Privacy Policy

Effective: June 7, 2026 · Last updated: August 6, 2026

This policy explains what Heather Window & Door does with your information when you use this website (www.heatherwindowanddoor.com), submit a form, or call us. It covers every page on the site, including the landing pages we run for our ads.

We are a garage door, window and door service company based in Coppell, TX. We work at your address across the Dallas–Fort Worth area, including Dallas, Collin, Denton, Ellis, Kaufman, Rockwall and Tarrant Counties. We are a mobile service business, so we do not publish a street location and we do not receive customers at our office. You can reach us at contactus@heatherwindowanddoor.com or at (469) 281-7750.

We have written this in plain English and made it specific to what this website actually does. Where our practice is imperfect, we say so rather than describing something better that we have not built.

1. What we collect

Information you give us

Our forms ask for what we need to call you back and get a technician to the right door. Only three things are required: your name, your phone number, and the service you need. You also have to tick the box giving us permission to contact you.

Everything else is optional. Depending on the form, you may also give us:

• Your service address — street, apartment or unit, city, state, ZIP.
• Your email address, if you would like a confirmation.
• A description of the problem — what is happening, how urgent it is, and any notes you type in the message box.
• Details about the door or opener — door type, number of doors, approximate size, brand, and where you are in the project.
• Timing — a preferred date or time window.
• A company or property name, for commercial requests.
• A note that you would prefer a text first.

Photos you upload

Some of our forms let you attach up to three photos of the door or the problem (JPEG, PNG, WebP or HEIC, up to 8 MB each). This is entirely optional and it helps us bring the right parts. Photos are checked to confirm they really are images, then sent straight to our team's inbox as email attachments. They are never saved on our web server. They live in our email, where they stay until that mail is deleted.

Information we record when you submit a form

When a form is submitted, our server records alongside it:

• The IP address your request came from.
• Your browser and device description (the user agent string).
• The page you submitted from and the site or ad that referred you.
• A timestamp.
• A record of the permission you gave — which box you ticked, the version of the wording shown to you, and the time and IP address at the moment you agreed. We keep this because federal calling rules require us to be able to prove consent.
• A spam score from Google reCAPTCHA (see Section 5).

Information collected automatically as you browse

Subject to the cookie settings in Section 4, this site records how it is being used: pages viewed, how far you scroll, which buttons and phone links you click, how far you get through a form (the name of the field you are in — never what you typed), page speed measurements, JavaScript errors, the site that referred you, your approximate location derived from your IP address, and your device and browser. If you use the ZIP coverage checker, the ZIP you type is included in that on-page event stream.

Advertising click identifiers (the hwd_attr cookie)

We advertise on Google and Microsoft. When you arrive from an ad, the link carries identifiers that tell us which ad you clicked. Our site stores them in a first-party cookie called hwd_attr for 90 days, and attaches them to your request if you later submit a form.

That cookie can hold up to 19 values, including Google click IDs (gclid, gbraid, wbraid), the Microsoft click ID (msclkid), a Facebook click ID (fbclid), standard campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content), and Microsoft campaign details — including the search phrase you typed that made our ad appear and a Microsoft location identifier for the city you searched from. Each value is capped at 300 characters. Arriving from a new ad clears the whole set and replaces it.

Two things you should know. First, this cookie is written when the page loads, before you interact with the cookie banner, and it is written whether or not you accept cookies — it is our own cookie, set by our own site, and it is not currently wired to the banner. Second, we use these identifiers to report completed requests back to Google Ads and Microsoft Advertising, so those platforms can tell which ads produced real work. If you do not want that, see Section 4 and Section 8.

Analytics and session replay

Subject to the settings described in Section 4, we use:

• Google Analytics 4 — page views, events, device and browser, approximate location from IP, referrer, and Google's own analytics IDs stored in cookies beginning _ga.
• Microsoft Clarity — session recording and heatmaps. This one deserves a plain description: Clarity records a playback of your visit — mouse movement, taps, clicks, scrolling, rage and dead clicks, your screen size, the content of the pages as they appeared to you, and any script errors. Members of our team watch these recordings to find where the site is confusing. Clarity masks what you type into form fields by default, so your name, phone number and address are not shown in the playback, but everything else on screen is. Recordings sit in our Microsoft Clarity project and expire on Clarity's own schedule. We do not download or keep copies of them.
• Microsoft Advertising (UET) — page loads and completed requests, so ad conversions can be counted. Microsoft's own "Insights" profiling feature is switched off on our tag.

