Your inspection request is kept 36 months and sold to nobody.

Who runs this site

The site at sunshineroofingtx.org is operated by Sunshineroofingtx, trading as Sunshine Roofing & Remodeling, a residential roofing contractor working Far North Dallas, Addison, Plano and Carrollton. The postal address is 17215 MARIANNE CIR, Dallas, Texas 75252, United States. For the purposes of the GDPR we are the controller of the personal data described here; under California and other US state law we are the business that collects it.

There is no parent company behind this and no data broker in the chain. The same people who come out and walk your roof are the ones reading your enquiry.

What we collect, field by field

The inquiry form. When you send the form on the contact page or the short version on the home page, our server writes down your name, phone number, email address, the property address, the kind of enquiry you picked (inspection, replacement, leak, low-slope, fascia and gutters, or something else), your message, any specification you described in the spec field, and whether you ticked the consent box.

Recorded automatically with the form. Your IP address, your browser's user-agent string, the page that referred you, the moment the form was rendered on your screen and the moment you sent it. The two timestamps exist to catch bots that fill a form in under a second. They are not used to profile you.

The support chat. The chat keeps the conversation itself and any name, phone or email you choose to give it. A token is stored in your browser so that if you close the tab and come back, the thread is still there.

Cookie and storage identifiers. Your consent choice is stored in your browser under the key site_consent_v2. If you press Allow, the advertising and analytics tags from Google, Microsoft and Meta may set their own identifiers. The full list sits in the cookie policy.

Advertising click identifiers. If you arrived from a paid ad, the link carries a click identifier in the address: gclid from Google, msclkid from Microsoft, fbclid from Meta.

We do not take payment on this site, so we never see card numbers. There are no accounts and no passwords. We do not buy lists and we do not knock on doors after a hailstorm to fill them.

What each piece is used for

Your name, phone and property address are used to call you back and book the inspection, then to find the house on the day. Email is where the photo report and any written estimate are sent. The message and spec field tell us whether to bring a ladder for a single-storey ranch or the 40-foot extension for a two-storey with a 10/12 pitch.

IP address, user-agent and timestamps are used to block spam and abuse of the form. Chat transcripts are used to answer you and to keep a record of what was said if a job follows. Click identifiers and ad cookies, when you allow them, tell us which campaign produced an enquiry, so we can stop paying for the ones that produce nothing.

The legal basis for each use

For visitors covered by the GDPR, every use above rests on one of three bases. Contract, where you have asked us to quote or inspect. Legitimate interest, where we protect the site from spam. Consent, for anything to do with advertising measurement and analytics.

• Answering an enquiry and booking an inspection. Data used: name, phone, email, address, kind, message, spec. Legal basis: steps taken at your request before a contract, then the contract itself.
• Recording that you agreed to be contacted. Data used: consent tick, send time. Legal basis: consent.
• Stopping spam and form abuse. Data used: IP address, user-agent, render and send times. Legal basis: legitimate interest in a working form.
• Support chat replies. Data used: transcript, optional name, phone, email, browser token. Legal basis: steps at your request; consent for the optional contact fields.
• Ad measurement and analytics. Data used: gclid, msclkid, fbclid, platform cookies. Legal basis: consent, given with Allow and withdrawn with Decline.
• Server logs. Data used: IP address, request, time. Legal basis: legitimate interest in keeping the site running and secure.

The ad platforms that send people here

This site runs paid advertising today. Google Ads and Microsoft Advertising send traffic to it, and Meta Ads sends traffic where a campaign runs there. When you click one of those ads, the platform adds an identifier to the link: gclid for Google Ads, msclkid for Microsoft Advertising, fbclid for Meta Ads.

That identifier is how the platform later matches a booked inspection to the ad that produced it. With storage denied, the identifier sits in the address bar and goes nowhere. With storage allowed, the platform's tag can read it and report a conversion. None of these platforms has been asked to review this site, and we make no claim that any of them has.

Consent Mode v2: denied until you say otherwise

Before any tag fires, Google Consent Mode v2 sets four signals to denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. They stay denied while you read the page. Press Allow on the banner and they are updated to granted. Press Decline, or later withdraw through Cookie settings in the footer, and all four are set back to denied at that moment.

Microsoft and Meta tags follow the same choice: they do not set storage until you allow it. The banner sits along the bottom edge and never blocks the page, so declining costs you nothing.

Who else receives data, by name

• Google Ireland Ltd and Google LLC, for Google Ads. Receives the gclid and the consent signals. Its handling is set out at policies.google.com/privacy.
• Microsoft Ireland Operations Ltd, for Microsoft Advertising. Receives the msclkid. Its own handling is covered by the Microsoft privacy statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd, for Meta Ads, which attaches the fbclid where a campaign runs there. See Meta's privacy policy.
• Our hosting provider, which serves this site and stores the enquiry database and chat transcripts.
• Our mail provider, which carries the notification of a new enquiry to the office inbox.

