LEGAL
Privacy Policy
Last Updated: October 21, 2026
OVO Painting ("we," "our," or "us") uses information from this website to answer inquiries, provide painting services and measure marketing. This notice explains what we collect, who receives it and your choices.
Information We Collect
- Inquiry and project details: Your name, email, phone number, property or street address, city, state, county, ZIP code, requested service, project details and messages you submit.
- Visit and advertising details: Page addresses, referrers, campaign and ad-click identifiers, browser and device information, IP addresses, cookie identifiers and website interactions.
- Linked records: An inquiry ID connects your submitted details with visit and advertising identifiers. Our records can also link the inquiry to CRM status, an estimate booking, a completed job and its value.
- Calls, errors and feedback: Call tracking and diagnostic information are described below, including screenshots you choose to submit with feedback.
How We Use Your Information
- Answer inquiries, prepare estimates, provide services and support warranty work.
- Send requested information and messages about your project.
- Understand website use, find errors and improve the site.
- Measure which marketing leads to calls, inquiries and sales, including matching inquiry information with advertising accounts through our advertising partners.
- Protect forms from bots and meet legal and tax duties.
Cookies and Browser Storage
Cookies can recognize your browser across visits. We also use sessionStorage, which keeps information within a browser tab session. The table lists our own storage and the main identifiers used by configured measurement services. Vendor defaults are not a guarantee that every browser keeps a cookie for that long.
On a small screen, scroll the table sideways to read each column.
| Name and provider | Who uses it and why | Lifespan |
|---|---|---|
| analytics_sessionOVO Painting | Dashboard users only, after successful sign-in. Keeps the user signed in. This HttpOnly cookie cannot be read by page scripts. It is not a Google Analytics visitor ID. | 7 days, or removed when you sign out. |
| _ovo_internalOVO Painting | Operators who use the internal-traffic marker link. Excludes their browser from public-site analytics. | 1 year. |
| _ga and _ga_<container-id>Google Analytics 4 | Visitors when Google Analytics is loaded. Distinguishes browsers and maintains visit information. | Google default: 2 years. Google settings can change this, and browsers can shorten it.Google cookie documentation |
| Google Tag Manager (GTM)Google | Delivers configured measurement tags to visitors. The tags it loads, such as Google Analytics, can use their own cookies. | No separate visitor-storage lifetime for the tag loader. The loaded tags use their own lifetimes.Google Tag Manager data practices |
| _fbp and _fbcMeta | Visitors when Meta Pixel is loaded. Identifies a browser or ad click for advertising measurement and matching. A click identifier can also be built from the page address for a submitted inquiry. | Meta Pixel default: 90 days. Browsers can shorten this. Copies sent with an inquiry follow the record-retention criteria below.Meta Pixel cookie implementation |
| _clckMicrosoft Clarity | Visitors when Clarity is configured and loaded. Keeps the Clarity user ID and preferences for this site. | Microsoft default: 1 year.Microsoft cookie defaults |
| _clskMicrosoft Clarity | Visitors when Clarity is configured and loaded. Connects page views into a session recording. | Microsoft default: 1 day.Microsoft cookie defaults |
| _attribution (sessionStorage)OVO Painting | Public-site visitors. Stores campaign and ad-click identifiers, referring page, landing path and available Meta identifiers. Forms attach these details to an inquiry. | The browser tab session, usually until the tab or window closes. A restored tab may restore its session storage.Browser session-storage behavior |
Microsoft also lists cookies that can operate across its services in its Clarity cookie inventory. Ahrefs describes its web analytics as cookie-free. Vercel Web Analytics uses a request-derived identifier rather than a tracking cookie and discards the visitor session after 24 hours.
You can block or delete cookies in your browser. Use your browser's site-data or storage controls to clear sessionStorage separately. Blocking cookies does not necessarily clear tab storage, delete server records or stop server-side advertising matching. Some features, including dashboard sign-in, may not work with cookies blocked.
Google Analytics and Conversion Measurement
We use Google Analytics 4 (GA4) to understand which pages people visit, how they find us, and which website interactions lead to inquiries. Google Tag Manager delivers measurement tags when configured. Google receives page addresses, browser and device details, cookie identifiers, and interactions with forms and call links. Google may receive your IP address when your browser connects to its services.
We may also send conversion events from our business systems, such as a qualified call, estimate booking or completed sale. A browser identifier can associate these events with an earlier website visit so we can measure which marketing brings customers.
Read how Google uses information from sites that use its services. You can limit browser collection with the Google Analytics opt-out browser add-on. These controls do not erase information already collected or control separate sharing with Meta. Contact us below about your information.
Meta Advertising and Conversion Measurement
We use Meta Pixel for advertising measurement on Facebook and Instagram. Browser events include page views and inquiry submissions. They can include page addresses, browser and device details, cookie or ad-click identifiers, an inquiry event ID and an optional conversion value. Meta receives your IP address when your browser connects to its services.
