Privacy Policy
How we collect, use, and protect your information.
Effective: April 25, 2026
RO Living Water (“we,” “us,” “our”) respects your privacy. This Privacy Policy explains what personal information we collect when you visit rolivingwater.com, request a quote, sign up for the 7-day free trial, or contact us, and how we use, share, retain, and protect that information. This notice is written to satisfy the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the “CCPA/CPRA”), Cal. Civ. Code § 1798.100 et seq.
1. Personal information we collect - per-category mapping
The table below maps each CCPA/CPRA category of personal information we collect to the sources we collect it from, the business or commercial purposes for which we use it, the categories of third parties we disclose it to, and whether we “sell” or “share” it as those terms are defined in Cal. Civ. Code §§ 1798.140(ad), (ah).
| Category | Examples we collect | Sources | Business purposes | Categories of recipients | Sold or shared? |
|---|---|---|---|---|---|
| A. Identifiers § 1798.140(v)(1)(A) | Name, business name, email, phone, IP address, account ID | Directly from you (forms, calls, email); automatically (server logs, cookies) | Respond to quote requests, schedule install, deliver service, send filter-swap reminders, customer support, fraud prevention | Service providers (email delivery, hosting, install partners, payment processor); legal authorities when required | No |
| B. Customer records § 1798.140(v)(1)(B) | Service address, billing address, invoice history | Directly from you | Install scheduling, recurring service, billing | Service providers (install partners, payment processor) | No |
| D. Commercial information § 1798.140(v)(1)(D) | Products considered or quoted, service plan length, install history | Directly from you; from our internal systems | Quote generation, service delivery, internal analytics | Service providers | No |
| F. Internet / network activity § 1798.140(v)(1)(F) | Pages viewed, referring URL, device type, browser, cookie IDs, ad-attribution identifiers if you arrive from a campaign | Automatically via server logs and Google Analytics 4 (with Consent Mode v2) | Site analytics, debugging, security, measure ad effectiveness if you opt in to analytics cookies | Analytics provider (Google LLC); CDN/host (Netlify) | No sale; no “sharing” for cross-context behavioral advertising. We honor Global Privacy Control signals. |
| G. Geolocation (approximate) § 1798.140(v)(1)(G) | City/region inferred from IP; service ZIP you provide | Automatically from IP; directly from you | Confirm we serve your area; route the right install team | Service providers (analytics, install partners) | No |
| K. Inferences § 1798.140(v)(1)(K) | Likely fit for a particular product (e.g., countertop vs floor-standing) based on team size you supply | Derived internally from data you provide | Recommend a model; tailor the proposal | Internal only | No |
We do not collect categories C (protected classifications), E (biometric), H (audio/visual), I (professional/employment), or J (education).
2. Sensitive personal information (CPRA § 1798.121)
We do not collect, use, or disclose any category of “sensitive personal information” as defined in Cal. Civ. Code § 1798.140(ae) - this includes Social Security number, driver’s license, financial-account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail/email/text, genetic data, biometrics for unique identification, health information, or sex-life/orientation information. Because we do not collect sensitive PI, the right to limit its use is not engaged. If our practices ever change, we will update this notice before beginning collection and provide a working Limit the Use of My Sensitive Personal Information request page.
3. How we use your information
- Respond to quote requests, schedule installs, and deliver ongoing service (filter swaps, sanitization).
- Send transactional communications (appointment confirmations, service reminders, invoices).
- Marketing communications you opt in to (only if you check the SMS or email opt-in box on a form).
- Improve the website and our services based on aggregated, de-identified usage data.
- Comply with legal obligations and enforce our Terms.
4. We do not sell or share your information
We do not sell personal information for money or other valuable consideration, and we do not “share” it for cross-context behavioral advertising as those terms are defined in CPRA. We have not done so in the preceding 12 months and have no current plans to. We honor browser-level Global Privacy Control signals as a valid opt-out request.
