Privacy · effective 6 October 2026

What this site collects, and what it leaves alone.

What you type into the estimate form, the advertising tag that tells the platform whose ad you clicked that a request happened, and a recording of how the page was used — with every box you type into blanked out of it. Written from the site’s own code.

Call (469) 461-4497 Email us about your information

What this page is

A description of what this website does with what you tell it, written from the site’s own code rather than from a template.

The two lists below are built from the form itself every time this site is built. A box cannot be added to the form without turning up on this page in the same breath, which is the only way a page like this stays true for longer than a week.

It covers this website. It does not cover what is said on a phone call, and it is not a summary of your rights under any particular law. The short version of the part people usually want: if you would like something corrected or removed, ask us and we do it.

The site is for people arranging work on a door at a home or a business. It is not meant for children, and we do not knowingly collect anything from them.

What the form asks you for

Three steps. Everything on it is here, including the optional boxes.

Service: Which of the services you picked. It decides who comes out and what is on the van.
Phone number: The number we call back on. It is the number the box at the end of the form covers.
What’s going on?: Optional. Whatever you want to tell us about the door, in your own words.
Street address: The service address — the door we would be coming to look at.
City: Part of the same address. It is also what tells us whether you are inside the area we cover.
State: Part of the same address.
ZIP code: Part of the same address.
Apt/Suite #: Optional. Only so the technician finds the right door.
Gate code: Optional, and never required. It has a section of its own below.
Full name: What to call you when we ring.
Email for your receipt: Optional. If you give it, we send a confirmation of what you submitted. We call the phone number you gave to discuss the request.
When do you need service?: Optional. How soon you would like someone out. It is a preference you are telling us, not a booking. If you skip it we treat it as ASAP.

Two steps in, the form has the service, a number and an address. That is what a technician needs to call you back and find the door, and it is the reason the form asks for it.

What the page fills in on its own

Sent with the form when you press the button, without you typing it. All of it is read at that moment — none of it is watched or stored while you are reading.

What kind of request this is: A fixed word. Every estimate request is the same kind.
How to contact you: A fixed form version that tells our system a callback phone number is required and an email address is optional.
Which page you were on: The path of the page the form was on, so we know which page brought you.
Whether you came from an ad or not: One of two words. It keeps requests from an ad and requests from anywhere else countable apart.
Where to put you back: The same page path, so a failed send returns you to it with your answers still in the boxes.
The city named in the link you clicked: Only if an ad link carried one, and only from a fixed list of cities we cover. It is kept apart from the address you typed.
The page you came from: Whatever your browser reports as the previous page. Some browsers report nothing, and that is fine.
An advertising click id: A code an ad platform puts in the link when you click an ad. Taken from the address bar if it is there when you send the form; otherwise from the first page of this tab that carried it. Never your name, number, email or address.
An advertising click id: The same thing for the other platform.
An advertising click id: A second form of the same Google code, used on some phones instead of the one above. Read the same way.
An advertising click id: The third form of the same Google code, for the same reason. Read the same way.
The end of an ad link: Kept when the address carried an advertising click id, or a paid campaign parameter such as a cpc medium or a bing or google source — up to 512 characters. The words of a search on their own are not kept. A later page in the same tab still has the first ad link.
What you agreed to: A fixed phrase recording that the agreement was about this request.
Which wording you were shown: The date of the sentence printed at the end of the form, so which words you actually saw can be checked later.

There is one more box on the form, hidden from you and left empty: automated junk fills it in and gets dropped for it. If you have never seen it, it is working.

What this site does not do

Checked against every page of this build on 6 October 2026, and re-checked by the build’s own gate each time the site is rebuilt. If any of it stops being true, this page stops saying it.

