Privacy Policy

1. About this policy

This Privacy Policy (the “Policy”) explains how Colorado Bear Heating & Air (“Colorado Bear,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information when you visit cobearhvac.com (the “Site”), call, text, or email us, request a quote or service, schedule an appointment, apply for financing through our partners, or otherwise interact with us. By using the Site or our services, you agree to this Policy.

Contact for privacy questions: Colorado Bear Heating & Air, Attn: Privacy, 2237 Deer Holw Trl, Castle Rock, CO 80104. Email [email protected]. Phone (720) 790-3765.

2. Scope

This Policy covers personal information we collect from and about consumers and prospective customers in connection with our residential and light-commercial HVAC services in Colorado. It does not cover the privacy practices of third-party websites, platforms, or service providers we link to or integrate with (for example, Synchrony for financing applications, Housecall Pro for online booking and payments, or Google Maps for directions). Their privacy practices are governed by their own policies, which you should review.

3. Information we collect

We collect the following categories of personal information:

3.1 Information you provide directly

• Identifiers and contact details: first and last name, postal address, email address, phone number, and the address of the property where service is requested.
• Service request details: the equipment you have, the symptoms you describe, photos you upload, preferred appointment times, and any notes you share with our team.
• Booking and payment information: when you book online or pay through our field-management partner (Housecall Pro), we collect billing details and payment confirmation. Card numbers are entered directly into the processor’s secure environment and are never entered on, transmitted through, or stored on our website or servers.
• Financing pre-qualification details: if you apply for financing, the application is submitted directly to our financing partner (Synchrony) on the lender’s own secure site. They collect the application data; we receive only the approval status and the loan/installation details needed to complete your project.
• Reviews, testimonials, and survey responses you choose to share.
• Career applications: resume, work history, contact details, and any information you include in your application.
• Chat messages: if you use the chat widget on the Site, the messages you send and the contact details you provide in the conversation.

3.2 Information collected automatically

• Device and usage data: IP address, device type, operating system, browser type and version, language, referring URL, pages visited on the Site, time spent on each page, clicks, scroll depth, and approximate location derived from IP.
• Cookies and similar technologies: first- and third-party cookies, pixels, SDKs, and local storage, used for required site functions, analytics, and advertising measurement. See § 8 below and Your Privacy Choices.
• Call-tracking metadata: when you call the number displayed on our Site, our call-tracking provider captures the calling number, time, duration, the marketing source that drove the call, and may record the call for quality, training, and dispute-resolution purposes. You will hear a recording notice at the start of the call where required by law.
• Spam-protection signals: our forms are protected by Google reCAPTCHA, which collects device and interaction signals to distinguish people from bots. Use of reCAPTCHA is subject to Google’s privacy policy and terms.

3.3 Information from third parties and service providers

• Marketing and analytics providers (Google Analytics 4 via Google Tag Manager container GTM-TBMMK56) share aggregated and pseudonymous information about how users find and interact with our Site.
• Field-management and after-hours AI booking (Housecall Pro, including its AI-assisted after-hours booking) shares appointment details and customer history when you book.
• Financing partner (Synchrony) shares the application decision and the promotional plan details required to complete your install.
• Review platforms (Google Business Profile) share reviews you publicly post about us.

We do not collect biometric identifiers, genetic data, precise geolocation (GPS-level), or government-issued identification numbers from website visitors. We do not knowingly collect personal information from children under 13. See § 13.

4. How we use your information

We use personal information for the following purposes:

• To deliver services you request — scheduling, dispatching, performing the work, communicating with you about your appointment, providing estimates and quotes, billing and collecting payment, processing financing applications, and honoring warranties and maintenance plans.
• To operate, secure, and improve the Site and our business — diagnostics, analytics, fraud prevention, spam protection, abuse monitoring, debugging, and product/service improvement.
• To communicate with you — respond to your inquiries, send service reminders and follow-ups, notify you about safety recalls or maintenance opportunities relevant to equipment we installed or service, and (with your consent where required) send marketing about promotions, financing offers, and seasonal tune-up campaigns.
• To market our services — measure advertising effectiveness and personalize the offers you see on our Site and on third-party platforms, subject to your privacy choices.
• To comply with law and protect rights — respond to legal process, enforce our Terms of Service, protect the safety of our team and customers, and defend or pursue legal claims.

