Privacy Policy

This Privacy Policy explains how Chimney Pro ("Chimney Pro," "we," "us," or "our"), operated by St. George HVAC & Insulation of St. George, Utah, collects, uses, stores, shares, and deletes information in connection with the Chimney Pro customer relationship management (CRM) application at chimneypro.app(the "Service"). Chimney Pro helps insulation and HVAC contractors manage customers, estimates, jobs, crews, payments, scheduling, and customer communications. By using the Service you agree to this policy.

1. Information we collect

We collect the following categories of information:

• Staff account information: name, email address, role (such as Admin, Sales, or Crew), and sign-in details for people who are invited to use the Service.
• Customer and lead information: name, phone number, email address, service and job-site addresses, appointment times, notes, and service history that our staff enter or that customers submit to us, for example through our website contact form.
• Estimates, jobs, and payment records: scope of work, pricing, deposits, amounts due and paid, and payment status. We do not store full credit or debit card numbers in the Service.
• Messaging records: text messages and emails sent to or received from customers, delivery status, and SMS consent (opt-in and opt-out) status.
• Google Calendar data (only if an administrator connects a Google account; see Section 3).
• Technical information: basic server logs such as IP address, browser type, and request timestamps, used for security and troubleshooting. We do not use third-party advertising or analytics trackers in the Service.

2. How we use information

• To provide estimates, schedule and perform jobs, and invoice and record payments.
• To communicate with customers about their estimates, appointments, receipts, and service reminders by text message and email.
• To sync scheduled appointments with a Google Calendar, if connected.
• To manage staff access and keep the Service secure.
• To comply with legal, tax, and accounting obligations.

We do not sell personal information, and we do not use it for advertising.

3. Google user data

An administrator of the Service may choose to connect a Google account so that scheduled estimates and jobs appear on a dedicated Google Calendar. If connected, the Service requests the following access through Google OAuth:

• Your Google account email address and basic sign-in identity (the openid and emailscopes), to show which account is connected.
• Google Calendar access (https://www.googleapis.com/auth/calendar), to create and use a dedicated calendar named "St. George Insulation Operations," and to create, update, and delete the events that the Service itself created on that calendar. Appointment events include details such as the customer name, phone number, job-site address, service type, assigned crew, and internal job notes.

Google user data we access, and why:

• Google account email address — to show administrators which Google account is connected. Stored with the connection.
• Calendar list and the dedicated "St. George Insulation Operations" calendar — to find or create that calendar. The calendar identifier is stored.
• Events that Chimney Pro created on that calendar (title, start time, location, description) — to create, update, and remove appointment events, and to detect when a start time is changed in Google Calendar. We keep only the event identifier, version marker, and sync status.
• OAuth refresh token — to keep the connection working without asking you to sign in each time. Stored encrypted.

How we handle Google user data:

• We use Google data only to provide and improve the calendar scheduling feature described above. The Service only syncs events it created; other events in the Google account are ignored. A change to the start time of a linked event in Google Calendar updates the matching record in the CRM.
• We store a Google refresh token, encrypted, in our database so the connection keeps working, along with the connected account email, calendar identifier, and sync status. We do not store the contents of your other Google data.
• We do not sell Google user data, use it for advertising, or transfer it to third parties, except as needed to provide the feature, to comply with law, or as part of a merger or sale of our business.
• We do not allow humans to read Google user data except with your consent, for security or abuse investigation, to comply with law, or when needed to operate and support the feature.
• You can disconnect at any time by removing the connection in the Admin Panel or by revoking access at myaccount.google.com/permissions. On request, we will delete the stored token and connection record.

The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Text messages (SMS)

We send text messages to customers only if they have given consent, and each customer's consent status is recorded. Message frequency varies with the customer's appointments and open estimates. Message and data rates may apply. Customers can reply STOP at any time to opt out, or START to opt back in. We do not share mobile phone numbers or SMS consent information with third parties for their marketing purposes.

5. Service providers we share information with

We share information only with providers that help us run the Service, and only as needed for them to perform their function:

• Supabase — database and authentication hosting.
• Twilio — sending and receiving text messages.
• Resend — sending email (such as estimates and receipts).
• Google — Google Calendar, if connected.
• Cloudflare and our hosting provider — network delivery and server hosting.

We may also disclose information if required by law or to protect our rights, customers, or staff.

6. Cookies and similar technologies

Chimney Pro uses only the cookies it needs to work: secure authentication-session cookies that keep you signed in, and a short-lived security cookie used during the Google sign-in flow. We do not use advertising cookies, cross-site tracking, or third-party analytics in the Service.

7. Security

• All traffic to the Service is encrypted in transit with HTTPS.
• Access is limited by role-based permissions and database row-level security, so users only see data they are authorized to see.
• Google refresh tokens are encrypted before they are stored, and are never shown in the app or sent to the browser.
• Document links sent to customers use random, expiring tokens, and are stored only as one-way hashes.
• Administrative access to servers and databases is restricted to authorized personnel.

No system is completely secure, so we cannot guarantee absolute security. If we learn of a breach affecting your information, we will notify affected people as required by law.

8. Data retention and deletion

• Customer, estimate, job, and payment records are kept for as long as the business needs them to provide service, honor warranties, and meet tax, accounting, and legal obligations, and are deleted or anonymized afterward.
• Google data: when an administrator disconnects the Google account, or asks us to, we delete the stored refresh token, connected account email, calendar identifier, sync state, and calendar-event links from our database. Events already created in the Google Calendar remain in the Google account until you delete them there.
• Message logs (text and email) are kept with the related customer record and are deleted with it.
• Server logs are kept for a limited period for security and troubleshooting, then rotated out.
• Backups containing deleted data are overwritten in the normal backup cycle.

To request deletion of your data, including Google user data, email [email protected] with the subject "Data deletion request." We will verify the request and respond within 30 days, and delete the data unless we are legally required to keep it.

9. Your choices and rights

You may ask us to tell you what personal information we hold about you, correct it, or delete it, subject to records we must keep by law. Depending on where you live (for example, Utah or California), you may have additional privacy rights, which we honor. We do not sell or share personal information for cross-context behavioral advertising. Staff can ask an administrator to update or remove their account. Customers can opt out of text messages by replying STOP, and out of email using the contact details in the message. Administrators can disconnect Google at any time in the Admin Panel or at myaccount.google.com/permissions.

10. Where data is stored

Chimney Pro is operated from the United States, and information is stored and processed by our providers in the United States.

11. Children

The Service is for business use and is not directed to children under 13. We do not knowingly collect information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. The effective date above shows when it was last revised, and material changes will be posted on this page.

13. Contact us

Chimney Pro, operated by St. George HVAC & Insulation
St. George, Utah
Email: [email protected]
Phone: 435-817-2468
Website: saintgeorgeinsulation.com