Privacy notice

1. Who we are, and what this notice covers

Brabham Quality Heating and Air is a family-owned heating, cooling and indoor air quality company, established 1997, working out of Savannah, GA across Savannah, the Coastal Empire and the South Carolina Lowcountry.

This notice covers brabham-hvac.com and the forms, account area and assistant on it. It does not cover someone else's website that we link to, or the paperwork you sign for work carried out at your property — that paperwork governs the job itself.

We are the controller of the information described here. In plain terms: it is ours to look after, and the decisions about it are ours to answer for.

2. What we collect

Almost everything we hold is something you typed in, on purpose, so that we could help you. The rest is the minimum a web server has to see to answer a request at all.

When you request service or an estimate

Your name, phone number, email address, the city and the service address, what kind of system you have, what it is doing, how urgent it is, when you would like us to come, and anything else you put in the notes box. If you built up a list of jobs first, that list comes with the request.

When we confirm a request

We generate a reference code beginning BQ- and keep it against your request. It is in your confirmation email, and it is how the office finds you again.

When you sign in to your account

Your email address, and the fact that a sign-in link was sent to it and used. There are no passwords on this site to store, lose or leak.

When you use the assistant

The messages you type and, if you give them, your email address, name, phone number and city. We also keep a short summary of what was discussed, a count of replies, and flags for the safety situations the assistant is trained to spot — a gas smell, a house with no heat — so the office can prioritise you.

Automatically, on every page

Your IP address and the standard information any browser sends: the page requested, the time, your browser and operating system. These sit in our hosting logs, and are used to serve the page, to stop one address flooding our office inbox, and to investigate abuse.

We do not ask for, and would rather you did not send, anything sensitive: no health information, no government ID numbers, no bank or card details. If something like that ends up in the notes box or in the assistant, we remove it when we see it.

3. Cookies, and what your browser keeps

This site sets no advertising cookies and runs no analytics. Nothing here follows you to another website, and no third party is given a way to watch you on this one — the typeface and every image are served from our own domain rather than someone else's. That is why there is no cookie banner: there is nothing on this site that needs your consent.

Two kinds of storage are in use, and both are strictly necessary.

Sign-in cookies — only if you sign in

Session, CSRF and callback cookies set by Auth.js. They keep you signed in to your account, or our staff signed in to the office dashboard, and they stop the sign-in form being submitted from another site. The session itself lives in our database rather than inside the cookie, which is what makes signing out take effect immediately and everywhere. Cookies expire on their own, and signing out deletes the session.

Storage that never leaves your browser

Saved jobs, your quote-request list, recently viewed pages, saved searches, service reminders and your previous requests are kept in your browser's own local storage, under keys beginning “atd.”. The assistant keeps your conversation there too, along with a random session id and — once you give it — your email address, so that closing the widget does not lose the thread. None of it is sent to us unless and until you submit something, and clearing site data for this site in your browser settings wipes all of it.

If we ever add analytics, advertising or an embedded third-party map, this section is rewritten before that code ships, and anything needing consent will ask for it first.

4. What we use it for

• Answering you — calling or emailing back, agreeing a time, and telling you what the visit costs before we set out.
• Doing the work — routing a technician to the right address, and knowing what equipment is there and what it did last time.
• Prioritising — a house with no cooling in July, or anything involving a gas smell, goes to the front of the queue. That is what the assistant's safety flags are for.
• Records — keeping your reference, what was quoted and what was fitted, so a warranty claim or a follow-up visit years later is answerable.
• Keeping the site up — rate limiting, spam filtering, and investigating abuse.
• Meeting our legal obligations — tax and accounting records, and responding to lawful requests.

We do not use your information to advertise to you, we do not build profiles, and we do not make automated decisions about you. The assistant helps you find an answer and helps us understand the problem before a person reads it — it decides nothing, and a person reads every request that comes in.

5. The assistant, and Google's AI

The chat assistant answers using Google's Gemini API. When you send a message, that message and the recent conversation go to Google along with our own instructions about this business, and the answer is streamed back to you. Google processes it to generate that answer on our behalf, under its API terms. It is not used to advertise to you.

So treat the assistant like a conversation with the office: tell it about your system, and do not type anything you would not put in an email. Full transcripts stay in your own browser. What reaches our database is your email address, anything you volunteered about how to reach you, the first thing you described, a summary, and the safety flags.

6. Who else touches it

Four suppliers process information for us — each for one job, each under a contract that stops them using it for anything else. All four hold it in the United States.

Vercel

Hosts the website, and keeps the server logs described in section 2.

Neon

Runs the Postgres database where requests, office notes, accounts and assistant leads are stored.

Resend

Sends our email: the alert to the office, your confirmation copy, and sign-in links.

