We keep your inquiry for 24 months, your chat for 6, and nothing at all from a card.

Effective date

This notice takes effect on 2 October 2026 and is the version in force from that day. It replaces anything this site said about personal data before it. The date at the top of the page and the date in this section always match. If you ever see them disagree, tell us and we correct it the same day.

Who runs this site

The controller of the personal data described here is Hdroofingandrepairs, trading as HD Roofing and Repairs at hdroofingandrepairs.de. The postal address is 12131 Pecan St, Austin, Texas 78727, United States. Mail for privacy matters goes to that address or to [email protected], and the phone line is 512-4586-800. We are a roofing contractor, not a data business. We do not sell lists, we do not buy them, and we do not run accounts or logins on this site.

What we collect

Four kinds of data reach us, and that is the whole list.

The inquiry form. When you send the form on the contact page or the home page, the server script nucucbb.php writes down your name, phone number, email address, the property address, the kind of job you picked (replacement, leak, metal, flat roof, inspection), your message, any specification you typed in such as roof size or material, and whether you ticked the consent box. Alongside that, automatically, it records your IP address, your browser's user-agent string, the page that referred you, the moment the form was rendered and the moment it was sent. The two timestamps are there to catch bots that fill a form in under a second.

The support chat. If you open the chat, rani714.php keeps the conversation: every message you and we type, plus a name, phone and email if you choose to give them. Your browser keeps a token so you can close the tab and come back to the same thread.

Technical and log data. The web server logs each request: IP address, time, the page asked for, the response code, the referrer and the user-agent. This is ordinary server behaviour and happens on every website.

Cookie and click identifiers. Your consent choice is stored in your browser under site_consent_v2. When you arrive from a paid ad, the link carries a click identifier: gclid from Google, msclkid from Microsoft, fbclid from Meta. Advertising and analytics cookies are only written after you press Allow. The cookie notice lists each one by name and lifetime.

We take no payment, no card number, no bank detail, no password and no government ID through this site. Nothing is sold here. A roof is priced on a written estimate after a roof walk, never through a checkout.

What each piece is used for

Form and chat details are used to answer you: to call back, to book a roof inspection in Austin at the address you gave, to write the itemised estimate, and, if the job goes ahead, to schedule the crew and send the paperwork. The kind-of-job field decides who calls you first; a leak reported at 9pm is triaged differently from a replacement quote. The automatic fields (IP, user-agent, timestamps, referrer) are used to stop spam and abuse of the form and to see which page a real inquiry came from. Server logs are used to keep the site running and to investigate attacks. Click identifiers and advertising cookies, once allowed, tell Google Ads, Microsoft Advertising and Meta Ads that a click turned into an inquiry, so we stop paying for ads that bring nobody. Analytics, once allowed, counts visits and pages in aggregate. We do not use any of it to build a profile of you, and no decision about you is made by software alone.

Legal bases

For visitors covered by European data protection law, each purpose above rests on a stated basis: consent, contract, legitimate interest or, for the consent record, a legal obligation. The list below sets them out. US visitors get the same handling; the list simply names the rule.

1. Answer an inquiry, quote, schedule work. Data: form fields, chat messages. Basis: steps before a contract, then the contract (Art. 6(1)(b)).
2. Contact you about the job you raised. Data: name, phone, email, consent tick. Basis: consent (Art. 6(1)(a)).
3. Spam and abuse prevention. Data: IP, user-agent, timestamps, referrer. Basis: legitimate interest (Art. 6(1)(f)).
4. Running and securing the server. Data: access logs. Basis: legitimate interest (Art. 6(1)(f)).
5. Ad conversion measurement. Data: gclid, msclkid, fbclid, ad cookies. Basis: consent (Art. 6(1)(a)).
6. Visit analytics. Data: analytics cookies. Basis: consent (Art. 6(1)(a)).
7. Remembering your cookie choice. Data: site_consent_v2. Basis: legal obligation and legitimate interest.

Where a basis is consent, you can withdraw it at any time and the withdrawal works from that moment forward.

Advertising platforms

This site is a destination for paid advertising today. Google Ads, Microsoft Advertising and Meta Ads run campaigns that send visitors here, mostly people searching for roof replacement in Austin, emergency roof repair or a hail damage inspection. Each platform adds its own click identifier to the link you tapped: Google Ads attaches gclid, Microsoft Advertising attaches msclkid, and Meta Ads attaches fbclid where a campaign runs there. The identifier is a random string. It tells the platform which ad was clicked; it does not carry your name. If you allow storage, the identifier is kept in a first-party cookie so that an inquiry sent later can be counted against the ad that brought you. If you decline, the identifier sits in the address bar and goes nowhere. None of these platforms has any say over what this page tells you, and nothing here should be read as a claim that any of them has looked at or endorsed this site.

Consent Mode v2

The site runs Google's consent mode, version 2, and the same choice governs the Microsoft and Meta tags. Before you choose anything, four signals are set to denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. In that state no advertising or analytics cookie is written and no user data is passed to an ad platform for personalisation. Press Allow and all four switch to granted. Press Decline, or withdraw later through Cookie settings in the footer, and all four go straight back to denied. Your choice is remembered under site_consent_v2 so the banner does not nag you on every page.