5. How we disclose your information

We do not sell your personal information for money. We do disclose personal information to the following categories of recipients for the purposes described above:

• Service providers and processors acting on our behalf under written contracts that restrict their use of the data, including:
  • Field-management, scheduling, dispatch, and online booking (Housecall Pro)
  • Payment processing (the processor integrated with Housecall Pro)
  • Financing (Synchrony)
  • Hosting, content delivery, security, backup, and analytics infrastructure (Amazon Web Services, Cloudflare, Google)
  • Call tracking and call recording
  • Website chat (LeadConnector chat widget)
  • Email, SMS, and transactional messaging providers
  • Marketing, advertising, and conversion-measurement partners (Google) — subject to your privacy choices
  • Professional advisors (lawyers, accountants, insurers, auditors)
• Affiliates and successors in connection with a merger, acquisition, reorganization, asset sale, financing, or similar transaction. We will require the recipient to honor this Policy with respect to your information.
• Government, law enforcement, and other parties where we believe disclosure is required by law, court order, subpoena, or to investigate fraud, protect safety, or defend our legal rights.
• With your direction or consent — for example, when you ask us to coordinate with a home-warranty company, landlord, HOA, real-estate agent, or insurer.

6. “Sale” and “share” / targeted advertising disclosure

We do not sell personal information for monetary value. However, the Colorado Privacy Act (“CPA”) and the California Consumer Privacy Act as amended by the CPRA define “sale,” “sharing,” and “targeted advertising” broadly. Our use of third-party advertising and analytics cookies to measure and improve our marketing may constitute “sharing” or processing for “targeted advertising” under those laws.

You can opt out of this processing at any time using any of the following:

• Use the privacy-choices banner on this Site and choose Decline.
• Send a Global Privacy Control (GPC) signal from your browser. We treat a valid GPC signal as a universal opt-out of targeted advertising and the sale or sharing of personal information — no other action needed.
• Email us at [email protected] with the subject “Opt out of targeted advertising.”

Opting out does not stop all advertising — you will still see ads, but they will be less tailored to you.

7. SMS and text-message terms (TCPA & A2P 10DLC)

Express consent: by checking a consent box on one of our web forms, texting a keyword to (720) 790-3765, or otherwise affirmatively opting in, you agree to receive recurring transactional and promotional SMS messages from Colorado Bear Heating & Air at the mobile number you provided, including messages sent using automated technology. Consent is not a condition of purchase.

Message frequency: message frequency varies. You may receive appointment reminders, on-the-way notifications, follow-up messages after service, and occasional promotional offers.

Costs: message and data rates may apply. Check with your wireless carrier.

Opt out: reply STOP to any message to unsubscribe. You will receive a final confirmation. To resubscribe, reply START. For help, reply HELP or contact [email protected] or call (720) 790-3765.

Mobile-information privacy: we will not share your mobile phone number or SMS opt-in status with third parties or affiliates for their marketing or promotional purposes. Information shared with service providers is limited to what is required to deliver the messages (carrier delivery, fraud prevention, support).

Carriers are not liable for delayed or undelivered messages. Supported carriers include AT&T, T-Mobile, Verizon, U.S. Cellular, and other major U.S. carriers.

8. Cookies, pixels, and online tracking

We use the following categories of cookies and similar technologies:

• Strictly necessary — required for the Site to function (security, spam protection, load balancing, remembering your privacy choices). These cannot be disabled.
• Analytics — help us understand which pages and features are useful (Google Analytics 4 via Google Tag Manager container GTM-TBMMK56).
• Advertising measurement — help us measure ad performance (Google).

How consent works on this Site: for visitors in the United States and other opt-out jurisdictions, analytics and advertising measurement run by default and you may opt out at any time. For visitors in the European Economic Area, the United Kingdom, and Switzerland, analytics and advertising storage are off by default and are enabled only if you accept them. If your browser sends a Global Privacy Control (GPC) signal, we automatically treat advertising and analytics storage as declined, with no action needed from you.

You can change your choice at any time using the privacy-choices banner. You can also block cookies in your browser settings, but parts of the Site may not function correctly.

Browser-level opt-outs for the major advertising networks: Google Ads Settings, NAI opt-out, DAA opt-out.

9. Analytics

We use Google Analytics 4 (via Google Tag Manager container GTM-TBMMK56) to understand Site usage. Google Analytics may set cookies on your device and collect IP address, device information, and behavior data. You can opt out by installing the Google Analytics opt-out browser add-on , by declining optional tracking in our privacy-choices banner, or by sending a GPC signal.

10. Your Privacy Choices — Do Not Sell or Share My Personal Information

This section is our “Do Not Sell or Share My Personal Information” notice. It applies to all visitors, with specific rights for California and Colorado residents described below. Last updated: July 17, 2026.

10.1 Your California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CPRA”), gives you the following rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purposes, and the categories of third parties to whom we disclose it.
• Right to delete — request deletion of your personal information (subject to legal exceptions).
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — direct us not to sell your personal information or share it for cross-context behavioral advertising.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information from Site visitors, so no limitation is needed.
• Right to non-discrimination — we will not deny you services, charge different prices, or provide a different quality of service because you exercised any of these rights.

Categories we collect (see § 3 for detail): identifiers and contact details (name, phone, email, address) submitted through our forms and chat; internet activity (pages viewed, clicks — via Google Analytics 4 / Google Tag Manager GTM-TBMMK56); approximate location derived from IP; call metadata from our call-tracking provider; spam-protection signals from Google reCAPTCHA; and commercial information about the services you request (booking via Housecall Pro, financing status from Synchrony).