No cookie of our own.
The pages themselves set none. The recorder named below does: _clck and _clsk, on this site’s address, are what make the pages of one visit read as one visit rather than five strangers. Five more — CLID, ANONCHK, MR, MUID and SM — are set by Microsoft on Microsoft’s own address as part of running that service; they are Microsoft’s cookies rather than ours, and Microsoft publishes what each is for. The chat window and, on the advertising pages, the advertising tags may set theirs too. Every one of them is named below.
Our own code keeps a few small notes, and nothing personal.
When you send the estimate form, this site’s own code writes down which service you picked and, if you arrived from an ad naming a city, that city — so the page that thanks you can tell us which kind of request came in. It is removed the moment that page reads it. The page also remembers that your request was counted once, so a reload does not count it twice. If a request is refused and the page has to reload, it keeps the reason for a moment, so the form can say why when you are back on it. If an advertising link carried a click code, or a paid campaign parameter, that code and the end of that ad link are kept for this tab so they are still there if you send the form from a later page. Search words alone are not kept as that note. None of those notes holds your name, your number, your email or your address, and none leaves your browser.
Form fields are masked in session recordings.
Visits here are recorded — the recorder is named below — and every box on every form is blanked out of that recording by its input masking, so your name, your phone number, your address, a gate code and whatever you write in the details box are masked that way. We cannot guarantee every third-party widget surface (for example the chat window) is masked the same way.
No location request.
The site never asks your browser where you are.
No payment, ever, on this site.
There is no card field on any page. Work is paid to the technician or on an invoice, never here.
No account and no password.
There is nothing to sign into.
Nothing sold or handed on for advertising.
Nothing you put in the estimate form is sold or handed on for advertising. On the advertising pages, Microsoft receives its own advertising identifiers to connect a visit to the Bing ad that brought it; it does not receive your form values.
No analytics beyond one advertising tag and the recorder.
No Google Analytics, and no tag container on these pages. The Microsoft Advertising tag and the session recorder named below are the whole of what measures anything here, and they are on these pages because you reach them from an ad.

The five things loaded from somebody else

Each one is loaded from that company’s own address, so each one sees your IP address when the page loads. Here is every one of them and what it does.

Cloudflare Turnstile
checks the estimate form for automated abuse. Loading it means Cloudflare sees your IP address and some ordinary signals from your browser, which is how it tells a person from a script. It is the alternative to making you pick out traffic lights.
CloseBot
is the chat window on every page. Loading it means CloseBot sees your IP address. If you open it and type, what you type goes to CloseBot and on to us, and it is handled as configured in CloseBot. If you never open it, it collects nothing you typed.
Microsoft Advertising (UET)
is the tag for the ads on Bing. It tells Microsoft that its ad brought a visit; that you tapped a Call or a Text button, and from which part of the page; and on the page after you send the form, that a request was sent, with the kind of service and the city, and never your name, number, email or address. It may set its own cookies on this site’s address, and may connect the visit to Microsoft’s advertising identity, which is how it connects the Bing click to the request.
Google Maps and Google Places
do two things on this site. The map of the cities we serve is drawn by Google Maps, and nothing loads it until you scroll to the map — if you never do, Google is never asked for anything. The map is a picture of where we work; it does not know where you are, and the site never asks for your location. The address box on the estimate form suggests addresses as you type, and that part works the other way round: from the moment you put the cursor in it, what you type in that one box is sent to Google so it can offer matches, and if you pick one, Google returns the full address and the form fills the city, state and ZIP for you. Nothing else you type on the form goes to Google — not your name, your number, your email, or what is wrong with the door. If you would rather Google saw none of it, type the address out and ignore the suggestions; the box is an ordinary text field and the form works exactly the same. Either way Google sees your IP address and the ordinary signals any request to a company carries, and may set its own cookies.
Microsoft Clarity
records the visit, so we can see where people get stuck instead of guessing: pointer movement, taps and clicks, scrolling, and how the page looked while it was on your screen. Form fields on this site’s own forms are blanked out of that recording by its input masking, so your name, your phone number, your address, a gate code and whatever you write in the details box are masked that way. We cannot guarantee every third-party widget surface (for example the chat window) is masked the same way. Microsoft keeps a recording for 30 days. It sets the cookies named above, which is what joins the pages of one visit together. We label each recording with the page, the service it is about, the kind of form on it and, when an ad or a search named one of the cities we serve, that city, or one of the door problems this site describes — never anything you type, the address you arrived from, or an ad click id — and we mark the moments a form is started, a step is reached, a form is sent, a call or text button is tapped and the chat is opened, so we can see where the pages help and where they do not.

