Privacy Policy | SLC Heating & Air Conditioning

Privacy Policy

Effective Date: January 1, 2026
Last Updated: April 15, 2026

Salt Lake City Heating & Air Conditioning (“we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and what rights you have over your data. It applies to information collected through our website at https://saltlakecityheatingairconditioning.xyz/, through phone calls to (385) 300-1867, in-person at our Winchester Street office, and during in-home service visits across Salt Lake County and the Wasatch Front.

This policy is designed to comply with applicable U.S. privacy regulations, including the Utah Consumer Privacy Act (UCPA), the California Consumer Privacy Act (CCPA) for any California-resident customers, the California Online Privacy Protection Act (CalOPPA), and where relevant, the EU General Data Protection Regulation (GDPR) for EU residents.

1. Information We Collect

1.1 Information You Provide Directly

Contact information:
Name, mailing address, service address (if different), email address, phone number(s), preferred contact method, preferred contact times.
Service request information:
Equipment make, model, and approximate age; reported symptoms or service needs; existing warranty information; previous contractor information (if relevant); preferred appointment scheduling.
Property information for load calculations:
Square footage; year built; insulation levels (if known); window type and U-factor (if known); number of occupants; primary fuel source for heating; existing duct configuration.
Financial information:
For payment processing: credit card information (processed through PCI-DSS Level 1 compliant payment processors — we do not store full card numbers on our systems). For financing applications: information shared with Synchrony Bank, Mountain America Credit Union, or Acuity Capital is governed by their respective privacy policies; we do not retain credit application details after processing.
Service history:
Records of past service visits, equipment installed, warranty registrations, permit numbers from local AHJs (Salt Lake City Building Services, Murray Building Department, etc.), inspection results, technician notes.
Communications:
Email correspondence; SMS messages (if you opt in to appointment reminders); voicemail recordings (retained 30 days for quality assurance); written reviews and testimonials submitted directly to us.

1.2 Information Collected Automatically

Website analytics:
IP address; browser type and version; operating system; pages visited; referring URL; time spent on each page; date and time of visit. Collected via Google Analytics 4 (GA4) with IP anonymization enabled.
Cookies and similar technologies:
Strictly necessary cookies for site functionality; analytics cookies (Google Analytics); marketing cookies (Meta Pixel, Google Ads conversion tracking) only when you grant consent via the cookie banner on first visit.
Device information:
Device type, screen resolution, language preference. Used to optimize site display.

1.3 Information From Third Parties

Lead generation platforms:
If you submitted a request through Google Local Services Ads, Angi (formerly Angie’s List), HomeAdvisor, Thumbtack, or Yelp Request a Quote, that platform shares your contact information and service request details with us.
Online review platforms:
Publicly-posted reviews on Google Business Profile, Yelp, Facebook, Nextdoor, and BBB are accessible to us as part of standard reputation management.
Public records:
For commercial property assessments and historic-district projects, we access publicly available building permit history, parcel data, and historic preservation records through municipal databases (slc.gov, sandyut.gov, ogdencity.com, etc.).

2. How We Use Your Information

  1. To provide HVAC services — scheduling appointments, completing installations and repairs, processing payments, fulfilling warranty obligations, filing permit applications with local AHJs.
  2. To communicate with you — sending appointment confirmations, service reminders (every 6 months by default), invoices, rebate paperwork status updates, follow-up satisfaction surveys.
  3. To process rebate and tax credit paperwork on your behalf — Rocky Mountain Power Wattsmart, Dominion Energy ThermWise, federal IRA 25C tax credit documentation.
  4. To register equipment warranties — submitting manufacturer warranty registrations within 72 hours of commissioning (Carrier, Trane, Lennox, Bryant, Goodman, Mitsubishi Electric, Daikin, Bosch, Rheem, Viessmann, etc.).
  5. To respond to emergency service requests — 24/7 dispatch routing based on service address.
  6. To process financing applications — sharing required information with Synchrony Bank, Mountain America Credit Union, or Acuity Capital when you apply.
  7. To improve our services — analyzing aggregated service patterns, common failure modes, geographic dispatch efficiency.
  8. To comply with legal obligations — maintaining records required by the Utah Division of Occupational and Professional Licensing (DOPL), EPA Section 608 refrigerant handling records, IRS requirements for businesses, state and federal employment law.
  9. For marketing — sending occasional emails about seasonal maintenance reminders, rebate program changes, or new service offerings. You can opt out at any time via the unsubscribe link in any marketing email or by emailing info@saltlakecityheatingairconditioning.xyz with “unsubscribe” in the subject line.