Nobody else. Not a lead-reselling network, not a storm-chasing referral service, not a shingle manufacturer. If an insurance adjuster needs your inspection photographs, you give them to the adjuster or tell us to.

Data that leaves the country

We collect in the United States, and most of it stays there. Google, Microsoft and Meta process data in the US and in the European Union through their Irish entities. If you reach this site from Europe, your data travels to the US. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and on the European Commission's standard contractual clauses in the platforms' own terms where it is not.

How long each record is kept

Real periods, not "as long as necessary". When a period runs out, the record is deleted.

• Enquiries and their email copies: 36 months. Long enough to cover the job, a follow-up season of storms and any workmanship call-back.
• Chat transcripts: 18 months. A conversation that leads nowhere has no reason to outlive the next re-roof season.
• Server and access logs: 90 days. Enough to trace abuse, then rotated out.
• Your consent choice: 6 months. After which the banner asks again.

How it is protected

The whole site is served over HTTPS, so the form travels encrypted. The enquiry store sits outside the public web folder and is reached only through a password-protected panel used by the office. The form carries two hidden trap fields and a timing check, which turn away most automated submissions before they are stored. Access is limited to the people who return calls and book inspections. No system is perfect, and if a breach ever touches your data we will tell you and the relevant authority without delay.

Your rights under the GDPR

If you reach this site from the European Economic Area or the UK, the GDPR gives you these rights, and we honor them without asking why:

• Access: a copy of everything we hold on you.
• Rectification: wrong phone number, wrong house, we fix it.
• Erasure: deletion, unless a contract in progress means we have to keep the job record.
• Restriction: we keep the data but stop using it while a dispute is settled.
• Portability: your enquiry in a plain, machine-readable file.
• Objection: to any use based on legitimate interest.
• Withdrawing consent: at any time, through Cookie settings in the footer or by email, without affecting what was done before.

Your rights under US state law

California residents have rights under the CCPA as amended by the CPRA: to know what personal information we collect and why, to delete it, to correct it, to opt out of its sale or sharing for cross-context behavioral advertising, to limit use of sensitive information, and not to be treated differently for using any of these. Residents of other states with privacy laws in force, including Colorado, Connecticut, Virginia, Utah and Texas, hold equivalent rights and we apply the same answer to all of them.

We do not sell personal information. Letting an ad platform read a click identifier can count as sharing under the CCPA, which is why it happens only after Allow and stops on Decline. Pressing Decline is your opt-out.

Global Privacy Control

If your browser sends a Global Privacy Control signal (the Sec-GPC header), we treat it as an opt-out of sale and sharing for that browser and keep the four consent signals denied. We do not ask you again to confirm it.

Children

This site is for homeowners and property managers arranging work on a roof. It is not meant for anyone under 16 and we do not knowingly take data from children. If a child has sent us something, write to us and we delete it.

Accessibility

We build this site to the Web Content Accessibility Guidelines 2.2 at level AA. Every page works with a keyboard alone: a skip link jumps past the header, focus is shown as a thick lime or ink outline, and the menu closes with Escape. Text keeps a contrast ratio of at least 4.5 to 1 against its ground. Tap targets are at least 44 pixels. The moving bands of spec labels pause when you hover or focus them and stop entirely if your system asks for reduced motion.

Known limits: the condensed display type in headings is large but tight, and some readers find long runs of capitals harder going. Body text is set in a plain face at 17 pixels for that reason. If any part of the site does not work with the assistive technology you use, call 214-532-8878 and we will take your details by phone, then fix the page.

How to make a data request

Any of the rights above, GDPR or US state, goes through one route. Send an email to [email protected] with the subject "Data request", or write to 17215 MARIANNE CIR, Dallas, Texas 75252, United States. Say what you want: a copy, a correction, deletion, or an opt-out. Give us the name and phone or email you used, so we can find the record and check it is yours. We may call the number on file to confirm before we send anything out.

We answer within 7 days. There is no fee. If you use an authorized agent, the agent needs your signed permission.

Complaining to an authority

If you think we have handled your data wrongly, tell us first and we will put it right. You also have the right to complain to the Attorney General of your state, and in California to the California Privacy Protection Agency. Visitors from Europe may complain to the data protection authority of the country where they live or work.

When this policy changes

A change is published on this page with a new "last updated" date at the top. If it changes what we collect or who receives it, the cookie banner is shown again so you can make a fresh choice, and anyone with an open enquiry is told by email.

Reaching a person

Email [email protected], call 214-532-8878, or write to Sunshine Roofing & Remodeling, 17215 MARIANNE CIR, Dallas, Texas 75252, United States. The same inbox handles roof questions and privacy questions. For the cookie detail, read the cookie policy; for estimates and workmanship, the terms.