Privacy

Privacy Policy.

Plain-English summary of what HavenCostGuide collects, how we use it, and the specific controls you have over your data. We don't sell personal information, we don't track you across the open web, and we don't share your email with advertisers — ever.

Effective date: February 1, 2026

TL;DR

  • · Calculators run client-side. Inputs never reach our servers unless you submit the email form.
  • · If you submit your email, we store it to send you the breakdown + a 3-touch nurture series. One-click unsubscribe.
  • · Anonymous traffic analytics via Google Analytics 4 (IP anonymization on). No cross-site advertising cookies.
  • · No sale of personal data. Ever.

1. What we collect

1.1 Information you give us directly

  • Email + name: when you submit a cost estimate or run the bundle estimator and ask us to email the breakdown.
  • Project details: state, project type, scope, material tier, cost ranges. We store these to send you a relevant follow-up shortlist of contractors.
  • Free-form notes: anything you type in a contact form's message field.

1.2 Information collected automatically

  • IP-based state detection: one-time lookup of your approximate state. We don't store the IP itself.
  • Anonymous analytics: page views, referrer, device, session interactions via Google Analytics 4 with IP anonymization. GA4 cookies are first-party and respect Do Not Track.
  • 404 / error reports: missing URLs only. No personal info.

1.3 Information we do NOT collect

  • Payment information, government IDs, financial credentials.
  • Cross-site behavioral tracking. No third-party ad cookies.

2. How we use your data

  • Send you the calculator breakdown + 3-touch nurture series you opted into.
  • Trigger the Full-Home Renovation Snapshot PDF when both bundle estimators are submitted.
  • Improve calculator accuracy via anonymized aggregate submissions.
  • Diagnose broken pages and improve performance.
  • Respond to messages sent through the contact form.

3. Who we share data with

We share specific data with three categories of service providers, each under their own GDPR/CCPA-compliant data-processing agreement:

  • Email delivery (Resend): email + project type only.
  • Anonymous analytics (Google Analytics 4): aggregated, IP-anonymized. GA never receives your email.
  • Hosting + database (MongoDB Atlas): encrypted at rest. Only HavenCostGuide staff have access.

We never sell, rent, or trade personal information. Disclosure only when legally required (subpoena, court order, fraud investigation) with user notice unless legally prohibited.

4. Your rights

  • Access: request a copy of all data we hold.
  • Correct: update any inaccurate info.
  • Delete: permanent deletion within 30 days.
  • Unsubscribe: one-click from any email.
  • Opt out of analytics: browser-level GA4 opt-out or Do Not Track.

To exercise any of these rights, email privacy@havencostguide.com. We respond within 5 business days.

4.1 California residents (CCPA)

California residents have rights to know specific PII collected, categories of third parties shared with (see section 3), and to opt out of "sale" of personal info. We do not sell personal information.

4.2 EU / UK residents (GDPR)

Lawful basis is your consent (form opt-in) and our legitimate interest in service improvement (anonymous analytics). Withdraw consent any time via unsubscribe.

5. Cookies and tracking

  • Google Analytics 4 (_ga, _ga_*): anonymous traffic. 13-month retention.
  • Session preferences: state code, theme. Local storage only.

No re-marketing pixels, advertising cookies, Facebook Pixel, or cross-site tracking.

6. Children's privacy

HavenCostGuide is intended for homeowners and homebuyers — typically 25+. We don't knowingly collect info from anyone under 13.

7. Data retention

  • Lead records: 24 months from last interaction, then auto-deleted unless you re-engage.
  • Analytics aggregates: 13 months in GA4, then auto-purged.
  • Logs: 30 days, for security and debugging.

8. Security

All data transmitted over HTTPS (TLS 1.2+) and stored encrypted at rest in MongoDB Atlas. Admin access gated behind bearer-token auth. Breach notification within 72 hours per GDPR/CCPA.

9. Changes to this policy

Material changes update the effective date above and (where possible) trigger an email notification.

10. Contact