What we do not collect

We do not ask for and do not want your Social Security number, driver's license, bank or card details, health information, or anything about your race, religion, politics, sexual orientation or immigration status. We do not read your device's precise location. We do not use dynamic call-tracking numbers that assign a different phone number to each visitor: we publish two real business lines and the site simply shows the advertising line to visitors who arrived from an ad. See Section 5 for what that does and does not mean.

2. Why we collect it

• To call you back. Your name and number are the whole point of the form.
• To schedule the assessment. Your address and preferred timing let us book a technician.
• To arrive prepared. Your description, door details and photos tell us what to bring.
• To produce your written estimate and, once you approve it, to carry out and invoice the work.
• To send you service messages — confirmations, scheduling changes, and information about the work.
• To keep spam and abuse out. reCAPTCHA scoring, a hidden bot trap and per-IP rate limits stop automated submissions from flooding our inbox.
• To prove consent if there is ever a dispute about whether we were allowed to call or text you.
• To measure our advertising — which campaigns and search terms actually produce genuine requests.
• To improve the website — analytics and session recordings show us where people get stuck.

We do not use your information to make automated decisions that have a legal or similarly significant effect on you. We do not build advertising profiles about you beyond the ad measurement described above.

3. Permission to call and text you (TCPA)

Every one of our forms has a required checkbox that reads:

OK to call or text me about this request. Heather Window & Door may use autodialed or pre-recorded calls/texts at this number. Consent isn't required to purchase. Msg & data rates may apply; reply STOP to opt out.

Here is exactly what that means:

• What you are authorizing: calls and text messages from us to the number you gave, about the service request you just submitted — including calls placed by an automatic dialing system or using a pre-recorded voice.
• It is not a condition of purchase. You never have to agree to automated calls or texts to buy anything from us. If you would rather not tick it, call us instead and we will take everything over the phone.
• Message and data rates. Your carrier may charge you for texts and data. That is between you and your carrier.
• How to stop texts: reply STOP to any text.
• How to stop calls: tell whoever you are speaking to, or email contactus@heatherwindowanddoor.com. We will stop.
• What we record: the fact that you ticked the box, the version of the wording you saw, and the time and IP address when you did. If you ticked "Text me first," we record that preference too.

Withdrawing permission does not stop us from contacting you about work already in progress — if a technician is scheduled, we will still need to reach you about the appointment.

4. Cookies, analytics and your choices

The categories

• Necessary — needed for the site to work and stay secure. This includes the security and performance handling done by our content delivery network, the spam protection on our forms, and a short-lived cookie (hwd_lead_confirmed, 5 minutes) that confirms a form really was submitted so we do not double-count it. These cannot be switched off.
• Analytics — Google Analytics 4 and Microsoft Clarity, including session replay.
• Advertising — Microsoft Advertising conversion measurement, and the advertising storage that Google's tools use.
• Our own attribution cookie — hwd_attr, described in Section 1. This one is not currently controlled by the banner.

What happens by default

Our banner behaves differently depending on where you are, because the rules do:

• In Texas: analytics — Google Analytics and Microsoft Clarity, including session recording — runs by default. Advertising storage stays off unless you press "Accept all."
• Everywhere else: both analytics and advertising stay off until you press "Accept all."

So if you are a Texas visitor and you do nothing, your visit is being measured and may be recorded by Clarity in full. That starts before you touch the banner. If that is not what you want, choose Necessary only — a choice to decline always overrides the Texas default, on that visit and on later ones.

Before you decide either way, analytics scripts may already be loading in a privacy-limited mode that sends cookieless measurement signals. We also record aggregate Accept and Necessary-only selections so we can tell how the banner performs. That is a count of choices and nothing more — it is never treated as a marketing conversion, and it is not attached to your service request.

What "Necessary only" actually turns off

Choosing "Necessary only" stops Google Analytics from storing analytics cookies, stops Clarity from recording your session in full, and keeps advertising storage off. Google's and Microsoft's tags may still receive a signal that a page loaded, in a limited, cookie-less form, and Google's ad tools redact data in that state. Your service request, if you submit one, is completely unaffected — the form works exactly the same either way.

Changing your mind

Your choice is stored on your own device and remembered on later visits. To change it:

• Use the Cookie Settings button in the footer of any page on this site. That reopens the banner. It is in the footer of our ad landing pages (addresses starting with /lp/) as well, so you can change your choice without leaving the page you arrived on.
• Clearing cookies and site data for this website in your browser resets everything, including hwd_attr, and the banner will ask again.