3. Information We Do NOT Collect

For transparency, we do not collect:

  • Social Security numbers (unless required by a specific lender for financing — in which case it goes directly to the lender, not to us)
  • Driver’s license numbers
  • Biometric data
  • Health information
  • Precise geolocation tracking from your device
  • Information about household members other than the primary account holder

4. How We Share Your Information

We share your information only as necessary to provide services or comply with legal obligations. Specifically:

Equipment manufacturers:
For warranty registration, we share your name, service address, equipment model and serial number, and installation date with the manufacturer (Carrier, Trane, Lennox, Rheem, Bryant, Goodman, American Standard, Mitsubishi Electric, Daikin, Bosch, etc.).
Municipal building departments (AHJs):
For permit applications and inspections, we file required information with the relevant Authority Having Jurisdiction — Salt Lake City Building Services, Murray Building Department, West Valley City, Sandy, Draper, Holladay, Millcreek, South Jordan, Riverton, Cottonwood Heights, Ogden City Building Services. Permit records are public.
Utility companies:
For rebate applications: Rocky Mountain Power (Wattsmart program) and Dominion Energy (ThermWise program) receive your service address, equipment installed, AHRI certificate, and contractor information.
Financing partners:
If you apply for financing, we share necessary information (your contact details, scope of work, equipment to be financed, total project cost) with the lender you choose: Synchrony Bank, Mountain America Credit Union, or Acuity Capital. We do not access or store the credit application details beyond what’s required to coordinate with the lender.
Payment processors:
Credit card transactions are processed through Stripe and Square — both PCI-DSS Level 1 certified. We receive transaction confirmations but do not store full card numbers.
Service providers (limited):
Cloud hosting (Amazon Web Services), email/communication (Google Workspace, Twilio for SMS), CRM/scheduling (ServiceTitan), accounting (QuickBooks Online). Each is bound by data processing agreements that prohibit secondary use of customer data.
Legal compliance:
We will disclose information if required by valid legal process: subpoena, court order, government investigation. We will notify you of such disclosure unless prohibited by law.
We do NOT sell or rent your personal information to data brokers, advertisers, or any other third party for their independent marketing purposes.

5. Data Retention

Active customer records:
Retained for the duration of the active customer relationship plus seven years after the last service visit, in compliance with Utah business record retention requirements and IRS guidelines.
Warranty registration records:
Retained for the full warranty period (typically 10 years for equipment parts; 20 years for some heat exchangers) plus three years after warranty expiration.
Permit and inspection records:
Retained indefinitely for installations, as required by Utah DOPL contractor record-keeping requirements and to support future service or sale of the property.
EPA Section 608 refrigerant records:
Retained for three years from the date of service, as required by 40 CFR Part 82 Subpart F.
Voicemail and call recordings:
30 days from date of call, then automatically deleted.
Website analytics data:
26 months (Google Analytics 4 default retention).
Email marketing list:
Until you unsubscribe, then retained on a suppression list to honor your opt-out preference indefinitely.

6. How We Protect Your Information

  • Encryption in transit: All data submitted through our website uses TLS 1.3 encryption (HTTPS). Email correspondence with our office uses TLS encryption where supported by your email provider.
  • Encryption at rest: Customer records stored in our CRM and accounting systems are encrypted using AES-256 at the database level.
  • Access controls: Customer data is accessible only to authorized employees who need it to perform their job functions. Access logs are retained for 12 months.
  • Authentication: Multi-factor authentication required for all employee access to systems containing customer data.
  • Payment security: All payment card data is processed by PCI-DSS Level 1 certified processors. We never see or store full card numbers on our systems.
  • Employee training: All staff complete annual privacy and data security training. Field technicians are specifically trained on protecting customer information collected during in-home visits.
  • Physical security: Our Winchester Street office is secured with electronic access control. Paper records (such as printed permits and inspection reports) are stored in locked filing cabinets and shredded after seven years per retention policy.
  • Incident response: If we experience a data breach affecting customer information, we will notify affected individuals within 45 days as required by Utah Code § 13-44-202 and applicable federal law. Notification includes a description of what happened, what information was involved, and what steps you can take to protect yourself.

7. Your Privacy Rights

7.1 Utah Consumer Privacy Act (UCPA) Rights — for Utah residents

Effective December 31, 2023, Utah residents have the following rights under the UCPA:

  • Right to access: Request a copy of the personal information we have about you.
  • Right to delete: Request deletion of your personal information (subject to legal retention requirements outlined in Section 5).
  • Right to portability: Receive your personal information in a readable, transferable format.
  • Right to opt out of targeted advertising: Opt out of having your data used for targeted advertising. We do not currently engage in targeted advertising as defined by UCPA, but we honor opt-out requests prospectively.

7.2 California Consumer Privacy Act (CCPA) Rights — for California residents

If you are a California resident, you have additional rights under the CCPA:

  • Right to know categories and specific pieces of personal information collected, sources, and purposes.
  • Right to delete personal information (subject to legal retention exceptions).
  • Right to correct inaccurate personal information.
  • Right to opt out of sale or sharing of personal information — though we do not sell personal information.
  • Right to non-discrimination for exercising your CCPA rights.
  • Right to limit use of sensitive personal information — though we do not use sensitive personal information for purposes beyond providing services.

