Privacy notice

This notice explains what personal data Zain Shaida, a sole trader trading as HVAC Marketing Playbook (“we”, “us”), collects through this website and when you buy The HVAC Marketing Playbook, why, and your rights. We are the data controller for the data described here. Contact: [email protected]; post: 2 Hasketon Drive, Luton, LU4 9EZ.

What we collect and why

• Website visits. Pages viewed, referring site, campaign tags (UTM), approximate country, device and browser type, and which buttons are clicked (for example “Buy” or gallery filters). Collected with Umami, which doesn't use cookies, doesn't store your IP address in analytics records and doesn't build profiles across sites. Our host, Cloudflare, processes IP addresses to deliver the site and protect it from attacks. Lawful basis: our legitimate interest in running, securing and improving the site.
• Purchases. Checkout is run by Polar Software, Inc. (“Polar”), which sells the Product to you as merchant of record. Polar collects your payment and billing details as an independent controller under its own privacy policy; we never see your card details. Polar shares with us your name, email address, billing country and address, order details and the campaign tags you arrived with, so we can deliver the Product, give support, handle refunds and keep accounting records. Lawful basis: performance of our contract with you, and legal obligation (tax and accounting records).
• Support emails. What you send us, so we can reply. Lawful basis: legitimate interest (and contract, where it's about your order).

We don't sell personal data, and we don't use it for automated decisions with legal effects.

Brand previews you request

• What happens. When you enter a website address on our preview page, our server (Cloudflare, as our processor) fetches that site's public homepage once, plus its robots.txt, at most one stylesheet and its logo image, and sends back the business name, logo, colors and phone number the site publishes. Your browser then draws the three example designs. We respect robots.txt, and if a site asks automated tools not to read it, we don't.
• What we keep. We don't save the address you enter, the preview or anything you type into the correction fields. A logo file you choose stays on your device. To keep the service fast and prevent abuse, the public brand details for a website address are cached by Cloudflare for up to 7 days, and a one-way hash of your IP address is counted for up to 24 hours for rate limiting.
• Analytics. We count whether a preview was requested, succeeded or failed (for example "logo found: yes"). The website address you entered is never sent to our analytics or to any advertising network.
• Lawful basis. Our legitimate interest in showing you what our templates can do, at your request. The previews are illustrative; we aren't affiliated with the business whose website is entered.

Advertising measurement

If you reach us from a Google ad, the link contains a click identifier (for example gclid). We don't use advertising cookies or tags. If you buy, the identifier travels with your checkout to Polar, and we may upload it to Google Ads together with the time and value of the purchase, so we can tell which ads lead to sales. We never send your name, email or the websites you entered to Google. Lawful basis: our legitimate interest in measuring our advertising. Google processes this under its own terms and privacy policy.

Business outreach

We occasionally introduce our product to individual US HVAC businesses that are incorporated companies. This section explains what we use and why.

• What we use. The business's name, website, the generic business email address it publishes on its own website (such as info@), its public logo, colors, phone number and service area, and public registration and licence records (Texas Comptroller and TDLR) that confirm it's an incorporated, licensed business. We don't buy contact lists, and we don't use named personal email addresses.
• What we do with it. We make a small number of illustrative social media concepts for the business, show them on an unlisted preview page (not indexed by search engines, removed on request and expiring after about 45 days), and send one short, individually written email that links to it. We may send at most one follow-up. If someone replies, we use the reply to answer it.
• What we measure. Visits to the preview page are counted with the same cookieless analytics as the rest of the site, using a campaign tag in the link. We don't use tracking pixels or track whether an email was opened.
• Lawful basis. Our legitimate interest in telling relevant businesses about our product. We've assessed that a single, relevant, clearly identified business introduction with an easy opt-out is proportionate; the assessment is available on request.
• Your choices. Reply “unsubscribe” or email [email protected] and we'll stop straight away, take down any preview page we made for you, and never contact the business again. To make that permanent, we keep a minimal suppression record (business domain, email address and date), which we don't use for anything else.
• How long we keep it. Outreach records are deleted 12 months after our last contact, except the suppression record, which we keep for as long as we do outreach.
• Who processes it. Our outreach email provider: Instantly AI, Inc. (United States), our outreach sending platform, and the business mailboxes it provides for that purpose. Safeguard: Instantly's data processing addendum incorporates the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

Cookies

This website sets no cookies. Polar's checkout and customer portal, which are on Polar's own domain, may use cookies needed to process payment, keep you signed in and prevent fraud; see Polar's privacy policy.

Who processes data for us, and international transfers

We use these providers. Each is based in the United States, so your data may be transferred outside the UK:

• Cloudflare, Inc. (website hosting and security, and forwarding emails sent to our support address). Safeguard: Cloudflare is certified under the UK Extension to the EU–US Data Privacy Framework, with the UK International Data Transfer Addendum in its data processing addendum as a fallback.
• Umami Software, Inc. (cookieless website analytics). Safeguard: Umami's data processing agreement incorporates the EU Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
• Google LLC (Gmail, the mailbox our support emails are forwarded to and answered from). Safeguard: Google is certified under the UK Extension to the EU–US Data Privacy Framework.

Polar receives your purchase data directly from you as an independent controller, and its privacy policy explains the safeguards it uses (including Standard Contractual Clauses).

How long we keep it

• Order and accounting records: 6 years after the end of the financial year they relate to, as UK tax law requires.
• Support emails: 2 years after the conversation ends.
• Website analytics: up to 6 months in Umami.

Your rights

You can ask to access, correct or delete your personal data, to restrict or object to our processing, or for a copy in a portable format. Email [email protected]; we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk). If you're in the US, you can contact us with any privacy request and we'll handle it in line with applicable state law.

Children

This product is for businesses. We don't knowingly collect data from anyone under 18.

Changes

We'll update this notice if our practices change, and change the date at the top.