Google (Gemini API)

Generates the assistant's replies, as described in section 5. Used only while you are chatting.

Beyond those four, information leaves us only in these cases:

• Your phone carrier and ours, when we call or text you — that is how a phone call works.
• Our accountant, insurer or lawyers, where they need it to do their job for us.
• A manufacturer such as Trane, when an equipment registration or a warranty claim has to be made in your name — and only then.
• A law-enforcement or regulatory body, where we are legally required to hand it over, or where someone's safety is at risk.
• A buyer, if the business is ever sold or merged. You would be told, and this notice would keep applying until it was replaced.

Our own staff see what they need to do the job. The office dashboard is invitation-only — an account has to be created by us before a sign-in link can even be sent — access is limited by role, and every change to a request is recorded against the person who made it.

7. Calls, texts and email

When you give us your number, you are asking us to use it. We will call or text you about your request, your appointment, the technician's arrival and the work itself. Message and data rates from your carrier may apply, and how often we message depends on what is happening with your job.

To stop texts, reply STOP to any message from us, or tell us on the phone. To stop emails other than the direct reply to something you sent us, reply and say so, or write to info@brabham-hvac.com. We will still need to reach you about a job that is already booked.

We do not run a marketing text or email programme, we do not buy contact lists, and we do not pass your number to anyone else to market to you. The full messaging terms are in our terms of use.

8. How long we keep it

Requests, quotes and job records

Kept while we are working for you, and afterwards for as long as we need them for warranty, insurance, tax and accounting purposes. A workmanship claim can arrive years after the work and an equipment warranty can run a decade, so these are the records we keep longest.

Assistant leads

Kept while we follow the enquiry up, then only as long as they are useful to the office. Ask us and we will delete yours.

Account and sign-in data

Kept while your account exists. Sign-in links expire shortly after they are sent and work once. Sessions expire on their own, and are deleted when you sign out.

Server logs

Kept for a short period by our host, for security and troubleshooting, then discarded.

In your browser

Until you clear it. That storage is yours, not ours.

When a record is no longer needed for any of the reasons above, it is deleted.

9. Your choices, and how to use them

Whether or not the law where you live grants these rights, we will honour them:

• Ask what we hold about you, and get a copy of it.
• Correct it — a wrong phone number or a misspelled street is worth telling us about for practical reasons anyway.
• Ask us to delete it, subject to the records we have to keep for warranty, insurance and tax.
• Opt out of contact you did not ask for, as described in section 7.
• Close your account. You can keep using the site, and the phone, without one.
• Clear what your browser is keeping, at any time, without asking us.

To use any of these: call (912) 858-3737, email info@brabham-hvac.com, or write to us at the address in section 13. Tell us what you are asking for, and give us enough to find you — your name and the phone number or the reference on the request. We may need to check that the request really comes from you before acting on it, and we will not charge you or treat you differently for asking.

Georgia and South Carolina, where we work, had no comprehensive consumer privacy statute when this notice was written; the rights above are our own policy. If you live somewhere that does grant statutory privacy rights — California, Virginia, Colorado, Connecticut and a growing number of other states — we will honour those too, including the right to appeal if we turn a request down. We do not sell personal information and we do not share it for targeted advertising, so there is nothing for you to opt out of on that front.

10. Children

This site is for people arranging work on a building, which means adults. It is not directed at children, we do not knowingly collect information from anyone under 13, and if we find that we have, we delete it. If you believe a child has sent us something, tell us and we will remove it.

11. How we protect it

• Everything between your browser and this site is encrypted in transit, and so is the connection to our database.
• There are no passwords to steal: signing in uses a single-use link, sent to an address we already hold.
• Sessions live in our database, so signing out — or us ending a session — takes effect immediately rather than waiting for a token to expire.
• The office dashboard is invitation-only and role-based: nobody can create their own staff account, and a technician does not see what the office sees.
• Forms are rate limited, and every change to a request is written to an audit trail with the name of whoever made it.

No website can promise perfect security, and we are not going to. What we can say is that we hold as little as the job requires, for no longer than we need it — and that if a breach ever affected your information, we would tell you, and the authorities, as the law requires.

12. Changes to this notice

If we change how we handle your information, we change this page, and the date at the top changes with it. For anything significant we will say so on the site rather than quietly editing the wording. If a change would affect information we already hold about you, we will ask first where the law requires it.

13. Contact us about privacy

A person at the company reads these, not a ticketing system. Call (912) 858-3737, email info@brabham-hvac.com, or write to Brabham Quality Heating and Air, 5960 Ogeechee Rd Ste N, Savannah, GA 31419.

If you are not satisfied with how we have handled a privacy question, tell us and ask for it to be looked at again — say that you are appealing, and someone else here will review it and write back with the outcome and the reasons.