No advertising integration is active, and there is no production integration with an external calendar or AI service. The site does not send SMS, email, or WhatsApp messages today.

Cookies and browser storage

The quote flow can use sessionStorage for the in-progress estimator and attribution details. Clearly labeled demo and portal features can use localStorage and IndexedDB for sample records, drafts, settings, and preview photos. Those browser features are separate from a submitted quote: a real quote request is sent to the server and stored in Supabase. The server also uses httpOnly cookies for lead follow-up access and operator sessions.

Children

This site is intended for property owners and decision-makers and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted information, contact us and we will delete it.

Security

Quote records are protected by row-level security in the database, the application connects with a least-privilege database role, photos are in a private bucket, and operator access requires a login. No system is perfectly secure. If a security incident affects your personal information, we will notify you as required by the Florida Information Protection Act (section 501.171, Florida Statutes) and other applicable law.

Changes to this policy

When the way the site works changes, this page changes with it, and the “Last updated” date above is revised. Material changes that affect information already collected will be described on this page.

Contact

Privacy questions, copy requests, deletion requests, and SMS opt-outs: info@sunmarpro.com. Mail: SunMar Group LLC, 1711 Amazing Way, Ste 213, Ocoee, FL 34761.