Privacy Policy

1. Introduction

This Privacy Policy explains how ONE PPF Inc. (“ONE PPF,” “Company,” “we,” “us,” or “our”) collects, uses, stores, and protects information when you access our website, submit inquiries, apply for dealer programs, or otherwise interact with our services (collectively, the “Services”).

By using the Services, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Services.

2. Scope & Relationship to Other Documents

This Privacy Policy:

• Applies to website visitors, leads, customers, and dealers
• Governs data handling only
• Does not create dealer rights, employment rights, or warranty coverage

Dealer obligations are governed solely by executed Dealer Agreements.

Employee data is governed by employment agreements and HR policies.

3. Information We Collect

A. Information You Provide

• Name, email address, phone number (including mobile)
• Business name and contact details
• Dealer application information
• Support inquiries or communications
• Preferences and opt-in selections

Appointment scheduling. If you book a call or appointment through a scheduling tool on our site, you provide your name, email address, phone number, and any details you enter for the appointment. This information is collected and processed through Google Appointment Scheduler / Google Calendar to schedule and manage the appointment, and is subject to Google's privacy practices in addition to this Policy.

B. Information Collected Automatically

• IP address, browser type and device info
• Operating system
• Pages viewed and time spent
• Referring URLs
• Approximate geographic location (derived from IP)

C. Cookies & Similar Technologies

• Used for site functionality
• Analytics and performance monitoring
• User experience improvements

You may disable cookies in your browser, but some features may not function properly.

4. How We Use Information

• Operate and maintain the Services
• Respond to inquiries and support requests
• Process dealer inquiries and onboarding
• Communicate service-related updates
• Send marketing communications (where permitted or consented)
• Improve products, services, and user experience
• Prevent fraud and protect security
• Comply with legal and regulatory obligations

5. SMS / Mobile Communications

If you provide a mobile number and opt in: message frequency varies, standard message/data rates may apply, you may opt out at any time by replying STOP.

Important: ONE PPF does not sell, rent, trade, or share mobile numbers with third parties for marketing or promotional purposes.

6. Information Sharing

We share information only in limited circumstances:

• With service providers performing services on our behalf (e.g., hosting, analytics, email/SMS delivery)
• To comply with legal obligations or protect rights
• In connection with a business transaction (merger, acquisition, asset sale)

We do not sell your personal information for money, and we do not share personal information for third-party marketing except for the advertising and conversion measurement described in Section 6A below, which you can decline through the cookie banner.

Service providers we currently use include: Resend (transactional email delivery), Mailgun and AWS SES (bulk and transactional email), Microsoft 365 (mailbox), ShipEngine (shipping and fulfillment), Stripe (payment processing), Google Analytics (website analytics), Microsoft Clarity (product analytics, heatmaps, and aggregate usage measurement), PostHog (product analytics and usage measurement), Sentry (application error and performance monitoring), Google Ads and Meta (Facebook/Instagram) (advertising and conversion measurement, see Section 6A), Google Places (address autocomplete), and Google Appointment Scheduler / Calendar (appointment booking on pages that embed the scheduler).

We use Google's appointment scheduling tool, embedded on pages of our site, to let you book calls with us. When you interact with the scheduler, Google processes your booking information as a service provider and may set cookies. See Google's Privacy Policy at policies.google.com/privacy.

6A. Third-Party Advertising and Conversion Measurement

When you complete a purchase, ONE PPF shares a conversion (purchase) event with our advertising and measurement partners, Google (Google Analytics 4 / Google Ads) and Meta (Facebook/Instagram), to measure the performance of our marketing, attribute sales to campaigns, and improve our advertising. This sharing occurs in two ways:

• In your browser: advertising and conversion tags (Google and Meta pixels) may set or read cookies and device identifiers (for example _ga, _fbp, _fbc) and send a purchase event.
• From our servers: we also send the same purchase event directly from our servers to Google and Meta (server-side conversion measurement).