When our Meta integration is enabled and connected, our server also sends Lead events for inquiries and Purchase events for completed sales. Matching information can include email, phone, first and last name, city, state, ZIP code and an inquiry identifier. These matching fields are normalized and hashed with SHA-256 before sending. Hashing does not make the information anonymous or prevent Meta from matching it to an account.
When available, the server also sends Meta browser and click identifiers (_fbp and _fbc), IP address, user agent, event ID, source page address and conversion value. Those fields are not hashed. We use this information to connect ads with inquiries and sales, measure results and avoid counting the same browser and server event twice.
You can manage advertising preferences in Facebook or Instagram and use browser cookie controls. See Meta's Privacy Policy and Meta's cookie controls. These choices may limit advertising or browser collection, but do not necessarily stop our server from sending matching information. Contact us below to ask about restricting use or deleting your information.
Microsoft Clarity and Other Site Measurement
When configured, Microsoft Clarity collects page content and interaction information to create session replays and heatmaps. This can include clicks, scrolling, pointer movements, page changes and diagnostic events, along with browser, device and session identifiers. We use it to understand how people use the site and where they encounter problems.
When you submit a form, we send Clarity a randomly generated inquiry ID so we can associate your inquiry with its session recordings. Our identify call sends only that ID, not your name, email or another identifying label. The ID remains linked to your inquiry in our records, so this association is not anonymous.
Read Microsoft's Clarity data collection details and Privacy Statement. Microsoft describes Clarity retention and telemetry choices in its Clarity FAQ, including an opt-out through YourAdChoices by selecting Microsoft. This does not delete our inquiry records.
We also use Ahrefs Web Analytics for visit sources, pages and campaign measurement. Vercel hosts the site. Its Web Analytics processes page, referrer, device, browser and approximate location information. Its Speed Insights processes page addresses, device and network details, and loading and responsiveness measurements.
Calls and Call Tracking
When configured, CallRail replaces phone numbers shown on the site with tracked numbers. This helps us connect calls with the marketing that brought someone to the site. CallRail and our Neon-hosted records can hold caller name, phone number and location, tracking number, call time, duration, whether it was answered, call direction and voicemail status. They can also hold source, campaign, landing-page and Google visitor identifiers, along with call details supplied in CallRail's notification. Records can include unanswered or short calls, not just calls counted as qualified leads.
If call recording is enabled for a tracked number, CallRail may record the call. We can receive a recording reference and its duration. Voicemail information may also be supplied when that feature is enabled. Retention follows the criteria below and the provider's settings. See CallRail's Privacy Policy.
Inquiry Storage, Security Checks and Feedback
Neon hosts our database. It stores contact, address and project details separately from, but linked to, visit identifiers and CRM outcomes through the inquiry ID. Resend handles inquiry notifications and confirmation emails sent to you. FormSpark processes configured form submissions for delivery to Salesforce, our customer relationship management system. These providers can receive inquiry details and associated campaign or click identifiers needed for their role.
Cloudflare Turnstile checks forms for bots. Verification sends Cloudflare the challenge token and, when available, your IP address.
The site can automatically report browser errors to our issue-reporting system. Reports can include error messages and stack details, the full page address, browser user agent and time. If you submit feedback, we also receive your message and a page screenshot when the screenshot option is selected. You can clear that option before submitting. Screenshots are part of that feedback flow, not automatically taken on every visit.
How We Share Your Information
- With Neon, Vercel, Resend, FormSpark and Salesforce for hosting, inquiry storage, email delivery and customer records.
- With Cloudflare for security and CallRail for call tracking when configured.
- With Google, Meta, Microsoft, Ahrefs and Vercel for the analytics, performance and advertising measurement described above. This includes customer matching with Meta when that integration is enabled and connected.
- When needed to meet legal duties or enforce our terms and policies.
How Long We Keep Information
We keep inquiry and customer records for as long as we need them to answer your inquiry, deliver and warranty the work, and meet legal and tax duties. We have not yet set fixed retention periods for every system we use. Provider settings also affect how long information remains in their systems. Contact us with retention questions or to request deletion.
Cookie expiry is separate from record retention. Clearing browser storage does not delete information already sent to us or our providers, including linked inquiry records or backups. Contact us to ask about a specific record.
Your Rights
Depending on your location, you may have rights to access your information, request correction or deletion, or withdraw consent for processing. To make a request, contact us at sebastian@ovopainting.com. Available rights and any limits depend on the laws that apply to your request.
Data Security
We implement reasonable administrative, technical, and physical safeguards to protect your information. However, no method of transmission over the Internet is 100% secure.
Third-Party Links
Our website may contain links to third-party websites. We are not responsible for their privacy practices. Review their privacy policies before providing information.
Children's Privacy
Our website is not intended for children under the age of 13. We do not knowingly collect information from children. If you believe we have collected data from a child, please contact us.
Changes to This Privacy Policy
We may update this Privacy Policy. Changes will be posted on this page with an updated effective date.
Contact Us
If you have questions or concerns about this Privacy Policy, please contact us.