7.3 How to Exercise Your Rights

To submit a privacy rights request, contact us by any of these methods:

We will respond within 45 days of receiving a verifiable request, with one possible 45-day extension if necessary. For requests involving deletion or access to personal information, we will verify your identity before responding — typically by requesting two pieces of information that match our records.

8. Children’s Privacy

Our services are directed to homeowners and businesses, not children. We do not knowingly collect personal information from individuals under 13 years of age. If we discover we have inadvertently collected information from a child under 13, we will delete it promptly. Parents or guardians who believe their child has provided information to us should contact privacy@saltlakecityheatingairconditioning.xyz.

9. Cookies and Tracking Technologies

9.1 Categories of Cookies Used

Strictly necessary cookies:
Required for the site to function (session tokens, form submissions). Cannot be disabled.
Performance and analytics cookies:
Google Analytics 4 with IP anonymization, used to understand site traffic patterns. Disabled until you grant consent via the cookie banner.
Marketing and advertising cookies:
Meta Pixel (Facebook/Instagram), Google Ads conversion tracking, Microsoft Advertising UET. Disabled until consent. Used for retargeting and conversion measurement.

9.2 Managing Cookie Preferences

You can manage cookie preferences via the cookie banner on your first visit or by clicking “Cookie Preferences” in the footer of any page. Most web browsers also allow you to control cookies through their settings — consult your browser’s documentation for instructions.

9.3 Do Not Track

Our website honors Do Not Track (DNT) browser signals as required by the California Online Privacy Protection Act (CalOPPA). When DNT is enabled, we will not enable analytics or marketing cookies regardless of cookie banner consent.

10. Third-Party Links

Our website contains links to third-party websites (manufacturer pages, financing applications, utility rebate portals, etc.). We are not responsible for the privacy practices of those websites. Review their privacy policies before submitting any personal information through those links.

11. International Data Transfers

Salt Lake City Heating & Air Conditioning operates exclusively in the United States. Customer data is stored on U.S.-based servers (Amazon Web Services US-West-2, Oregon region). We do not transfer data internationally except in the limited case where a manufacturer’s warranty registration system is hosted outside the U.S. In those cases, the manufacturer is responsible for compliance with applicable cross-border data transfer requirements.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will notify you by:

  • Posting the updated policy at this URL with a new “Last Updated” date at the top
  • Emailing active customers within 30 days of material changes (such as a change in how we share data)
  • Displaying a notice on the homepage for 30 days following a material change

Your continued use of our services after the effective date of an updated policy constitutes acceptance of the changes.

13. Frequently Asked Questions About Our Privacy Practices

Do you sell my information to other contractors or marketers?
No. We do not sell, rent, or trade your personal information for marketing purposes. We share information only as outlined in Section 4 of this policy: with equipment manufacturers for warranty registration, with municipal AHJs for permits, with utility companies for rebates, with financing partners if you apply, with PCI-DSS compliant payment processors, and with limited service providers under data processing agreements that prohibit secondary use.
How long do you keep my information?
Active customer records are retained for seven years after the last service visit. Permit and warranty records are retained longer (warranty period plus three years; permits indefinitely). EPA Section 608 refrigerant records are retained three years per federal regulation. Voicemails are deleted after 30 days. Marketing email list members are retained until they unsubscribe, then placed on a permanent suppression list to honor the opt-out preference.
What happens if I’m a California resident?
California residents have additional rights under the CCPA outlined in Section 7.2 above, including the right to know, delete, correct, and opt out of sale or sharing. Submit California-specific requests to privacy@saltlakecityheatingairconditioning.xyz with “California Privacy Request” in the subject line. We respond within 45 days.
How do I opt out of marketing emails?
Click “Unsubscribe” at the bottom of any marketing email. Alternatively, email privacy@saltlakecityheatingairconditioning.xyz with “Unsubscribe” in the subject line. Opt-out processing is typically immediate; you may receive emails sent prior to your unsubscribe for up to 24 hours due to email-system queueing. Service emails (appointment confirmations, invoices, warranty notifications) are operational communications and continue regardless of marketing opt-out.
Can I request a copy of all the information you have about me?
Yes. Submit a written request to privacy@saltlakecityheatingairconditioning.xyz with “Data Access Request” in the subject line. Include your full name, service address(es), and approximate date(s) of service so we can locate your records. We respond within 45 days with a portable copy of your data in PDF or CSV format. The first request per 12-month period is free; subsequent requests within the same period may incur a reasonable processing fee.

Contact Our Privacy Officer

For any questions about this Privacy Policy or our privacy practices, contact us:

Utah DOPL HVAC Contractor License: #11567823-5501
EPA Section 608 Universal (Lead Tech): #608U-2009-447129