Sale/sharing disclosure: we do not sell personal information for money. Our use of advertising and analytics cookies may be considered “sharing” for cross-context behavioral advertising under the CPRA. We do not knowingly sell or share the personal information of consumers under 16 years of age.

10.2 How to opt out of sale/sharing

• On this Site: open the privacy-choices banner and choose Decline. Your choice is stored and re-applied on return visits.
• Global Privacy Control: we honor the GPC browser signal as a valid opt-out of sale/sharing and targeted advertising, automatically and without any interaction.
• By email or phone: email [email protected] with the subject “Do Not Sell or Share” or call (720) 790-3765.

10.3 Your Colorado privacy rights (CPA)

Colorado residents have the following rights under the Colorado Privacy Act (C.R.S. §§ 6-1-1301 et seq.) and the Colorado Privacy Act Rules (4 CCR 904-3):

• Right to access — confirm whether we process your personal data and obtain a copy.
• Right to correct — inaccuracies in your personal data.
• Right to delete — your personal data (subject to legal exceptions).
• Right to data portability — in a portable, readily usable format.
• Right to opt out of (a) the sale of personal data, (b) processing for targeted advertising, and (c) profiling in furtherance of decisions producing legal or similarly significant effects.
• Right to appeal — if we decline your request, you may appeal by replying to our response or emailing [email protected] with “Privacy appeal” in the subject. If you remain dissatisfied, you may contact the Colorado Attorney General’s Office.

10.4 How to exercise your rights

Email [email protected] with the subject “Privacy request,” or call (720) 790-3765 and ask for the privacy officer. We will verify your identity using the information we already have on file (name, contact details, and recent service interactions) and respond within 45 days. If your request is complex, we may extend by another 45 days and will tell you why.

Authorized agents: you may designate an authorized agent to make a request on your behalf. We require written, signed authorization and may take reasonable steps to verify both your identity and the agent’s authority.

No discrimination: we will not deny you services, charge different prices, or provide a different quality of service because you exercised any of these rights.

11. Data retention

We retain personal information only as long as needed for the purposes described in this Policy and to comply with our legal, accounting, and reporting obligations:

• Service and customer records — for the life of the customer relationship plus seven (7) years (warranty, tax, and limitations-of-action requirements).
• Marketing and analytics data — up to twenty-six (26) months (the default Google Analytics 4 retention).
• Call recordings and call metadata — up to twelve (12) months unless flagged for a dispute or quality-assurance hold.
• Job applicant data — up to two (2) years after the application date, unless you are hired (in which case employee retention rules apply).

When the retention period ends, we securely delete or de-identify the data.

12. Security and payment security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, alteration, and destruction. These include encryption in transit (TLS), role-based access controls, employee confidentiality obligations, regular updates of our systems, and use of reputable service providers. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping any account credentials confidential and for notifying us promptly of any suspected unauthorized use.

Payment security: this website never collects, transmits, or stores payment-card data. Online payments are handled entirely by the payment processor integrated with Housecall Pro, in the processor’s own PCI-compliant environment. Financing applications are completed on Synchrony’s own secure website. We see payment confirmations and financing decisions — never your card number.

13. Children’s privacy

Our Site and services are intended for adults and are not directed to children under thirteen (13). We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please email [email protected] and we will delete it promptly. This complies with the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506).

14. Third-party links and services

Our Site contains links to third-party websites, applications, and services (for example, Synchrony for financing, Housecall Pro for online booking and payment, Google Maps for directions, and our social-media profiles). We are not responsible for the privacy practices or content of those third parties. Please review their privacy policies before providing information.

15. AI features on the Site

Portions of our Site (including the chat widget, content generation, and after-hours booking assistance via Housecall Pro) use artificial-intelligence systems. Conversational AI may use the information you submit to respond, schedule, and generate transcripts. Human team members supervise these systems but cannot review every interaction in real time. Do not submit sensitive personal information (such as government identification numbers, payment card data, or health information beyond what is needed for an HVAC service request) through AI-assisted chat or forms. See also the AI disclaimer in our Terms of Service.

16. Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. There is no industry standard for how websites must respond, so we do not respond to DNT signals. We do honor the Global Privacy Control (GPC) signal as described in § 6 and § 10.

17. International users

Our Site is operated from the United States and is intended for residents of Colorado and neighboring states. If you access the Site from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States.

18. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, the law, or our services. The “Last updated” date at the top reflects the most recent revision. Material changes will be highlighted on this page or communicated by other reasonable means. Continued use of the Site after changes take effect indicates your acceptance.

19. Contact us

Colorado Bear Heating & Air
Attn: Privacy Officer
2237 Deer Holw Trl, Castle Rock, CO 80104
Phone: (720) 790-3765
Email: [email protected]