Legal

Privacy Policy

Effective Date: November 6, 2026

Hickory (referred to as "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you interact with our website, landing pages, services, marketing campaigns, or communications.

It applies to all visitors, users, prospects, and customers of our website www.hickory.ai and any related forms, ads, emails, texts, calls, or direct mail. By using our site, submitting information, or opting in to communications, you agree to the practices described here. If you do not agree, please do not use our services or provide your information.

We may update this policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website with a new effective date and, where required, via email or other notice. We may update this Privacy Policy from time to time. Any updates will be posted on this page with a revised effective date. Where required by law, we will provide additional notice. We encourage you to review this policy periodically.

1. Information We Collect

We collect only the information necessary to provide efficient HVAC services, respond to inquiries, streamline operations, and communicate about appointments and updates. Our focus is on basic contact and service-related data; we do not collect or process large volumes of sensitive personal information.

Personal Information You Provide Directly

• Contact details such as name, email address, phone number, physical address, and service request details (e.g., type of HVAC issue, property type—residential or commercial—preferred appointment time, or other notes) submitted via website forms, landing pages, contact pages, chat features, click-to-call tools, or during service bookings.
• Communication preferences and consent records, including opt-in status for SMS texts, emails, automated calls, date/time of consent, source (e.g., specific form or page), and any opt-out requests (e.g., STOP/HELP logs, delivery history).
• Reviews, feedback, or testimonials you submit (e.g., via embedded review tools or post-service surveys).
• Email addresses or other contact info provided for marketing sign-ups (e.g., newsletters).

Automatically Collected Information

• Device and browser data, such as IP address, device type, operating system, browser type, unique identifiers, and usage patterns (e.g., pages visited, time spent on site, referral sources).
• Behavioral data from site interactions, including session recordings, heatmaps, click paths, or feedback polls for user experience improvement.
• Tracking data from cookies, local storage, tracking pixels, or similar technologies (see Section 6 below), which may include ad identifiers or inferred interests from ad-driven traffic.

Information from Other Sources

• Email addresses or contact lists from sponsored events, ad agencies, or marketing partners for outreach campaigns (e.g., to current clients or non-clients), only if collected with appropriate consent or from permissible sources.
• Physical addresses for direct-mail campaigns, sourced from prior customer interactions, public records, or purchased lists (scrubbed against suppression lists where applicable).
• Analytics or performance data from third-party providers about ad effectiveness, site traffic, or campaign results (e.g., conversion tracking).

We do not collect sensitive personal information such as payment details (no payments are processed via our website), health-related data, financial information, Social Security numbers, dates of birth, or information about children. Our services are not directed at minors, and we assume all users are adults. If commercial services involve business contacts (e.g., B2B emails), we treat them with lighter regulatory considerations where applicable.

2. How We Collect Information

We collect information through standard, transparent methods to support our HVAC operations:

• Directly from You: Via website forms (e.g., lead-generation on landing pages from Meta, Bing, or Google ads), contact submissions, live chat or instant messaging features, click-to-call/voice tools, email sign-ups, or during phone/email interactions for service requests.
• Automatically: When you visit our site, interact with ads, or use features, via cookies, pixels, analytics scripts, and similar technologies embedded on our pages.
• From Third Parties: From advertising networks, analytics providers, or marketing agencies that run campaigns (e.g., email, TV, radio, streaming) and direct traffic to our site. Agencies manage communications independently but may share lead information (e.g., form submissions or calls) under data processing agreements. We also receive lists from sponsored events for marketing use.
• Via Integrations: Our CRM system logs customer records, appointments, billing, and communication history. Automated messaging platforms record consent, message delivery, and response history for compliance audits.

We take steps designed to collect and use personal information in accordance with applicable law, including obtaining consent for automated communications where required.

3. How We Use Your Information

We use your information for legitimate, service-focused purposes only, with a primary emphasis on contacting you via text, email, or call for scheduling and updates:

• Service Delivery and Operations: To respond to inquiries, provide quotes, schedule/confirm/reschedule appointments, send reminders or confirmations, follow up on services, and manage billing or account notifications through our CRM.
• Communications: To send service-related messages via email, SMS text, automated/prerecorded calls, or direct mail (e.g., appointment updates, service notifications, or promotional offers to current customers).
• Marketing and Campaigns: To run targeted ads (e.g., retargeting via pixels), send promotional emails or direct mail to current clients and non-clients (e.g., from event lists or agency campaigns), and measure campaign performance. We scrub lists against opt-out/suppression registries.
• Site and User Experience Improvement: To analyze traffic, optimize layouts, gather feedback, and enhance accessibility using analytics, session tools, and heatmaps.
• Compliance, Security, and Legal: To maintain audit trails (e.g., consent records), honor opt-outs, detect/prevent fraud, ensure data security, and comply with laws or vendor requirements (e.g., TCPA audits).
• Business Insights: To aggregate anonymized data for internal reporting, such as service trends or ad effectiveness, without identifying individuals.