If our practices ever change, we will update this notice before a change takes effect and provide a working Do Not Sell or Share My Personal Information link in the footer.
5. Disclosures to service providers
We disclose limited personal information to vendors that help us operate, under written contracts that prohibit them from using your data for any purpose other than the service we contracted for. Current categories:
- Hosting / CDN: Netlify, Inc. - serves the website.
- Analytics: Google LLC (Google Analytics 4 with Consent Mode v2 set to “denied by default” until you accept analytics cookies).
- Email delivery: Google Workspace (Gmail) - transactional and quote-reply email.
- Install partners: Steve and Jonah Stiles personally, plus, occasionally, a vetted independent plumber for the in-home/in-office install.
- Payment processing: Stripe, Inc. - collects card details directly from you on Stripe-hosted pages; we never see the card number.
6. Cookies and tracking technologies
We use a small number of cookies and similar technologies. The categories appear in the cookie banner and you can re-open it any time via the Cookie Settings link in the footer.
- Strictly necessary - site functionality, consent state. Always on.
- Analytics - Google Analytics 4. Off by default; on only if you click “Accept” or set the analytics toggle.
- Advertising - we do not currently set advertising cookies.
7. Your CCPA/CPRA rights
If you are a California resident, you have the right to:
- Know what personal information we have collected about you, the sources, the purposes, and the categories of recipients (Cal. Civ. Code § 1798.110, § 1798.115).
- Delete personal information we have collected from you (§ 1798.105), subject to exceptions in § 1798.105(d).
- Correct inaccurate personal information (§ 1798.106).
- Opt out of the sale or sharing of personal information (§ 1798.120). See Do Not Sell or Share My Personal Information. We do not currently sell or share, but the request page is available.
- Limit the use of sensitive personal information (§ 1798.121). See Limit the Use of My Sensitive Personal Information. We do not currently collect sensitive PI.
- Non-discrimination - we will not deny service, charge a different price, or provide a different level of service because you exercised a privacy right (§ 1798.125).
- Authorized agent - you may use an authorized agent to submit a request on your behalf with written permission and verification of identity.
To exercise a right, email privacy@rolivingwater.com or call (707) 888-1234. We will verify your identity (typically by matching two pieces of information you have on file with us) and respond within 45 days, with one 45-day extension if needed and disclosed to you.
8. Data retention
| Category | Retention period |
|---|---|
| Lead form submissions (no install) | 24 months from last contact, then deleted |
| Active customer records | For the life of the service plan + 7 years (tax/contract retention) |
| Server / access logs | 90 days, then aggregated and de-identified |
| Google Analytics 4 (with consent) | 14 months at the property level |
9. Security
We use TLS 1.3 in transit, hardened HTTP security headers (CSP, HSTS, frame-ancestors self), encrypted storage, and access controls limiting personal information to the two owners. No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you in accordance with Cal. Civ. Code § 1798.82 and any other applicable law.
10. Children
Our services are for businesses and adults. We do not knowingly collect personal information from children under 13, and we do not sell or share the personal information of consumers we know to be under 16 (CPRA § 1798.120(c)). If you believe a child has provided personal information, contact us and we will delete it.
11. Notice at collection
This policy serves as the “notice at collection” required by Cal. Civ. Code § 1798.100(a). The categories of personal information collected and the purposes are listed in Section 1 above. We will not collect additional categories or use information for additional purposes without first updating this notice.
12. Out-of-state and EU/UK visitors
If you are outside California, you may have similar rights under your local law (e.g., Virginia VCDPA, Colorado CPA, Connecticut CTDPA, EU/UK GDPR). To exercise them, use the same contact methods in Section 7 and identify the law you are invoking.
13. Changes to this policy
We may update this policy. Material changes will be posted here with a new effective date and, where required by law, with notice to users.
14. Contact / DPO
RO Living Water, Santa Rosa, CA 95401. Email privacy@rolivingwater.com · Phone (707) 888-1234.