Privacy Policy

Information we collect

Candys collects the information a visitor chooses to send through the website, estimator, contact forms, quote requests, phone links, and optional upload tools.

Contact details such as name, phone number, email, city, ZIP code, project address details when provided, and language preference.
Project details such as material choice, measurements, layout, access, demolition, backsplash, sink, cooktop, faucet, notes, price range, and quote status.
Optional project photos when a customer chooses to upload them.
SMS opt-in choice, consent context, and message records when SMS is configured and used.
Basic website and security information such as page views, referrer, UTM/source details, browser data, IP-derived security signals, and rate-limit logs.

Sensitive information

Candys does not ask customers to send Social Security numbers, payment card numbers, government IDs, medical records, tax records, passwords, or unrelated private family information through the website, photo upload, email, or SMS. If a customer sends that kind of information by mistake, Candys may delete it or ask the customer to use a safer process.

Browser storage and analytics status

The public site uses local or session browser storage, rather than advertising cookies, to remember an unfinished estimator, an unfinished contact form, the first tagged campaign/referrer, and a same-session confirmation receipt. Contact-form drafts are accepted as current for up to 14 days and are then ignored and removed the next time the site reads them. Campaign/referrer data remains on the device until it is replaced or the visitor clears browser storage and is attached only when a request is submitted.

The public site does not currently run the optional Plausible analytics integration or behavior-based advertising trackers.
Administrative sign-in cookies and the admin language cookie are for authorized staff using the private admin area, not public customer advertising.

How we use information

Candys uses this information to respond to requests, review project fit, prepare price ranges, schedule project review, prepare written quotes, provide customer support, operate the admin dashboard, attribute a submitted request to its source, protect the site, and improve the customer experience.

Calls, email, and text messages

Candys may call or email using the contact information a customer provides. Text messages are optional and are sent only when SMS service is configured, the customer opts in, and the message relates to the submitted project. Message frequency varies, message and data rates may apply, and a customer can reply STOP or clearly ask us to stop texting to opt out, or reply HELP for help.

Candys does not sell, rent, or transfer mobile numbers or SMS opt-in information. Mobile information and text messaging consent are not shared with third parties or affiliates for their marketing or promotional purposes. Service providers may process this information only to operate an approved Candys messaging program.

Service providers and disclosures

Candys uses or may use vendors only for the business functions described here. Providers process information under their own terms and privacy notices, and the enabled provider set must be reviewed whenever this policy changes.

Website infrastructure serves the site; Supabase supports lead records, admin authentication, database functions, and private file storage; and Resend delivers project email when configured.
Google Places may receive address text typed into its autocomplete field and the selected suggestion when that optional feature is used.
Twilio processes phone, consent, and message data only if customer SMS is later approved and enabled. Customer SMS is currently disabled.
Optional application-error monitoring is designed to exclude request bodies and direct customer details. It remains a separate production gate, and optional Plausible analytics is not currently active.
Candys may disclose information when reasonably necessary to comply with law or legal process; protect rights, safety, systems, customers, or others; investigate misuse; or complete a business transfer subject to appropriate privacy obligations.

Security and limits

Candys uses reasonable small-business safeguards such as private storage, access limits, validation, and provider controls. No website, email, SMS, or storage system can be guaranteed perfectly secure, so customers should avoid sending sensitive records through public forms or text messages.

Project photos

Project photos are optional. Accepted images are signature-checked, resized, re-encoded as JPEG, stripped of embedded metadata, and stored in private provider storage for project review, support, estimating, pricing, and quote preparation. Uploading a photo is not permission to publish it in a gallery, advertisement, social post, AI training set, or before-and-after proof. Public or training use requires a separate, specific permission record and owner approval.

External AI-assisted analysis of customer photos is currently disabled. It must not be enabled until a vendor, data-use terms, retention path, human-review process, and updated disclosure receive owner/legal approval.
If an approved analysis path is enabled later, the processed image and a random storage identifier may be sent to that provider without the customer name, email, phone number, or street address; its output remains preliminary and subject to human review.

How long we keep information

Different records have different retention needs. Candys keeps lead, quote, communication, consent, audit, security, accounting, and project records only while reasonably needed for the request, an active or completed project, business records, security, disputes, or legal obligations. A request to delete one item does not automatically require deletion of every project or accounting record.

The private-photo retention rule uses a 60-day clock after a lead is recorded as closed, lost, or completed. Open-project photos remain outside that clock. Documented legal, accounting, security, dispute, and preservation exceptions can extend retention when reasonably required.
An uploaded photo that never becomes attached to a lead is eligible for cleanup after a 7-day orphan grace period.
Encrypted backups and legally required or dispute-related records may remain until their rotation or lawful retention period ends. A deleted item is not intentionally returned to the active system from a backup.
Separately permissioned public proof is managed under its own permission record and is not silently converted from a private lead photo.

Privacy requests and choices

Anyone may ask Candys to correct contact details, answer a privacy question, review an access or deletion request, or stop optional text messages. Depending on applicable law, a Texas resident may also have rights to confirm processing, access, correct, delete, or obtain a portable copy of personal data, or opt out of sale, targeted advertising, or qualifying profiling. Candys does not currently sell personal data or use customer data for targeted advertising or qualifying profiling.

Candys may need to verify the requester or an authorized agent before disclosing or changing records.
A request may be limited or denied when an exception applies, including an active project, transaction records, security, fraud prevention, accounting, legal obligations, or legal claims. If applicable law provides an appeal right, the response will explain how to appeal.

Children

The website is for countertop project inquiries from adults, homeowners, property managers, contractors, and business contacts. It is not directed to children under 13, and Candys does not knowingly collect personal information online from a child under 13. A parent or guardian who believes a child submitted information should contact Candys so the record can be reviewed and deleted when required.

Policy updates

Candys may update this policy as providers, business processes, or legal requirements change. The last-updated date identifies the current posted version. A materially different SMS or AI use requires the matching consent, provider, and policy review before it is enabled; posting a broader policy alone does not create consent.