← Carpet Installers Direct All Legal Documents
Back to Legal Documents
Last updated: February 4, 2026

Privacy Policy

Version: 2.0
Effective Date: December 29, 2025
Last Updated: December 29, 2025

PRIVACY POLICY

Carpet Installers Direct ("Platform," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information.

By using our Platform, you consent to the practices described in this Policy.

1. Information We Collect

1.1 Information You Provide Directly

When you create an account, place an order, or use Platform features, we collect:

Account Information:

Order Information:

Payment Information:

Photos and Content:

Communication Records:

1.1a Installer Information (Collected from Installers Directly)

For BYOI tiers, we collect information from installers who are nominated by customers:

Installer Account Information:

Installer Credential Information:

Background Check Information (FCRA-Compliant):

Important: Installers submit their own credentials directly via a secure link. This ensures accuracy and FCRA compliance. Customers do NOT submit installer credentials on behalf of installers.

1.2 Information Collected Automatically

When you visit the Platform, we automatically collect:

Device and Browser Information:

Usage Data:

Cookies and Tracking:

1.3 Information from Third Parties

We may receive information about you from:

Payment Processors (Stripe):

Shipping Carriers:

Social Media:

Background Check Providers (for installers):

Data Brokers (optional, for marketing):

2. How We Use Your Information

2.1 To Provide Services

We use your information to:

2.2 To Improve the Platform

We use data to:

2.3 For Marketing and Advertising

With your consent, we use information to:

You can opt out of marketing (see Section 8).

We use information to:

3. How We Share Your Information

3.1 With Service Providers (to Fulfill Orders)

We share information with third parties who help us operate the Platform:

Carpet Mill (Manufacturing Partner):

Shipping Carriers (LTL freight companies):

Installers (BYOI tiers):

Payment Processor (Stripe):

3.2 With Marketing and Analytics Providers

Google Analytics:

Facebook Pixel:

Email Service Provider (e.g., SendGrid, Mailchimp):

3.3 With Background Check Providers (Installers Only - FCRA Compliant)

For installers seeking verification (especially for BYOI Certified status), we share:

FCRA Compliance:

Customer data is NOT shared with background check providers.

We may disclose information if required by law or to protect rights:

3.5 Business Transfers

If Platform is acquired, merged, or sold:

3.6 We Do NOT Sell Your Personal Information

Platform does NOT sell your personal information to third parties for their marketing purposes.

Exception (California residents): Under CCPA, "sell" has a broad definition. If you are a CA resident and want to opt out of any data sharing that might qualify as a "sale," see Section 9 (California Privacy Rights).

4. Cookies and Tracking Technologies

4.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. We use cookies to:

4.2 Types of Cookies We Use

Essential Cookies (required):

Preference Cookies (optional):

Analytics Cookies (optional):

Advertising Cookies (optional):

4.3 Managing Cookies

Cookie Consent Banner:

Browser Settings:

Do Not Track (DNT):

5. Data Security

5.1 How We Protect Your Data

We implement industry-standard security measures:

Encryption:

Access Controls:

Payment Security:

Regular Security Audits:

5.2 Your Responsibilities

Protect your account:

Report suspicious activity:

5.3 No System is 100% Secure

Despite our security measures, no system is completely secure. We cannot guarantee that:

If a data breach occurs, we will notify you per Section 5.4.

5.4 Data Breach Notification

If a security breach exposes your personal information, we will:

  1. Investigate the breach: Determine what data was accessed and who was affected
  2. Notify affected users within 72 hours: Email notification with details of breach
  3. Report to authorities: Notify state/federal regulators as required by law (GDPR, CCPA, state data breach laws)
  4. Offer remediation: Free credit monitoring (if financial data was compromised)

6. Data Retention

6.1 How Long We Keep Your Data

Account data: As long as your account is active + 7 years after deletion (for legal compliance - tax records, dispute resolution)

Order data: 7 years after purchase (for warranty claims, legal disputes, accounting)

Payment data: Tokenized card information retained until you delete it or account is closed

Customer support records: 3 years (for quality assurance, legal defense)

Analytics data: Aggregated data retained indefinitely (de-identified - not linked to specific users)

Marketing data: Until you unsubscribe or delete account

6.2 Deleting Your Data

You may request deletion of your data by:

We will delete your data within 30 days, except:

Note: Deleting your account does NOT cancel pending orders or void existing contracts.

7. Your Privacy Rights

7.1 Access Your Data

You have the right to request a copy of your personal information. To request:

  1. Email privacy@carpetinstallersdirect.com with subject "Data Access Request"
  2. Verify your identity (we may ask for account credentials or order number)
  3. Receive data within 30 days (in machine-readable format - JSON or CSV)

We provide this for free (first request per year). Subsequent requests may incur a $25 processing fee.

7.2 Correct Your Data

If your personal information is inaccurate or outdated, you can:

We will update within 10 business days.

7.3 Delete Your Data

You can request deletion per Section 6.2.

Exceptions: We may retain data if:

7.4 Object to Processing

You can object to certain uses of your data:

Email privacy@carpetinstallersdirect.com to object.

7.5 Data Portability

You can request your data in a portable format (to transfer to another service):

  1. Email privacy@carpetinstallersdirect.com with subject "Data Portability Request"
  2. Receive data in JSON or CSV format (machine-readable)

Included data: Account info, order history, saved quotes, product reviews

Excluded data: Proprietary algorithms (cutting diagrams, price calculations), third-party data (payment tokens)

8. Marketing and Communication Preferences

8.1 Opt Out of Marketing Emails

To stop receiving promotional emails:

You will still receive transactional emails (order confirmations, shipping updates, installation reminders).

8.2 Opt Out of SMS

To stop receiving text messages:

You will still receive critical SMS (e.g., installer arrival notification on installation day - unless you specifically request full SMS opt-out).

8.3 Opt Out of Retargeting Ads

To stop seeing Platform ads on Facebook, Google, etc.:

Facebook:

Google:

Industry-Wide Opt-Out:

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

9.1 Right to Know

You can request:

9.2 Right to Delete

You can request deletion of your personal information (see Section 6.2).

Exceptions: We may retain data if necessary to:

9.3 Right to Opt-Out of "Sales"

CCPA defines "sale" broadly. While we do NOT sell your data for money, we do share data with analytics and advertising partners (Google Analytics, Facebook Pixel), which may qualify as a "sale."

To opt out:

9.4 Right to Non-Discrimination

We will NOT discriminate against you for exercising CCPA rights. You will receive the same service quality, pricing, and features regardless of whether you opt out.

9.5 Submitting CCPA Requests

To exercise CCPA rights:

  1. Email privacy@carpetinstallersdirect.com with subject "CCPA Request: [Right You're Exercising]"
  2. Verify your identity (provide email, phone, or order number)
  3. Receive response within 45 days (may extend to 90 days for complex requests)

Authorized agents: You may designate an authorized agent to submit requests on your behalf (provide written authorization).

10. International Users and GDPR

10.1 Platform is Based in the United States

Carpet Installers Direct is a Georgia-based business. Your data is processed and stored in the United States.

If you are located outside the U.S.:

10.2 GDPR Rights (European Users)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing:

GDPR Rights:

To exercise GDPR rights:

File a complaint:

10.3 Data Transfer Mechanisms

For EEA users, we rely on:

11. Children's Privacy

11.1 Platform is NOT for Children

The Platform is intended for users 18 years and older. We do NOT knowingly collect personal information from children under 13 (or 16 in the EEA).

11.2 If We Discover Child Data

If we discover we have collected data from a child:

  1. Delete the data immediately
  2. Terminate the account
  3. Notify parents (if contact information is available)

11.3 Parental Notification

If you are a parent and believe your child has created an account or provided personal information:

The Platform may contain links to:

We are NOT responsible for the privacy practices of third-party sites. Review their privacy policies before providing personal information.

12.2 Social Media Integration

If you interact with our social media (like, share, comment):

13. Changes to This Privacy Policy

13.1 We May Update This Policy

Platform may update this Privacy Policy by:

We will notify you of material changes via:

13.2 Continued Use = Acceptance

By continuing to use the Platform after updates, you agree to the new Privacy Policy. If you do not agree, you must stop using the Platform and delete your account.

If changes materially expand how we use your data (e.g., we start selling data to third parties), we will:

14. Contact Us

For privacy questions, data requests, or concerns:

Carpet Installers Direct - Privacy Team
Email: privacy@carpetinstallersdirect.com
Phone: [Phone Number]
Address: [Physical Address, Georgia]
Business Hours: Monday-Friday, 9 AM - 5 PM EST

For GDPR-specific inquiries:
Email: gdpr@carpetinstallersdirect.com

For CCPA-specific inquiries:
Email: ccpa@carpetinstallersdirect.com

15. Summary of Key Points

What we collect:

How we use it:

Who we share with:

We do NOT sell your data (except possibly under CCPA's broad definition - opt out available)

Your rights:

Installer data (FCRA compliant):

How to contact us:

Effective Date: December 29, 2025
Version: 2.0
Document ID: PRIVACY-2025-v2.0

Attorney Review Notes

⚠️ IMPORTANT: This document should be reviewed by a privacy attorney before use. Key areas requiring review:

  1. CCPA compliance - Verify "Do Not Sell" disclosures, opt-out mechanisms, non-discrimination policy
  2. GDPR compliance - Confirm legal basis for processing, data transfer mechanisms (SCCs), DPA appointment (if needed)
  3. State data breach laws - Ensure breach notification procedures meet requirements (72-hour rule varies by state)
  4. Cookie consent - Verify cookie banner meets requirements (ePrivacy Directive, GDPR, CCPA)
  5. Children's privacy - Confirm COPPA compliance (no data collection from under-13s)
  6. Third-party data sharing - Ensure all data processors are listed and have DPAs in place
  7. Data retention - Verify retention periods align with legal requirements and business needs
  8. FCRA compliance - Verify installer background check process meets FCRA requirements (standalone disclosure, consent, adverse action notice)
  9. Installer credential data - Ensure proper handling and retention of installer license, insurance, and background check data

Recommended attorney budget: $400-600 for Privacy Policy review (high complexity due to GDPR/CCPA/FCRA)