Who receives data

Named one by one:

• Google Ireland Ltd and Google LLC, for Google Ads. Receives gclid, conversion events and the consent signals. Policy: policies.google.com/privacy.
• Microsoft Ireland Operations Ltd, for Microsoft Advertising. Receives msclkid and conversion events after consent. Its handling is covered by the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
• Meta Platforms Ireland Ltd, for Meta Ads, where a campaign runs there. Receives fbclid and conversion events after consent. Policy: facebook.com/privacy/policy.
• The hosting provider that serves this site, keeps the server logs and stores the inquiry and chat database.
• The mail provider that carries the notification of a new inquiry to our inbox.

Material suppliers, insurers and adjusters never get your details from this website. If a job needs them, we ask you first.

Transfers abroad

We work in Texas and the data is processed in the United States. A visitor reaching the site from Europe is therefore sending data out of the European Economic Area. Where Google, Microsoft or Meta receive data, they do so through their Irish entities and move it to the US under the EU-US Data Privacy Framework, where certified, and the European Commission's standard contractual clauses. The hosting and mail providers are bound by processing terms that apply the same safeguards. You can ask us for a copy of the relevant safeguard; write to the address in §17.

How long we keep it

Real periods, not "as long as necessary":

• Inquiries and their email copies: 24 months from the day they arrive. A roof leak that comes back a year later is easier to diagnose when we can see what you reported the first time.
• Chat transcripts: 6 months.
• Server and access logs: 90 days.
• The record of your consent choice: 12 months, after which the banner asks again.

If you become a customer, the estimate, contract and invoice are business records and are kept for as long as Texas tax and contract law require. They live in our job files, not on this website.

Security

The site is served over HTTPS only, so form and chat traffic is encrypted in transit. The inquiry store sits outside the public web folder and is not reachable by URL. Access to it is limited to the people who answer inquiries and is protected by a password. The form carries hidden honeypot fields and a render-time check that turn away most automated junk before it is stored. Logs are rotated and deleted on the 90-day cycle. No system is perfectly secure; if a breach touches your data, we will tell you and the relevant authority as the law requires.

Your rights under the GDPR

If you reach the site from Europe, the GDPR gives you the right to access the data we hold on you and get a copy; to rectification of anything wrong; to erasure where there is no reason left to keep it; to restriction of processing while a dispute is settled; to portability, meaning a copy in a common machine-readable format; to objection to processing based on legitimate interest; and to withdraw consent at any time without affecting what was done before. You will not be charged for using any of these, and a refusal will always come with a reason.

US state privacy rights

California residents have rights under the CCPA as amended by the CPRA: to know what personal information is collected and why, to delete it, to correct it, to limit use of sensitive information, and to opt out of the sale or sharing of personal information for cross-context behavioural advertising. We do not sell personal information for money. Passing click identifiers to ad platforms after you allow storage can count as sharing under California law; you opt out by pressing Decline, through Cookie settings, or with Global Privacy Control. Residents of the other states with privacy laws in force, Texas included, have comparable rights to access, correct, delete and opt out of targeted advertising, and we honour the same requests from them. Nobody is treated differently for exercising a right.

Global Privacy Control

If your browser sends the Global Privacy Control signal (the Sec-GPC header), the site treats it as an opt-out of sale and sharing and as a Decline. The four consent mode signals stay denied and the banner does not ask you again. You do not need to do anything else.

Children

This site is for property owners and managers arranging roof work. It is not directed at children under 13, or under 16 in Europe, and we do not knowingly collect their data. If a child has sent us something, tell us and it will be deleted.

Complaints

Talk to us first; most problems are fixed in one email. You also have the right to complain to a regulator. In the United States that is your state Attorney General, and in California also the California Privacy Protection Agency. In Europe it is the data protection authority of the country where you live or work.

Accessibility

The site is built to the Web Content Accessibility Guidelines 2.1 at level AA as its target. In practice that means: one heading structure per page, a skip link at the top, every control reachable and usable by keyboard with a visible lime focus ring, text contrast of at least 4.5 to 1 and mostly far higher, tap targets of 44 pixels or more, no content that depends on colour alone, and motion that stops when your system asks for reduced motion. The horizontal process rail on the home page becomes a normal vertical list in that case. Tables scroll inside their own box rather than forcing the page sideways.

Known gaps: photographs carry descriptive alt text but no long descriptions, and the cookie banner relies on the browser's own focus order. If something on the site blocks you, call 512-4586-800 or email [email protected] and tell us the page. We will give you the information another way straight away and fix the page.

Changes to this notice

When this notice changes, the effective date at the top and in §01 changes with it, and a short line saying what moved appears under the page title for at least 30 days. If a change widens what we collect or who receives it, the cookie banner is shown again so you can make a fresh choice. Earlier versions are available by email.

Contact

A person reads every message. Email [email protected], call 512-4586-800, or write to HD Roofing and Repairs, 12131 Pecan St, Austin, Texas 78727, United States. For anything about cookies specifically, the cookie notice has the full list; for the rules of using the site and the warranty position, see the terms.