If you want the ad cookie gone

hwd_attr is set by our own site as soon as a page loads, so declining cookies does not currently remove it. To get rid of it, clear this site's cookies in your browser, or block cookies for this site. You can also email us and ask us to opt you out of advertising measurement, and we will remove the ad identifiers from your record and exclude your request from conversion reporting.

Universal opt-out signals and Global Privacy Control

Texas law requires businesses that use personal data for targeted advertising to honor a recognized universal opt-out signal, such as Global Privacy Control (GPC). On this site, advertising storage is off by default for every visitor and turns on only if you press "Accept all" — so if you never press it, there is nothing for GPC to switch off. Our website does not currently detect the GPC signal automatically. If you have pressed "Accept all" and later turn GPC on, that signal alone will not change your setting — choose "Necessary only," or email us and we will record the opt-out against your details.

What is stored on your device

• hwd_attr — cookie, advertising click identifiers, 90 days.
• hwd_lead_confirmed — cookie, a random one-time token confirming a submission, 5 minutes.
• cc — local storage, your cookie choice ("granted" or "denied"), kept until you clear site data.
• hwd_lead_draft — session storage, a copy of what you typed into a form so it is not lost if the submission is rejected. It includes your name, phone, email, address and message. It never leaves your device, and it is erased when you close the tab or when your request goes through.
• hwd_lead_fired, hwd_paid_phone — session storage, small flags that prevent double-counting a submission and remember which of our two phone lines to show. Erased when you close the tab.
• Google Analytics cookies beginning _ga, plus Clarity and reCAPTCHA cookies, set by those providers when they are active.

5. Who receives your information

The list below is every outside party this website actually sends data to, described by what it does for us.

• Our web hosting provider — stores the website files and the backup copy of requests described in Section 6.
• Our content delivery and security network (Cloudflare) — every request to this site passes through it, including form submissions. It sees the request, your IP address and the content you submit, and it filters attacks before they reach us.
• Our email delivery provider (SMTP2GO) — sends the notification email that carries your complete request, including any photos you attached, to our team's inbox, and sends your confirmation email if you gave us an address. Our lead inbox is also accessible to the contractor that builds and maintains this website and our lead-handling systems on our behalf.
• Google reCAPTCHA — scores form submissions to block bots. It loads when you first touch a form field, observes how you interact with the page, sets its own cookies on google.com, and receives your IP address from our server when we verify your submission.
• Google's address lookup service (Places) — powers the suggestions in the service address field. As you type, from the third character onwards, what you have typed so far is sent to Google. That happens before you submit anything, and it happens whether or not you pick a suggestion. If you would rather your address never touched Google, give it to us over the phone instead.
• Google Maps — draws the service-area maps on some pages. It loads when a map is about to come into view and receives your IP address and browser details.
• Google Tag Manager — loads our measurement tags. It runs on production pages and sees the page address, your IP and your browser.
• Google Analytics 4 — website measurement, subject to Section 4. Our Analytics property is linked to our Google Ads account with personalized advertising features enabled.
• Microsoft Clarity — session recording and heatmaps, subject to Section 4.
• Microsoft Advertising — counts conversions from our ads, subject to Section 4.

We do not currently send requests to an outside CRM system. The capability exists in our software but it is switched off; if we turn it on, we will update this policy first.

About our phone lines. We publish two real business lines and show the advertising line to visitors who arrived from an ad, so we can tell which advertising is working. It is a fixed pair of numbers swapped by source — not a per-visitor number pool, and it does not identify individual callers. Calls are answered by our team or by the answering service that takes calls for us. This website does not record or transcribe calls.

Beyond the list above, we may share information with our professional advisors (such as an attorney or accountant), with authorities when the law requires it, and with a buyer if the business is ever sold — in which case we would tell you.

6. How long we keep it

Here is exactly what happens to a request after you press submit:

• A backup row is written to a file on our hosting server, in a folder that is not reachable from the web, before anything else happens. It contains your name, phone, email, service, urgency, message, address, preferred timing, the source and referrer, your consent record, your IP address, your browser description, and the ad identifiers, including the search phrase if you came from a Microsoft ad. We do not currently run an automatic deletion schedule for this file, so those rows remain until we remove them. We would rather tell you that than quote a retention period we do not enforce. If you ask us to delete your information, we remove your rows from it.
• An email goes to our team inbox with the full request and any photos attached. That mail stays in the mailbox until it is deleted. Photos exist only there — they are never written to our server.
• A confirmation email goes to you, if you gave us an address and our notification went through.
• Your IP address is hashed and stored for one hour by the rate limiter that stops repeated automated submissions, then discarded.
• Anonymous counters — how many submissions succeeded or were rejected, and why — are kept for 31 days and automatically pruned. They contain no personal information.
• Google Analytics keeps event and user data for 14 months, reset by new activity.
• Microsoft Clarity recordings expire on the schedule set in our Clarity project. We keep no copies.
• The hwd_attr cookie expires after 90 days on your device, or sooner if you clear cookies.

