Privacy Policy

<strong>AquaShield Restoration USA</strong> ("we," "our," or "us") is a licensed restoration contractor based in Houston, Texas. We take your privacy seriously. This Privacy Policy explains what personal information we collect through our website, why we collect it, who we share it with, and the rights you have under applicable law — including the Texas Data Privacy and Security Act (TDPSA).

1. Categories of Personal Data We Collect

We collect the following categories of personal data when you use our Contact Support form, Free Inspection form, or interact with our website:

2. Why We Collect This Data (Purpose of Processing)

We process your personal data only for the following purposes:

• Scheduling free inspections — To contact you and schedule a property assessment at your request.
• Responding to support inquiries — To answer your questions about our services, insurance claims, or restoration projects.
• SMS communications — Only if you explicitly opt in. Used to send appointment reminders and status updates.
• Fraud and spam prevention — IP addresses and User-Agent strings are used to detect bots and prevent abuse (legitimate interest).
• Website analytics — Aggregate, anonymized data via Google Analytics 4 to improve our website performance.
• Legal compliance — To meet our obligations under Texas law, TDPSA, and any applicable regulatory requirements.

Legal basis (TDPSA/GDPR): Primarily contract performance (responding to your service request) and legitimate interest (fraud prevention, security). Consent is obtained for SMS notifications and optional analytics.

3. Third Parties We Share Data With

We do not sell your personal data. We share data only with the following service providers (processors) who act on our behalf and are contractually required to protect it:

We do not share your data with data brokers, advertising networks, or third-party marketers. We do not sell, rent, or trade your personal information.

4. Data Retention

We retain your personal data only as long as necessary for the purposes described above:

• Contact & Appointment records: 3 years from last interaction, then securely deleted.
• Spam/rate-limiting logs (IP addresses): 90 days, then automatically purged.
• Email records: 2 years (in our email system), aligned with transactional record requirements.
• Analytics data (Google Analytics 4): 14 months (Google's default retention).
• Legal obligations: If required by Texas law or a legal proceeding, records may be retained longer.

You may request early deletion of your data at any time. See Section 5 for instructions.

5. Your Privacy Rights (TDPSA)

Under the Texas Data Privacy and Security Act (TDPSA), Texas residents have the following rights. We will respond to all verified requests within 45 days (extendable by 45 days with notice):

6. Do Not Sell My Personal Information

You still have the right to formally opt out of data sharing for targeted advertising purposes. To exercise this right:

• Submit a request via our Privacy Request form
• Email us at privacy@aquashieldrestorationusa.com
• Enable the Global Privacy Control (GPC) in your browser (automatically honored)

7. Security Safeguards

We implement the following technical and organizational security measures, aligned with OWASP Top 10 2025:

• TLS/HTTPS: All data in transit is encrypted using TLS 1.3.
• Database encryption: All data at rest is encrypted by Supabase (AES-256 on AWS).
• CAPTCHA: Cloudflare Turnstile protects all public forms against bot submissions.
• Anti-spam: Multi-layer spam detection (honeypot, content analysis, rate limiting, User-Agent detection) on every form submission.
• HTTP Security Headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, HSTS, Permissions-Policy deployed on every response.
• Input validation: All form data is validated with strict Zod schemas server-side before any database operation.
• Rate limiting: Maximum 3 form submissions per IP per hour, enforced server-side.
• Access control: Database access uses a service role key stored server-side only, never exposed to the client.

Despite these measures, no system is 100% secure. In the event of a data breach affecting your rights, we will notify you as required by Texas law.

8. Cookies & Tracking

Our website uses cookies and similar tracking technologies. Our Cookie Policy provides full details. Summary:

• Strictly necessary: Session and security cookies required for the site to function. No consent required.
• Analytics: Google Analytics 4 cookies (if you consent). IP anonymization is enabled. You may opt out via your browser or the Cookie Settings page.
• No advertising cookies: We do not use third-party advertising or tracking cookies.

9. Contact & How to File a Complaint

If you have questions about this Privacy Policy, wish to exercise your rights, or want to report a concern:

If you are a Texas resident and believe we have not adequately responded to your privacy request, you may file a complaint with the Office of the Texas Attorney General.

This Privacy Policy was last updated on February 20, 2026. We reserve the right to update this policy periodically. Material changes will be posted on this page with an updated "Last Updated" date. Continued use of our website after changes constitutes acceptance of the updated policy.