Privacy Policy
Plain answers about what we collect when you ask for a contractor match, who receives it, how long we keep it, and how to see, correct, delete or stop the sale of your information.
- Free for homeowners
- Licenses checked at CSLB
- You contract directly with your pro
This policy explains how ProjectThunder.com, Inc., a California corporation that runs Coachella Valley Remodeling (mailing address: 42-215 Washington St. Suite A #168, Palm Desert, CA 92211), collects, uses, sells, shares and protects personal information. We're a contractor referral service, not a contractor. The policy covers this website, our phone calls, texts and emails, and the forms on this site.
The short version
- We collect what you tell us about yourself and your project, plus basic device data.
- We sell your contact and project information to our partner contractor, which pays us a fee. We work with one partner contractor. We tell you who it is, and you approve the introduction, before it receives anything. Your text-message opt-in and consent are never part of that sale: they are never sold or shared with anyone.
- We look up public property records for some addresses to decide how quickly to follow up. We never use them for credit or eligibility decisions, and they never leave our own systems.
- Advertising tools are off unless we turn them on and you accept them in the cookie banner, and they never load when your browser sends a Global Privacy Control signal.
- If you use our kitchen makeover preview, your kitchen photos go to an AI image provider (OpenAI or Google) only to create the concepts, and are never used to train AI models.
- If you use one of our AI tools (handyman photo triage, cabinet advisor, permit and HOA checker), your photos and answers go to an AI provider (OpenAI or Google) only to produce your result, and are never used to train AI models (see “AI tools”).
- When you arrive from one of our paid ads, we log the visit to detect click fraud (see “Paid ad clicks and fraud prevention”).
- You can ask to see, correct or delete your information, and you can opt out of its sale or sharing at any time on our Do Not Sell or Share page. You can delete what you sent through our forms yourself, any time, on the Delete my data page.
Notice at Collection
This is our California Notice at Collection. It's also linked next to every form's submit button, and the full table is on the Notice at Collection page.
We collect: your name, phone and email; the project address or ZIP, property type, occupancy and HOA status; the project details, budget range, timeline and photos you send; your contact preferences and consent record; and device and usage data (pages visited, the page you arrived on, the referring site and campaign tags).
Why: to refer you to our independent licensed partner contractor and contact you about your project, to keep proof of your consent, to prevent fraud and spam, and to understand which pages help people.
Sold or shared: we sell your contact and project information to our partner contractor, once you approve the introduction; it pays us a fee. Text-message opt-in data and consent are not part of that sale and are never sold or shared with third parties or affiliates. If advertising tools are turned on, we share device data with advertising partners. We do not collect Social Security, driver's license, passport or financial account numbers, and we don't ask for them.
How long we keep it: lead information for up to 24 months after your last contact with us; consent records for at least five years.
Do Not Sell or Share My Personal Information · Delete my data from previous form fills
What we collect and where it comes from
From you, through forms, calls, texts and email:
- Identifiers and contact details: name, phone, email, and the property address or ZIP.
- Property and project details: property type, whether it's your primary home, a second home or a rental, HOA status, what you want done, budget range, timeline, finish level, and anything you write in a message.
- Photos you add to a form (“Add photos of your space”) or text us. Up to 10 photos per request. Your browser may shrink large photos before sending them. Phones often store the location where a photo was taken inside the file. We keep that only with the original photo, use it only to confirm the project location, and strip it from any preview image we make. Photos wait on our web server, where they can't be opened from the web, only until our customer system confirms it has them, and are then deleted from the web server.
- Your choices and consent record: whether you agreed to calls and texts, the exact wording you saw, the time, your IP address and browser, and your preferred contact method and times.
- Call recordings, if a call is recorded. We tell you at the start of any recorded call.
- Kitchen makeover photos and concepts. If you use the kitchen makeover preview, the 1 to 3 kitchen photos you upload, the style and finish you pick, and the AI concepts we generate from them. See “AI kitchen makeover” below.
