Privacy Policy

1. Scope and Operator

This Privacy Policy describes information practices for sunburstsolar.com, related website forms, and online features operated by Sunburst Solar, LLC. It does not replace a separate notice or agreement that expressly applies to a particular product, provider, transaction, or service.

2. Information Provided Directly

We may collect information that you choose to provide through a quote request, assessment, email, telephone call, or other direct communication, including:

• First and last name
• Telephone number and email address
• ZIP code and an optional street address
• An optional average monthly electric bill
• Questions, preferences, and other information included in a request

3. Assessment, Property, Energy, and Quote Information

The website may collect property and household-energy context used to prepare or discuss a potential solar or battery plan. This may include home type, ownership status, energy-use information, requested system context, source page, and the project details you submit. A website assessment or quote request is informational and does not guarantee service, price, savings, project eligibility, financing, or installation.

4. Contact Information

When you submit a quote request, we collect the telephone number and email address needed to respond. A street address and average monthly electric bill are optional on the website form. Please do not submit sensitive information that the form does not request.

5. Consent and Communications Records

We may maintain records showing the consent language presented, its version, whether a required or optional choice was accepted, the submission identifier, the server-recorded time, and related attribution. Required authorization for a quote request is separate from optional marketing consent. We do not infer optional marketing consent from a quote request, telephone number, email address, or acceptance of website Terms.

6. Attribution and UTM Information

The website may retain source-page, source-section, source-CTA, landing-page, and UTM campaign values associated with a request. These values help explain where a request originated. If you separately allow optional analytics, the website may also use non-personal page, campaign, device, and interaction context to understand website use. We do not send contact details, form-field contents, street addresses, ZIP codes, utility-bill information, Turnstile tokens, or free-form homeowner answers to analytics.

7. Browser and Session Storage

The website uses browser sessionStorage for an assessment draft that expires after four hours. The draft may hold property, energy-use, assessment, and attribution context so it can carry into the quote form. It excludes name, telephone number, email address, street address, and consent state. sessionStorage is normally limited to the active browser session, subject to browser behavior. The optional analytics preference is stored locally with a consent-version value. After analytics is allowed, limited session storage may preserve the original landing path, approved UTM values, and event-deduplication state for the current browser session. Rejecting or withdrawing analytics clears analytics session storage controlled by this implementation.

8. Cookies and Similar Technologies

Optional analytics is off unless you affirmatively allow it. Before that choice, this implementation does not load or contact Google Analytics and does not set Google Analytics cookies. If you allow analytics, Google Analytics may use first-party cookies and process page, device, network, campaign, and interaction information under the approved configuration. Advertising measurement and personalization remain disabled. You may later use Manage preferences to reject or withdraw analytics; doing so prevents future collection through this implementation and clears analytics storage that the website controls. Hosting, security, or anti-abuse providers may separately process limited technical information or use necessary technologies when their services are enabled.

9. How Information Is Used

We may use information to:

• Respond to a quote or consultation request
• Review potential property, utility, jurisdiction, equipment, and project fit
• Prepare or discuss informational solar and battery planning options
• Maintain consent and request evidence
• Protect the website, investigate misuse, and troubleshoot operations
• Understand website use and improve the site when optional analytics is allowed
• Comply with reasonable legal, security, contractual, and dispute-resolution needs

10. Service Providers

Sunburst Solar uses Vercel to host the website, Resend to deliver quote-request email, Cloudflare Turnstile to help prevent abuse, and Google Analytics only when a visitor allows optional analytics. These providers may process information for their applicable functions. Google Analytics is not contacted unless optional analytics is allowed and does not receive quote-form contents or contact information from this implementation. No active CRM or durable website lead database exists at initial launch.

11. Email Delivery

Sunburst Solar uses Resend to deliver an internal quote-request notification and a transactional receipt to the email address submitted with an accepted request. The receipt confirms that the request was received; it is not marketing. Email routing, retention, and access depend on approved configuration and provider settings. Email is a notification mechanism and is not an authoritative CRM, database, or durable lead record.