We do not use your information for profiling, automated decision-making with legal effects, or any purposes beyond our HVAC services. All uses align with your consent and expectations.

4. Sharing of Information

We do not sell, rent, or share your personal information with third parties for their own marketing purposes. We ensure consumer data is not shared for unrelated marketing. Sharing is strictly limited and protected by contracts:

• Service Providers and Vendors: We share with trusted partners who assist our operations, bound to use data only for our purposes and maintain confidentiality/security:
  • CRM and database providers for customer management, scheduling, and automation.
  • Automated messaging platforms for delivering texts and calls.
  • Analytics and advertising partners for traffic analysis, behavioral tracking, retargeting, audience building, and ad optimization (e.g., sharing pseudonymous data like IP or device IDs).
  • Hosting providers for site maintenance and lead-generation forms.
  • Review platforms for embedding/displaying customer reviews and tracking submissions.
  • Chat/voice tools for live interactions and transcripts (if recorded, with appropriate consent disclosures).
  • Accessibility providers for compliance features.
  • Marketing agencies or email platforms for campaign management and list handling (they operate independently but share leads with us).
  • Other tools for fonts, static assets, or minor tracking.
• Legal and Safety Requirements: If required by law, court order, subpoena, or to protect our rights, property, safety, or that of others (e.g., fraud prevention).
• Business Transfers: In a merger, acquisition, reorganization, or asset sale, your information may be transferred with notice and protections.
• Aggregated/Anonymized Data: We may share non-identifiable data (e.g., site stats) for research or reporting.

For SMS/calls, see Section 5.

5. SMS/Text Messages, Automated Calls, and Email Communications

Our primary goal is compliant customer outreach via text, email, and calls for service scheduling and updates. We use automated systems for efficiency.

• SMS/Call Consent and Opt-In: By providing your phone number and opting in (e.g., via unchecked, separate checkbox on forms), you provide prior express written consent under the TCPA to receive recurring automated text messages and/or automated/prerecorded voice calls from us (and our providers) at the provided number, using an automatic telephone dialing system (ATDS) or artificial/prerecorded voice. Consent records (status, date/time, source) are stored in our CRM or messaging platforms.
• Message Types: Primarily informational/transactional: appointment reminders/confirmations, service updates/scheduling/rescheduling, follow-up communications, account notifications related to your HVAC requests or services.
• Message Frequency: Varies based on your appointments and needs; expect 0–10 messages per month (or more/less depending on activity).
• Rates and Charges: Message and data rates may apply per your carrier plan. Contact your carrier for details; we do not charge extra.
• Opt-Out Instructions: For texts, reply STOP, CANCEL, UNSUBSCRIBE, END, or QUIT to any message. You'll receive one confirmation; no further texts will be sent. For calls or emails, use provided unsubscribe links, reply with opt-out request, or contact us. We process revocations within a reasonable time (up to 10 business days) and honor them across channels where possible. Opting out of one type (e.g., texts) does not automatically revoke others unless specified.
• Help and Support: Reply HELP to texts for assistance, or contact us at hello@hickory.ai.
• Data Usage and Non-Sharing: We use your phone number/email solely for these communications and related compliance (e.g., delivery/response history). We do not sell/share with third parties for marketing. Data is shared only with service providers for delivery.
• Retention for Compliance: We retain phone/email data, consent records, preferences, and history while you're an active customer, plus 6–12 months after opt-out or inactivity for legal/audit purposes.
• Not Required for Purchase: Consent is optional and NOT a condition of purchasing or using our services. You can book without opting in.
• Email-Specific (CAN-SPAM): Commercial emails include our physical address and clear unsubscribe options. We honor unsubscribes promptly and do not use deceptive subjects/headers.
• Direct Mail: For hard-mail campaigns, opt-out by contacting us; we voluntarily respect USPS Do-Not-Mail preferences.

For full SMS details, see our separate Messaging Terms & Conditions. If chats/calls are recorded (e.g., via voice tools), we disclose this at the start and comply with state wiretap laws (one- or all-party consent as applicable).