Automatically, from your browser:
- Device and usage data: IP address, browser type, the pages you view, the page you first landed on, the site that referred you, and campaign tags in the link (for example utm tags, or the click ID Google Ads adds to an ad link: gclid, gbraid or wbraid). The click ID is kept with your request so we can tell which ads lead to requests; we don't keep it, or pass it on, when your browser sends a Global Privacy Control signal or you've opted out.
Paid ad clicks. When you arrive from one of our paid ads (a link with a Google Ads click ID or a paid campaign tag), we log the visit for fraud prevention: time, the click ID and campaign tags, the page, your IP address, the network (ASN) and approximate city, region and country looked up from that IP in an offline database on our own server, your browser's user agent and language, the referring page, and, from a small script on that page, how long you stayed, how far you scrolled, whether you tapped or clicked, how far you got in a form, and signs of browser automation. It reads nothing you type. See “Paid ad clicks and fraud prevention” below.
From other sources:
- Public property records. For some projects with a full address, we look up property records from a property-data provider: estimated value, year built, square footage, last sale and whether the home appears owner-occupied. See the next section for the limits on how we use it.
- Address suggestions. On the address step of some forms, a search box suggests matching addresses as you type. It uses Google Maps Platform (the Places API): what you type in that box, your IP address and browser details go to Google to produce the suggestions, under Google's privacy policy. When you pick a suggestion we keep Google's place ID and the map coordinates with your request, to confirm the project location. The box doesn't load when your browser sends a Global Privacy Control signal or you've opted out, and you never have to use it.
From our partner contractor, limited to the status of your project (for example, whether an estimate happened), so we can follow up with you.
Property records: what they're for, and what they're never for
Property records help us decide which requests a coordinator should call first and whether a job fits our partner contractor's license and capacity. That's all. We never use property records, or anything we infer from them, to make or influence decisions about credit, financing, insurance, housing, employment or anyone's eligibility for anything. They stay inside our own customer system: we don't show them on this website, and we don't pass them to our partner contractor or sell them to anyone.
How we use personal information
- To refer you to our independent licensed partner contractor, and introduce you only if you approve.
- To call, text or email you about your project, with your consent where the law requires it.
- To check in during and after the project, and to mediate if something goes wrong.
- To prioritize follow-up, using an internal score built from your answers and, for some addresses, property records.
- To keep records that prove consent and honor opt-outs.
- To prevent spam, fraud and abuse, and to secure the site.
- To understand which pages and campaigns bring people to the site and improve them.
- To comply with the law and respond to legal requests.
We don't use your information to make automated decisions with legal or similarly significant effects on you.
Who receives it
Our partner contractor, if you approve. We sell your contact and project information, including photos and a record of your consent to its calls, to our one partner contractor, which pays us a fee. That sale never includes your text-message opt-in or text consent, and the partner may not text you under our consent. We name the contractor, with its CSLB license number, and get your OK first; no other contractor receives your information. It is an independent business with its own privacy practices, and our written agreement limits its use of your information to your project, bars it from reselling or sharing it, and requires it to honor your opt-out and deletion requests. Our partner is listed on our contractor partners page.
Service providers that work for us under contracts limiting their use of your information to that work: website hosting and security, our customer database (which stores the photos you send), phone, text and email delivery, address autocomplete and address validation (Google Maps Platform), bot protection on the makeover preview and the AI tools (Cloudflare Turnstile), AI image generation for the makeover preview and AI analysis for the AI tools (OpenAI or Google, see below), and the property-data provider.
Advertising and analytics partners, only if those tools are turned on and you accept them in the cookie banner. Today that means Google (Google Analytics, and Google Ads conversion measurement) and Microsoft (Clarity, which shows how visitors use our pages; it hides what you type into form fields). They would receive device and usage data, which counts as “sharing” under California law. For Google Ads that includes the fact that you sent a request (with the form type and a random reference number for the request) or tapped our phone number. We don't send Google your name, phone number, email or project details. They are off by default and never load when your browser sends a Global Privacy Control signal or you've opted out.