We also keep ordinary business records — estimates, invoices, warranty records — for as long as we need them to honor our written warranty terms and to meet our tax and accounting obligations.

7. How we protect it

• The whole site runs over HTTPS, so what you type is encrypted in transit.
• Form submissions are accepted only from our own domain, and are filtered by reCAPTCHA, a hidden bot trap and per-IP rate limits.
• The backup file of requests sits outside the public web folder, and the server is configured to refuse to serve it even if it is misplaced.
• Uploaded photos are validated as real images before they are accepted, and file names are stripped of anything unusual.
• Access to our lead inbox and admin systems is limited to the people who need it.

No website or email system is perfectly secure, and we cannot promise absolute security. If we ever discover a breach affecting your information, we will notify you as the law requires.

8. Your privacy rights in Texas

If you are a Texas resident, the Texas Data Privacy and Security Act (TDPSA) gives you the right to:

• Know and access — confirm whether we are processing your personal data and get a copy of it.
• Correct — fix anything inaccurate, taking into account why we hold it.
• Delete — have us delete personal data you gave us or that we obtained about you.
• Take it with you — receive a copy in a portable, readable format, where we hold it electronically.
• Opt out of targeted advertising, of the sale of personal data, and of profiling used for decisions with legal or similarly significant effects.

On selling and targeted advertising: we do not sell your personal information for money. We do attach advertising click identifiers to requests and report completed requests back to Google and Microsoft so we can measure our ads. Texas law may treat that as targeted advertising, so we treat it as opt-out-able: tell us and we will stop including your data in it.

How to exercise your rights

Email contactus@heatherwindowanddoor.com with the subject line "Privacy Request", or call us at (469) 281-7750. Tell us which right you want to use and give us enough detail — normally the phone number and name you used — for us to find your record. We may ask a question or two to confirm it is really you; if we genuinely cannot verify you, we will tell you why. You may use an authorized agent to submit an opt-out request on your behalf.

Our response window: we will respond within 45 days. If a request is genuinely complicated, we may take one additional 45 days, and we will tell you before the first 45 days are up. Requests are free twice in any 12-month period.

If we decline — the appeal

If we decline your request, we will tell you why. You then have the right to appeal. Email contactus@heatherwindowanddoor.com with the subject line "Privacy Appeal" within a reasonable time. We will review it and give you a written answer, with our reasoning, within 60 days. If we still decline, we will give you a way to complain to the Texas Attorney General, who accepts consumer complaints at texasattorneygeneral.gov.

9. Visitors from outside Texas

We serve the Dallas–Fort Worth area, so nearly everyone who contacts us is in Texas. If you live in another US state with its own privacy law, send us the same kind of request described above and we will handle it the same way, to the extent that law applies to us. If you are visiting from outside the United States, note that our website, our email and our measurement providers operate in the United States, and your information will be handled there.

10. Children's privacy

This site is for homeowners and businesses arranging garage door, window and door work. It is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has given us information, email contactus@heatherwindowanddoor.com and we will delete it.

11. Other sites we link to

Some pages link out to manufacturer sites, review platforms and other third parties. Once you leave our site, their privacy practices apply, not ours.

12. Changes to this policy

We will update this page when what we do changes — for example, if we connect a CRM, change how the cookie banner treats our attribution cookie, or add automatic deletion of the request backup. The "Last updated" date at the top always reflects the current version. For changes that materially affect you, we will flag it on the site.

13. Contact us

• Email: contactus@heatherwindowanddoor.com
• Phone: (469) 281-7750. Calls are answered 24/7.
• Business: Heather Window & Door, Coppell, TX. We are a mobile service business serving Dallas, Collin, Denton, Ellis, Kaufman, Rockwall and Tarrant Counties. We do not operate a showroom or take walk-ins. If you need to send us something in writing, email us and we will arrange it.

This policy describes our actual practices in good faith and reflects requirements we believe apply under current US privacy laws, including the TDPSA. It has not been reviewed by an attorney and it is not legal advice.