Privacy Policy

Last updated: August 4, 2026

This policy explains how personal information is collected and used when you visit hvacsitecraft.com, request a free HVAC website concept, communicate with us, or separately subscribe to marketing emails.

1. Who is responsible for your information

The data controller is Rog Innovations - Cezary Róg, a sole proprietorship registered in CEIDG, trading as HVAC Sitecraft. Our business address is ul. Stawy 5, 02-467 Warszawa, Poland. NIP: 5213786955. REGON: 367699620.

Privacy questions and requests may be sent to cezary@roginnovations.com.

2. Information we collect

Information you provide. A concept request includes your name, business email, company name, primary service city and state, current website situation, desired timing, and acknowledgment of the managed-service price. A website or Google Business Profile link and separate marketing choice are optional.

Technical and attribution information. We may collect the page and time of submission, referring page, campaign and UTM parameters, Meta click and browser identifiers, user agent, form interaction events, and a cryptographic hash derived from an IP address for rate limiting and abuse prevention. The hash is designed to avoid retaining the plain IP address in the lead record.

Information stored on your device. A necessary first-party cookie records the version, time, and optional categories you accepted or rejected. Analytics and advertising providers may use cookies or similar identifiers only after the relevant affirmative choice. The form does not save an unfinished draft in browser storage.

Public business information. To prepare a personalized concept, we may review information that the business has made public, such as its website, Google Business Profile, public reviews, service descriptions, service area, branding, and public booking links.

Please do not send sensitive personal information, financial account information, health information, government identifiers, or information about children in connection with a concept request.

3. Why we use information and our legal bases

• Reviewing and fulfilling a concept request: to assess the request, research the named business, prepare or discuss a concept, confirm availability, deliver the concept, and send up to two request-specific follow-ups within 30 days. The legal basis is taking steps at your request before a possible contract under GDPR Article 6(1)(b).
• Optional marketing: to send occasional offers and information about HVAC websites, online advertising, and lead generation only after a separate marketing opt-in and confirmation. The legal basis is consent under GDPR Article 6(1)(a). Consent is optional and may be withdrawn at any time.
• Analytics and advertising measurement: to understand site performance, attribute advertising, measure conversions, and improve campaigns. Where consent is required, the legal basis is consent under GDPR Article 6(1)(a).
• Security and abuse prevention: to detect duplicate or automated submissions, apply rate limits, protect the website, and investigate misuse. The legal basis is our legitimate interest in operating a secure and reliable service under GDPR Article 6(1)(f).
• Business administration and legal protection: to maintain necessary correspondence, establish or defend legal claims, comply with lawful requests, and meet accounting or other legal obligations. The legal bases are legitimate interests under GDPR Article 6(1)(f) and compliance with legal obligations under GDPR Article 6(1)(c), as applicable.

You may decline optional fields, but we cannot review and deliver a concept without the required business and contact information.

4. Email communications

Providing an email with a concept request allows us to communicate about that request. It does not automatically add you to a recurring marketing list. Request-related messages are limited to confirmation, availability, delivery, and up to two follow-ups connected to the requested concept within 30 days.

Marketing emails require a separate, optional choice and confirmation. Marketing subscribers may unsubscribe at any time using the link in an email or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal. We do not sell our marketing list.

5. Analytics and advertising

When configured and permitted, we may use Google Analytics and Meta advertising technologies to measure visits, form interactions, ad attribution, and conversions. Meta conversion measurement may receive a hashed version of an email address together with technical identifiers. Hashing is a security measure and does not make the information anonymous.

Optional analytics and advertising technologies will be controlled through the site's consent choices where required. We do not intentionally include submitted business or contact details in browser analytics events.

Google Analytics and Meta technologies are blocked before the relevant choice. Analytics and advertising can be accepted independently, “Reject optional” is available on the first layer, and the “Cookie settings” control allows withdrawal at any time. Details about technologies, purposes, and durations are in our Cookie Policy.

6. Who receives information

Information may be provided to the following categories of recipients only as needed for the purposes described above:

• Supabase for database hosting and lead storage;
• Netlify for website hosting, request handling, and operational logs;
• Resend and our email provider for transactional and opted-in marketing email;
• Google, when analytics services are enabled with the required consent;
• Meta, when advertising measurement is enabled with the required consent;
• professional advisers, contractors, or authorities where reasonably necessary to operate the service, protect legal rights, or comply with law.

Providers that process information on our instructions are contractually required to protect it. Some providers may also process limited information as independent controllers under their own privacy terms.

7. Storage locations and international transfers

The website is hosted in the United States. The primary Supabase database is hosted in Frankfurt, Germany, within the European Economic Area. Supabase and providers supporting email, hosting, analytics, advertising, security, and backups may also access or process information in the United States, Singapore, or other countries outside the European Economic Area.

Where GDPR applies to an international transfer, we use an approved safeguard such as the EU-US Data Privacy Framework for a participating recipient or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where appropriate. You may contact us for more information about the safeguard applicable to a particular recipient or to request access to a copy, subject to permitted redactions.

8. How long we retain information

• Unconverted concept requests: up to 12 months after the last meaningful contact.
• Rejected, spam, or incomplete requests: up to 6 months, except limited security information retained longer when reasonably necessary to prevent recurring abuse.
• Request-specific communication: normally ends no later than 30 days after submission unless you continue the discussion.
• Marketing subscriptions: until you unsubscribe or after 24 months without meaningful engagement, whichever occurs first.
• Consent and suppression records: minimal records may be retained after withdrawal as reasonably necessary to demonstrate compliance and ensure that an opt-out continues to be honored.
• Customer and legal records: for the duration of the customer relationship and any additional period required by Polish tax, accounting, limitation, or other applicable laws.

Provider logs and backups may remain for their documented rotation periods before being securely deleted or overwritten. We may retain information longer when necessary for an active dispute, security incident, or binding legal obligation.

9. Security

We use measures intended to protect information against unauthorized access, alteration, disclosure, and loss. These include encrypted transmission, access restrictions, administrative credentials kept separate from public website code, rate limiting, hashed IP-based abuse controls, and provider security controls. No online service can guarantee absolute security.

10. Your privacy rights

Subject to applicable law, you may request:

• access to and a copy of your personal information;
• correction of inaccurate or incomplete information;
• deletion of information;
• restriction of processing;
• data portability where applicable;
• withdrawal of consent at any time;
• objection to processing based on legitimate interests and an unconditional objection to direct marketing.

Send a request to cezary@roginnovations.com. We may need to verify your identity before fulfilling a request. We normally respond within one month, subject to legally permitted extensions. Rights are not absolute, and we may retain limited information where required by law or necessary to establish, exercise, or defend legal claims.

You also have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Information about complaints is available on the UODO website.

11. Automated decisions and profiling

We do not use submitted information to make solely automated decisions that produce legal or similarly significant effects. Advertising providers may use device or interaction information for measurement and audience-related processing under their own terms and your applicable consent choices.

12. Children

This is a business-to-business service intended for representatives of operating US HVAC businesses. It is not directed to children, and we do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy when our service, providers, or legal obligations change. The current version and effective date will be posted on this page. Material changes affecting existing marketing consent will be communicated where required.

14. Contact

Rog Innovations - Cezary Róg, trading as HVAC Sitecraft
ul. Stawy 5, 02-467 Warszawa, Poland
NIP: 5213786955; REGON: 367699620
Email: cezary@roginnovations.com