That is the entire list. Everything else on every page loads only from this site — the typefaces are served from here rather than from a font service, so no font service is told what you are reading. A check in the build fails if any other outside address ever appears on a page, so this list cannot grow quietly.

Where it goes when you send it

In this order:

The Turnstile check is confirmed. If it does not pass, nothing goes further.
The hidden box is checked. If it was filled in, the message is dropped.
The address is checked against the area we cover.
The request is stored, with the click id if there was one, in a database we run on Cloudflare (a D1 database) — the record dispatch works from and the paperwork for the job is kept against.
An email goes to our office through SMTP2GO, our email provider. If you gave an optional email address, a confirmation of what you sent goes to you too.
You are sent to the page that says a person will call you back.
If you arrived from an ad, the click id stored with the request is later matched by us against that advertising platform’s records to tell it that the click led to a request. The platform is told that it happened. It is not told what you wrote.

The site itself and the database are on Cloudflare. So: Cloudflare, SMTP2GO, and — only for the fact that a request happened — the advertising platform whose ad you clicked. Nobody else.

The gate code

The form has a box for a gate code, and it is the one thing on it that is a key to your property.

It is optional and it is never required. You can leave it blank and give it to the technician on the phone when they call to confirm — plenty of people do, and it is the option we would pick. Nothing about your request is treated differently either way.

If you do type it, it is kept with the job in the same place as your address, included in the email that tells our office about your request, seen by the office and the technician assigned to your door, and kept for as long as we keep the job. You can ask us to take it out on its own, at any time, without touching the rest of the record — the same way as anything else.

The last thing on the form is a box, and this is exactly what it says:

I agree that Heather Window & Door may call or text me at this number about this request. Message and data rates may apply; texting STOP ends messages.

It has to be ticked to send the form, because being called back about the door is the whole point of sending it. If you would rather not agree to that, call us instead on (469) 461-4497 — nothing is recorded on this website at all when you do.

What you are agreeing to is this request, and it is recorded that narrowly. It is not an agreement to marketing, and we do not use it for any. Reply STOP to any text and the texts end; say so on the phone and that works too.

The wording above is dated in the site’s code, and the date is sent with your request, so which words you were actually shown can be checked afterwards rather than taken on trust. The version in use is 7 September 2026.

How long we keep it, and how to have it removed

We keep it until you ask us not to. There is no other timer on it.

To have your information corrected or removed, email contactus@heatherwindowanddoor.com, or call (469) 461-4497. Tell us the address or the phone number you gave us, so we can find the right record. You do not have to give a reason.

One thing worth knowing before you ask: if we have done work at your address, the written estimate and the invoice are the paperwork behind the warranty on that job. Removing the record removes those too. Ask anyway if that is what you want — we will tell you what is about to go, and then do it.

The recordings are the one thing here with a clock already on it. Microsoft holds a recording of a visit for 30 days and then it is gone. What is in one: where the pointer moved, what was clicked, how far the page was scrolled, and how the page looked while it was on your screen. What is never in one: anything typed into a box on a form, because Microsoft masks input boxes in every one of its masking settings and a website cannot switch that off.

Microsoft has also enforced consent signals sent by a visitor’s browser since 31 October 2025, for visits from the European Economic Area, the United Kingdom and Switzerland. A visit from one of those places is handled under that rule rather than under this paragraph.

Microsoft also says Clarity supports Global Privacy Control, the signal some browsers and browser extensions send on your behalf to say you do not want to be tracked. If yours sends it, it reaches Microsoft with the visit.

When this page changes

This page is effective 6 October 2026. It is generated from the build, so it changes when the build changes rather than on a review cycle — if a box is added to the form or anything in the list above stops being true, this page is different as soon as the site is rebuilt.

Questions about any of it: contactus@heatherwindowanddoor.com, or (469) 461-4497.

Back to your estimate