12. Anti-Abuse and Turnstile

The Production quote form uses Cloudflare Turnstile to help distinguish legitimate requests from abuse. The browser loads the Turnstile widget for the form and requests a response token when submission is attempted. The server verifies that token with Cloudflare before delivering an accepted request. Turnstile may process the token and limited technical information under Cloudflare's applicable terms and privacy notices. The ordinary Local mock flow does not contact Turnstile.

13. Hosting and Operational Logs

Vercel is the intended hosting provider. When hosting is activated, Vercel and related infrastructure may process request, device, network, security, and operational log information needed to serve and protect the website. Log contents and retention depend on provider configuration and contract. This Policy does not claim that no technical information is processed.

14. Data Sharing and Disclosures

We may disclose information to approved service providers acting for us; to project or financing participants when necessary to evaluate a request and separately authorized; to professional advisers; to authorities when reasonably required by law or safety; or in connection with a bona fide business transaction. Providers may process information only for approved purposes and subject to their agreements and applicable requirements.

15. No Sale or Targeted-Advertising Use at Initial Launch

At initial launch, Sunburst Solar does not sell personal information and does not use personal information for cross-context behavioral advertising. No advertising pixels are active. We will update our notices and controls before introducing a practice that materially changes this statement.

16. Retention

Quote requests, consent evidence, and internal quote email are generally retained for up to five years, unless longer retention is reasonably required for a resulting agreement, legal obligation, dispute, security, fraud-prevention, or operational need. Entity-specific do-not-call and suppression records may be retained for at least five years or a longer applicable period. Provider mailbox, hosting, security, and log retention may differ and remains subject to provider settings and contracts. If optional analytics is activated, analytics retention is controlled by the separately approved Google Analytics property settings; this Policy revision does not itself change those settings. No CRM retention period applies at initial launch because no CRM is active.

17. Security

We use administrative, technical, and organizational measures designed to protect information in light of the website's operation and the information involved. No internet transmission, mailbox, provider, or storage method can be promised to be completely secure.

18. Communication Choices and Withdrawal

You may ask us to stop marketing calls, texts, or emails by using a method provided in the communication or by contacting customersupport@sunburstsolar.com. Reply STOP to a marketing text if that channel is later activated. Analytics choice is separate from communication consent: use Manage preferences on the website to allow, reject, or withdraw optional analytics. Withdrawal does not affect a communication already lawfully sent or a nonmarketing response reasonably related to an active request, transaction, safety issue, or legal need. Automated calling, SMS marketing, and marketing email are not active at initial launch.

19. Privacy Requests

You may request access, correction, deletion, communication withdrawal, do-not-call treatment, or other privacy assistance by emailing customersupport@sunburstsolar.com. We may use proportionate steps to verify identity and authority before acting. Deletion may be limited when information is reasonably needed for law, security, consent evidence, fraud prevention, disputes, or agreements. Available rights and exceptions depend on the circumstances and applicable law.

20. Children and Age

This website and its quote process are intended for adults who are at least 18 years old, or the legal age of majority where they reside if higher. We do not intend to collect quote requests from children. If you believe a child submitted information, contact us so we can review and take appropriate action.

21. External Links

The website may link to government, utility, financing, equipment, or other third-party websites. Their content, security, and privacy practices are governed by their own notices. A link does not guarantee availability, eligibility, accuracy, or endorsement.

22. Changes to This Policy

We may update this Policy to reflect approved operational, provider, legal, or data-use changes. We will post a revised version and date before activating a materially different use such as CRM storage, advertising, call tracking, or a new communications channel, and will provide additional notice or choice when reasonably required.

23. Contact Information

24. Effective Date

Effective August 20, 2026. This Policy describes the website's current practices, including optional analytics that operates only after a visitor affirmatively allows it. Advertising measurement and personalization remain disabled.