Fraud-prevention records about paid ad clicks stay in our own systems (our website and our customer database). If we ask Google for a refund of invalid clicks, we send Google the click IDs, times and reasons for the clicks we think were invalid, which Google already has from its own ad.
Legal and safety. When the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply.
Text messaging. Text-message opt-in data and consent are never shared with third parties or affiliates for their marketing. All of the categories above exclude text-message originator opt-in data and consent: they are never sold, rented or shared with any third party, including our partner contractor. Only Coachella Valley Remodeling texts you under your text consent. The providers that deliver our messages handle your number only to deliver them. If you approve an introduction, our partner contractor receives your phone number to call you about your project, not your text consent.
Sale and sharing, by category
In the last 12 months, and going forward:
| Category | Sold to | Shared for advertising with |
|---|---|---|
| Identifiers and contact details | Our partner contractor, with your OK | Not shared |
| Property and project details, photos | Our partner contractor, with your OK | Not shared |
| Consent record (calls only; never text-message opt-in or consent) | Our partner contractor, with your OK | Not shared |
| Device and usage data | Not sold | Advertising partners, only if those tools are on |
| Property records and internal score | Not sold | Not shared |
| Call recordings | Not sold | Not shared |
We don't knowingly sell or share the personal information of anyone under 16.
How long we keep it
| Information | How long |
|---|---|
| Lead information (contact details, project details, photos, property records, score) | Up to 24 months after your last contact with us |
| Call recordings | Up to 24 months after your last contact with us |
| Consent records (wording, time, IP, browser) | At least 5 years, to answer any legal claim about calls or texts |
| Opt-out and do-not-contact records | As long as needed to keep honoring them |
| Contractor applications | Up to 24 months after our last contact |
| Server and security logs | Up to 12 months |
| Paid ad click records | Raw IP address deleted after 90 days; the rest (network, approximate area, verdict) up to 120 days, then only totals |
| Kitchen makeover photos and concepts on our web server | Up to 30 days, then deleted (copies sent with a request you submit follow the lead information row above) |
| Cookies | See “Cookies” below |
If you ask us to delete your information, we keep only what we need to honor the request and to meet legal obligations: the date of the request (privacy request records are kept 24 months, as the law requires); a one-way copy of your email or phone coded with a secret key (hashed), so we never contact you again or bring your data back by mistake (without that key, which we keep apart from our records, it can't be turned back into your email or number); if you had already unsubscribed from our emails or replied STOP to a text, that opt-out (the email or number) so it keeps working; and, if you agreed to calls or texts, the date and wording of that consent, tied only to the coded phone number, for 5 years, to defend against legal claims. Conversion measurements already sent to Google can't be recalled; nothing more is sent after a deletion.
Your California privacy rights
If you live in California, you have the right to:
- Know what personal information we've collected about you, where it came from, why we use it, and who we've sold or disclosed it to, and get a copy.
- Delete personal information we collected from you, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of your personal information.
- Limit the use of sensitive personal information. We don't use sensitive personal information to infer anything about you, so this right doesn't change anything we do; ask if you have a question about it.
- Not be treated differently for using any of these rights. We won't deny you service, charge you more, or give you a lower-quality match.
How to make a request
- To opt out of sale or sharing: use the Do Not Sell or Share page. You don't need to verify your identity, and we act on it within 15 business days.
- To delete what you sent through our forms: use the Delete my data page (en español). Enter the email or the phone you used; we send a one-time 6-digit code (valid 15 minutes) to it to prove it's you, and when you confirm, we delete what you sent with that email or phone from our website and our customer system right away, including photos, texts, calls and recordings, and email you a confirmation. If our customer system is briefly unreachable, the deletion there is queued and finishes automatically.
- For any other request: call or email us using the details at the bottom of every page, or use the opt-out form and say what you'd like.