What is shared: the fact and time of a purchase, an order identifier, the order value and currency, and online identifiers (advertising/measurement cookies or device identifiers). Our server-side measurement may also include hashed (irreversibly transformed) identifiers such as a hashed email or phone number used only to match the event to an ad interaction.

What is NOT shared: we do not share your raw payment card details, and we do not sell your personal information for money.

Purpose and lawful basis: advertising measurement, attribution, and optimization, on the basis of your consent where required (see your controls below) and otherwise our legitimate interest in measuring our marketing.

Your controls: these tags are in the Marketing cookie category. You can decline or withdraw them through the cookie banner or the Your Privacy Choices link in our footer (see our Cookie Policy). We honor browser Do Not Track and Global Privacy Control (GPC) signals: when present, our advertising and conversion measurement, including the server-side measurement, is disabled or suppressed regardless of prior consent. California residents may exercise the right to opt out of sharing for cross-context behavioral advertising (CCPA/CPRA Section 1798.135).

Partners: Google (GA4 / Google Ads) and Meta (Meta Pixel / Conversions API). See our Cookie Policy for the cookie and pixel detail.

7. Data Retention

We retain information only as long as reasonably necessary to fulfill the purposes described in this Policy, comply with legal obligations, and support legitimate business needs.

8. Security

We implement reasonable administrative, technical, and organizational safeguards to protect information. However, no system is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Services are not intended for individuals under 18. We do not knowingly collect personal information from minors. If discovered, such data will be deleted. This is a B2B platform for dealers and installers; we do not market to or knowingly collect data from individuals under 18. The under-18 threshold reflects both COPPA (which protects individuals under 13) and general contract law (which generally requires the age of majority for binding agreements). Where COPPA applies, we treat individuals under 13 the same as individuals under 18.

10. Your Rights & Choices

Depending on your location, you may have the right to:

• Request access to your personal information
• Request correction or deletion
• Opt out of marketing communications

Requests may be submitted to: sales@onepaintprotection.com

10a. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• The right to know what categories of personal information we collect and how we use it
• The right to request deletion of personal information we have collected from you
• The right to opt out of the sale of personal information, note that ONE PPF does not sell personal information
• The right to non-discrimination for exercising any of these rights

To exercise any of these rights, contact us at sales@onepaintprotection.com. We will respond within the timeframes required by law.

10b. Connecticut Privacy Rights (CTDPA)

If you are a Connecticut resident, the Connecticut Data Privacy Act (CTDPA), enacted in 2023, provides you with additional rights regarding your personal data:

• The right to confirm whether we are processing your personal data and to access that data
• The right to correct inaccuracies in your personal data
• The right to request deletion of personal data we have collected
• The right to opt out of targeted advertising and the sale of personal data, note that ONE PPF does not sell personal data
• The right to non-discrimination for exercising any of these rights

To exercise any of these rights, contact us at sales@onepaintprotection.com. We will respond within the timeframes required by the CTDPA.

11. Do Not Track and Global Privacy Control

We honor browser Global Privacy Control (GPC) and Do Not Track (DNT) signals for advertising and conversion measurement: when either signal is present, our marketing and advertising tags and our server-side conversion measurement are disabled regardless of any prior consent, as described in Section 6A. For other, strictly necessary site functionality we do not alter behavior based on these signals.

12. Transition & Operational Change Clause

ONE PPF may relocate, expand, or operate in additional jurisdictions. Such changes do not alter how personal data is handled under this Policy. This Policy remains effective unless expressly updated. Governing law remains as stated below unless revised in writing.

13. Governing Law and Arbitration

This Privacy Policy is governed by the laws of the State of Connecticut, without regard to its conflict of law provisions. Any dispute, claim, or controversy arising out of or relating to this Policy shall be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, with the arbitration seated in Hartford, Connecticut. Judgment on the arbitration award may be entered in any court of competent jurisdiction. In the event of any conflict between this Privacy Policy and the Terms & Conditions, the Terms & Conditions control.

14. Updates

We may update this Privacy Policy periodically. The “Last Updated” date reflects the most recent revision. Continued use of the Services constitutes acceptance.