Privacy Policy

HVACSuite ("we", "us") provides HVACSuite CRMto businesses ("customers"). For the lead and contact information that a customer brings into the CRM, the customer decides why and how it is used and we act as its service provider. For account, billing and website information, we are responsible for the information.

Questions or requests can be sent to support@hvacsuite.ca.

• Account information: name, email address, role, business name and a hashed password for each user a customer adds to the CRM.
• Lead and contact information:names, phone numbers, email addresses, addresses, appointment details, notes, status history and any other fields a customer enters or imports. This includes information submitted through a customer's own Facebook and Instagram lead ad forms.
• Call data: when a customer uses the browser dialer, we store call logs (numbers, time, duration, outcome) and, where enabled by the customer, call recordings.
• Billing information: subscription status and invoices. Card details are collected and stored by our payment processor and never reach our servers.
• Usage and technical data: sign-in events, IP address, browser type and basic diagnostics used to secure and improve the service.

A customer can connect a Facebook Page they manage by using Facebook Login for Business or by supplying a Page access token. When they do, we request only the permissions needed to run lead capture:

• pages_show_list to list the Pages the customer has chosen to share so they can pick which one to connect.
• pages_manage_metadata to subscribe the selected Page to lead notifications (webhooks) so new leads reach the CRM in real time.
• pages_read_engagement to read basic Page information and its lead forms so leads can be matched to the right Page and form.
• pages_manage_ads to read the campaign, ad set and ad that produced each lead, so customers can see which ads generate business.
• leads_retrievalto retrieve the contact details a person submitted on the customer's lead ad form.

We store the following from Meta: the Page ID and name, a Page access token, lead form names, and each lead's submitted answers and ad attribution.

We use this data only to deliver leads into the customer's CRM and show their results. We do not sell it, use it for advertising, share it with data brokers, or use it to build profiles of people for any other purpose. Page access tokens are kept in our access-controlled database, are never shown to other customers, and are used only for the Meta requests described above. Customers can disconnect a Page at any time from the Integrations page, which stops lead delivery and removes the stored token.

Our use of information received from Meta APIs follows the Meta Platform Terms and Developer Policies.

• To provide, secure and support the CRM and its integrations.
• To send service messages, such as lead alerts and account notices.
• To bill for the subscription and prevent fraud or misuse.
• To diagnose problems and improve reliability and performance.
• To meet legal obligations.

We do not sell personal information.

We share information only with providers that help us run the service, and only as needed:

• Hosting and storage providers (application hosting, database and file storage).
• Twilio, for voice calling and call recordings.
• Stripe, for subscription payments.
• Resend, for transactional email.
• Meta, only to carry out the Facebook connection a customer authorizes.

We may also disclose information if required by law, or to protect the rights, safety and security of our users and the service.

Customers are responsible for telling the people they call that a call may be recorded, and for following the laws that apply to them. Recordings are stored privately and are visible only to users in that customer's business.

Each customer's data is kept while their account is active. Customers can delete leads, call recordings and integrations at any time. When an account is closed, we delete its data within 30 days, except for records we must keep for legal, tax or security reasons. Backups are overwritten on a rolling schedule.

If your information reached us through a Facebook lead ad and you want it removed, see our data deletion instructions.

We use encrypted connections, hashed passwords, role-based access control and strict separation between each customer's data. No system is perfectly secure, but we work to protect information and to respond promptly to any incident.

Depending on where you live, including under Canada's PIPEDA and provincial privacy laws, you may have the right to access, correct or delete your personal information, or to withdraw consent. If you are a person whose details are held in a customer's CRM, please contact that business first, since they control that information. You can also write to us at support@hvacsuite.ca and we will help route or fulfil your request.

The service is for businesses and is not directed at children. We do not knowingly collect information from anyone under 13.

We may update this policy from time to time. When we do, we will change the date at the top, and for material changes we will notify customers in the app or by email.

HVACSuite
support@hvacsuite.ca