We'll confirm we received a request to know, delete or correct within 10 business days and answer within 45 calendar days. If we need more time, we'll tell you why, and may take up to 45 more days. To protect you, we verify these requests by matching details you give us, usually the email or phone you used on our form, and we only ask for what we need to do that.
An authorized agent can make a request for you with your signed permission. We may ask you to confirm your identity with us directly.
When you delete or opt out, we tell our partner contractor if we already sent it your information (for a deletion, by email right away), and it has agreed to honor it. A deletion made on the Delete my data page counts as verified (you proved you control the email or phone with the code), so we don't ask for anything more.
Global Privacy Control and Do Not Track
We treat a Global Privacy Control signal from your browser as a valid request to opt out of sale and sharing for that browser, and when we've applied it you'll see “Opt-Out Request Honored” at the bottom of the page. With the signal on, we don't load advertising or analytics tags, and we flag any request you send from that browser as opted out.
We don't respond differently to the older “Do Not Track” browser setting, which has no agreed meaning. GPC does what most people want Do Not Track to do.
Calls and texts
We call or text only about your request, and only with your consent where the law requires it. Consent is never a condition of any purchase, and you can choose email only. Reply STOP to any text, or tell us on a call, and we'll stop and tell our partner contractor to stop too. We call between 8 a.m. and 9 p.m. Pacific. If a call is recorded, we'll say so at the start. Our SMS Terms explain our text messages: what we text about, how often, rates, STOP and HELP. Text-message opt-in data and consent are never shared with third parties or affiliates for their marketing. We do not sell or share your SMS opt-in data, or the personal information you give us when you agree to texts, with third parties for marketing purposes.
Emails about your request (a confirmation, the contractor we introduce, an appointment) are part of the service. If we ever send marketing email, it will include our mailing address and a one-click unsubscribe that we honor within 10 business days.
Cookies
Our cookie notice has the details. In short, the site sets only first-party cookies it needs to work, and nothing else by default:
| Cookie | What it does | How long |
|---|---|---|
| cvr_af | Protects forms from forgery | Until you close your browser |
| cvr_ft | Remembers how you first found the site (landing page, referring site, campaign tags and, if you came from a Google ad, the ad click ID), so a request can be attributed. Read only by our server and never sent to Google by the site; no click ID with Global Privacy Control or an opt-out | 90 days |
| .AspNetCore.Mvc.CookieTempDataProvider | Carries your first name, contact preference and a one-time reference for your request to the thank-you page | Until that page is shown |
| cvr_consent | Remembers your choice in the cookie banner | 1 year |
| cvr_optout | Remembers that you opted out of sale and sharing on this browser | 2 years |
| cvr_mk | Kitchen makeover preview and the AI tools only: a random ID that limits uses per browser and keeps your photos, concepts and results visible only to you | 1 day |
A cookie banner asks before anything optional is used. Analytics cookies stay off unless you click “Accept analytics”, and Google Ads cookies stay off unless you click “Accept analytics & ads” (that button replaces “Accept analytics” when Google Ads measurement is turned on). Neither ever loads with a Global Privacy Control signal or an opt-out, whatever you clicked. Google Ads cookies are used only to measure which ads lead to a request or a call; we switch off ad personalization signals in that setup. Declining never stops you from using a form: the “I agree to the Terms, Privacy Policy and cookie notice” box on our forms covers only the essential cookies above, and the separate call-and-text consent box is never required to get a quote by email.
Address validation
When you enter a street address on a form or the makeover, our server sends that address (not your name or contact details) to Google's Address Validation API to check that it's a real, deliverable address, suggest a corrected spelling, and tell whether it's in the Coachella Valley. Google returns a standardized address, map coordinates and whether the address is residential. We keep that result with your request. If Google can't be reached, your request goes through anyway, marked “address not validated”.