6. Cookies, Pixels, and Similar Technologies

This section serves as our comprehensive Cookie Policy, detailing our use of cookies, pixels, local storage, web beacons, and similar tracking technologies (collectively, "Tracking Technologies"). We use these to enhance your experience, analyze usage, and support advertising. There is no federal U.S. law requiring cookie consent banners, but we provide full transparency and opt-out options to comply with laws like CCPA/CPRA (which may treat certain tracking as "sharing" personal information) and vendor requirements.

Tracking Technologies are small data files or code snippets placed on your device or browser. They help us recognize you across visits, remember preferences, and gather insights. Some are set by us (first-party), others by our partners (third-party). We do not use them for cross-site tracking beyond our authorized partners or for any harmful purposes.

Categories of Tracking Technologies We Use

We categorize them based on purpose and duration (session: temporary, deleted when you close your browser; persistent: remain until expired or deleted). Below is a table summarizing the key categories, with examples of tools/providers (broadly described to avoid frequent updates):

How We Use Tracking Technologies

• Collection: Automatically when you visit our site, interact with ads, or submit forms. They may link to personal information if you provide it (e.g., tying behavior to a lead form).
• Vendor Requirements: We comply with partner terms, such as anonymizing IP in analytics (where recommended) and disclosing uses. For session tools, we mask PII in recordings.
• No Sensitive Tracking: We do not track sensitive categories (e.g., health inferences).
• Legal Basis: Based on legitimate interests for essentials/performance; implied consent for others via continued use after notice. Under CCPA, ad-related sharing may qualify as "sharing" (not "sale").

Managing Your Preferences

You have control:

• Browser Settings: Most browsers allow blocking or deleting cookies (e.g., via "Do Not Track" or privacy modes). Note: Blocking essentials may break site features.
• Opt-Out Tools: Use industry tools like Network Advertising Initiative (NAI) opt-out, Digital Advertising Alliance (DAA) opt-out, or platform-specific settings (e.g., Google Ad Settings, Facebook Ad Preferences).
• CCPA Opt-Out: California residents can opt-out of "sharing" via our "Do Not Sell or Share My Personal Information" link (see Section 8).
• Global Opt-Out: Contact us to request suppression of tracking tied to your data. Changes may not apply retroactively and could limit personalization.

If you have questions about specific technologies, contact us (Section 13). This Cookie Policy is integrated into our Privacy Policy; updates follow the same process.

7. Third-Party Analytics and Advertising Partners

We use partners for deeper insights without tool-specific details:

• Analytics: For user journeys, session data, and metrics (e.g., behavioral events, not linked to identities unless integrated with CRM).
• Advertising: Pixels/scripts for retargeting, audience building, and ad measurement from platforms like search engines or social media.
• Disclosures: This may constitute "sharing" under CCPA (no monetary "sale"). Opt-out via partner settings (e.g., ad preferences) or our rights process below. We recommend masking sensitive fields in tools like session recordings.

Vendor terms require policy disclosures; we anonymize IP where recommended.

8. Your Choices and Rights

You control your data:

• Communication Opt-Outs: As detailed in Section 5; also, manage email unsubscribes via links or contact us for direct mail suppression.
• Cookies/Tracking: Via browser/do-not-track tools (we honor opt-outs but not DNT signals automatically).
• Access, Update, Delete: Request a copy of your data, corrections, or deletion (subject to legal exceptions, e.g., compliance records).
• CCPA/CPRA and Other State Rights (e.g., for CA, VA, CO Residents): Depending on your state of residence and applicable law, you may have certain rights regarding your personal information. These rights may include the ability to request access to, correction of, or deletion of your personal information, and to opt out of certain uses or disclosures of your personal information. California residents may also have the right to opt out of the sale or sharing of their personal information, as those terms are defined under California law.
• General Requests: Contact us for any concerns; we respond promptly under FTC guidelines.

9. Data Security

We implement reasonable safeguards, including encryption for transmissions, access controls, secure storage, and vendor agreements requiring similar protections. However, no system is infallible; we notify of breaches as required by law.

10. Data Retention

We retain data only as needed: active customer info during the relationship; consent/message history for 3–5 years for compliance; analytics data for 12–24 months. We delete or anonymize when no longer necessary, honoring deletion requests.

11. Children's Privacy

Our services are for adults only and not directed at children under 13 (or 16 under CCPA). We do not knowingly collect their data; if discovered, we delete it immediately and comply with COPPA.

12. International Transfers

Our website and services are intended for users in the United States, and we primarily process personal information in the United States. No transfers to other countries occur.

13. Contact Us

For questions, requests, opt-outs, or complaints: