Privacy Policy

Introduction

FreeStatUpgrade(“we,” “us,” or “our”) operates the website at https://freestatupgrade.com (the “Site”). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit our Site or use our services.

By using our Site, you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use our Site.

Information We Collect

Information You Provide Directly

When you fill out a form on our Site — such as an eligibility check, a get-started request, or a contact form — we collect the information you provide, which may include:

Your name and job title
Email address
Phone number
Property name and address
Number of units and property details
Any additional information you include in your message

Information Collected Automatically

When you visit our Site, we automatically collect certain information through cookies and similar technologies:

Analytics Data: We use Google Analytics 4 (GA4) to collect anonymized usage data including pages visited, time spent on pages, referral sources, device type, browser type, and general geographic location (city/region level). GA4 does not collect personally identifiable information.
Log Data: Our hosting provider (Vercel) automatically collects server log data including IP addresses, browser type, referring pages, and timestamps. This data is used for security monitoring and performance optimization.

How We Use Your Information

We use the information we collect to:

Respond to your inquiries and communicate about our services
Verify your property's eligibility for utility energy efficiency programs
Prepare and submit program applications on your behalf
Coordinate thermostat installation scheduling
Analyze Site usage to improve our content and user experience
Detect and prevent fraud or abuse
Comply with legal obligations

How We Send Emails

When you submit a form on our Site, your information is sent to our team via email using Microsoft Graph API (Azure Mail.Send). This means your form submission is transmitted through Microsoft's cloud email infrastructure. We do not use your email address for marketing purposes unless you explicitly opt in. We never sell your email address to third parties.

Cookies and Tracking Technologies

Our Site uses the following cookies and tracking technologies:

Google Analytics 4 (GA4): Uses first-party cookies to distinguish unique users, track sessions, and measure site engagement. GA4 data is anonymized and does not include personally identifiable information. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
Essential Cookies: Our hosting platform (Vercel) may set technical cookies necessary for site functionality, security, and performance. These cannot be disabled.

We do not use advertising cookies, retargeting pixels, or social media tracking pixels.

Third-Party Services

We use the following third-party services that may process your data:

Vercel: Website hosting and serverless functions (Vercel Privacy Policy)
Google Analytics 4: Website analytics (Google Privacy Policy)
Microsoft Azure (Graph API): Email delivery for form submissions (Microsoft Privacy Statement)

We do not sell, rent, or trade your personal information to any third parties. We share information with third parties only as necessary to provide our services (e.g., submitting your property information for program applications, with your authorization).

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, including maintaining records of program applications and installations. Analytics data is retained according to Google Analytics 4 default retention settings (14 months). You may request deletion of your personal information at any time by contacting us.

Data Security

We take reasonable measures to protect your personal information, including:

HTTPS encryption on all pages (TLS 1.2+ via Vercel)
Secure email transmission through Microsoft Graph API with OAuth 2.0 authentication
Access controls limiting who within our organization can view personal information
Security headers including HSTS, X-Frame-Options, and X-Content-Type-Options

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

Your Rights Under California Law (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

Right to Know: You can request what personal information we have collected about you, the sources of that information, and how we use it.
Right to Delete: You can request that we delete the personal information we have collected about you, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
Right to Opt Out of Sale: We do not sell personal information, so this right does not apply.

While we primarily serve Texas properties, we extend these rights to all users regardless of location. To exercise any of these rights, please contact us using the information below.

Children's Privacy

Our Site is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete that information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised “Last updated” date. We encourage you to review this page periodically for the latest information on our privacy practices.

Contact Us About Privacy

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your information, please contact us:

Email: info@freestatupgrade.com
Subject Line: “Privacy Request”

We will respond to all privacy-related requests within 30 days.