AI kitchen makeover
The kitchen makeover preview sends the kitchen photos you upload (resized, with the location data inside the photo removed) and a description of the style you picked to an AI image provider, to generate “after” concepts of your kitchen. Today that is OpenAI (the OpenAI API) or Google (the Gemini API), whichever we have switched on; a small copy of your first photo may also go to the same provider to check that it shows a kitchen. Under those providers' API terms, the photos aren't used to train their models, and they keep API data only briefly, for abuse monitoring. We don't use your photos to train anything either.
Every generated image is labelled “AI concept: not a design, drawing or bid”. It isn't a design, a drawing, a measurement or a price. We keep the photos and concepts on our web server for up to 30 days. If you ask us to send the full set, your request (with the photos, the concepts and a written project brief) goes into our customer system and is kept as described under “How long we keep it”. Cloudflare Turnstile checks that a person, not a bot, is using the preview; it sees your IP address and browser details under Cloudflare's privacy policy. A cookie named cvr_mk limits each browser to a few previews a day and makes your photos visible only to your browser.
AI tools
Our handyman photo triage, cabinet advisor and permit and HOA checker send what you give them to an AI provider to produce your result: the photos you upload (resized, with the location data inside the photo removed) and your description or answers. For the permit checker, the AI gets only the facts we looked up for your address (which city or county, the projects you picked, whether an HOA is likely), not your street address. Today the provider is OpenAI (the OpenAI API) or Google (the Gemini API), whichever we have switched on; under their API terms your data isn't used to train their models, and we don't use it to train anything either. The permit checker also sends the address to Google's Address Validation API, as described above.
Every result is labelled “AI estimate, not a bid or inspection” (the permit checker: “verify with your city”). It never includes a price for your job. We keep the photos and results on our web server for up to 30 days. If you ask for the full write-up, your request (with the photos, your answers, the result and the write-up) goes into our customer system and is kept as described under “How long we keep it”, and we email or text you the write-up. Cloudflare Turnstile checks that a person is using the tools, and the cvr_mk cookie limits each browser to a few uses a day and keeps your results visible only to your browser. If what you describe sounds like a gas, electrical, water or structural hazard, the tool tells you to get safe and call 911 or your utility; it doesn't diagnose hazards.
Paid ad clicks and fraud prevention
Some businesses lose money to fake clicks on their ads. To detect them, we log each visit that arrives from one of our paid ads, as described under “What we collect”, score it with simple rules (for example a data-center network, a location far outside California, automation signals, or many clicks from the same address), and keep the result in our own systems. This is fraud prevention and security, a purpose that doesn't need your consent to analytics cookies, so it works without them and without any extra cookie. We don't use it to profile you or to show you ads, we don't sell it, and we delete the raw IP address after 90 days. IP-to-location data comes from an offline database on our own server (MaxMind GeoLite2); your IP address isn't sent to anyone to look it up.
How we protect information
The site runs only over encrypted connections. Lead information is stored in systems with access limited to the staff who need it, and photos are stored where they can't be opened from the web. No system is perfectly secure; if a breach affects your information, we'll notify you as the law requires.
Children
This site is for adults planning work on their homes. We don't knowingly collect information from anyone under 16. If you think a child has sent us information, contact us and we'll delete it.
California “Shine the Light”
California residents can ask once a year whether we've disclosed personal information to third parties for their own direct marketing in the prior year. The only third party that receives your information for its own use is our partner contractor, if you approve the introduction, for your project. Contact us to ask.
Changes to this policy
We review this policy at least once a year. The “last reviewed” date on this page shows the most recent update. If we change how we use information you've already given us in a material way, we'll tell you before it applies.
Contact
Questions or requests: use the phone number or email at the bottom of every page, or write to us at the mailing address shown there. You can also use the Do Not Sell or Share page for opt-outs and the Delete my data page for deletions.
Mailing address: ProjectThunder.com, Inc., 42-215 Washington St. Suite A #168, Palm Desert, CA 92211. It's a mailbox; we don't have a walk-in office.
Last reviewed . Prices and rules change; confirm details with your contractor and your city or county building department.