AI calls, recordings, and transcription are owner-confirmed. Provider retention, in-call recording consent, downstream AI processing, and final privacy procedures still need confirmation. This page does not configure the phone agent or certify legal compliance.
1. Scope and the business behind this site
This policy describes information handling for Solana Beach Heating and Air, this website, service and estimate inquiries, and calls to (619) 848-3500. The coastal business is presented as a Paulson AC company. The verified licensed contracting entity is PAULSON A C, CSLB #1044938, classification C-20. The Solana Beach DBA and operational service boundaries remain pending approval.
This is a comprehensive draft for business and legal review, not a representation that all outstanding practices have been verified. The phone provider’s retention, recording-consent configuration, downstream AI processing, and the business’s complete retention and privacy-rights procedures must be confirmed before this notice is approved. Separate signed service agreements govern contracted work.
2. Information collected and its sources
Information comes from you when you fill out a form, call, email, or communicate with staff. Required website inquiry fields are name, phone number, ZIP code, and service requested. Optional fields depend on the form and can include email, address, equipment type and age, project timing, preferred appointment date or window, and your description.
A submitted inquiry also includes a unique submission identifier, submission time, landing-page URL, referring page, and campaign parameters if present (including UTM parameters and a Google click identifier). These are stored with the inquiry to understand its source and prevent duplicate submissions. A phone-derived hash is used for submission-abuse checks. These request records are separate from cookie-free visitor analytics.
Please do not include payment-card details, passwords, Social Security numbers, medical information, alarm or gate codes, or other sensitive information in general forms or AI calls. An exact service address can be provided when needed to check coverage. This site does not collect online membership payments.
3. AI agents, call recording and transcription
Calls to (619) 848-3500 are handled by an AI sales/reception agent using Twilio and Vapi. The owner confirms that calls are recorded and transcribed for quality assurance. You are communicating with automated software, not necessarily a human, licensed technician, or emergency dispatcher.
Call information can include your telephone number, call date, duration and routing information, your voice and what you say, recordings, transcripts, and information you provide about your home or service needs. Twilio provides telephone infrastructure and Vapi supports the AI conversation. These services receive or process call information to provide those functions; business personnel may review recordings and transcripts for quality assurance and follow-up.
Recording and transcription can involve confidential communications. Appropriate notice and any legally required consent must be obtained in the call itself before recording or transcription starts. This website notice, use of the site, or a submitted form is not a substitute for that consent. The actual greeting and consent controls have not been verified here.
If you do not want to use the AI agent or be recorded, do not provide further information through that call. Use admin@paulsonac.com or the contact form to request a human follow-up. A transfer or unrecorded telephone option is not guaranteed and must be arranged with staff.
Recording and transcript retention periods, storage locations, access permissions, deletion procedures, and any additional speech, language-model or other AI subprocessors are awaiting confirmation. No promise is made that providers never use information for model training or that every request can immediately remove copies held in backups or by providers. Ask the team for the current provider-specific practices before sharing sensitive information.
AI responses can be incomplete or wrong. Ask staff to verify appointment details, prices, diagnosis, equipment recommendations, membership terms, financing, warranties, and service coverage. Do not rely on an AI conversation for safety-critical advice.
4. How information is used
Inquiry information is used to review your needs, check the service address, respond to your request, discuss repair or installation options, coordinate scheduling, manage lead status, and maintain relevant service communications. Call recordings and transcripts are used for quality assurance as confirmed by the owner.
Technical and security information supports site operation, authentication, duplicate prevention, abuse checks, troubleshooting, and protection of customer records. Information may also be needed for applicable legal obligations, records of authorized work, or the establishment or defense of legal claims. A request is not a confirmed booking, and providing contact information is not blanket permission for promotional campaigns.
5. Who receives information
Website service requests are stored through Lovable Cloud and made available to authorized business staff through restricted lead-management access. Hosting and technical service providers process information needed to deliver, maintain, and protect the site. Twilio and Vapi handle telephone and AI-call information as described above.
If you email the business, your email service and the business’s email service process the message and delivery information. If you choose a Google or Lovable staff sign-in option, that provider handles authentication information. External social and resource links are not embedded review or advertising feeds; visiting them exposes information directly to the destination under its own policy.
Information may be disclosed when legally required, to respond to valid legal process, protect safety and security, or in a business transfer subject to applicable protections. The full vendor/subprocessor list and contractual data-use restrictions remain subject to business review. This draft does not certify that every provider’s handling qualifies as a legally defined service-provider arrangement.
No advertising pixel, remarketing campaign, or marketing SMS feature is implemented in the reviewed site code. This is not a verified business-wide statement that personal information is never sold or shared as those terms are defined by privacy law. Any sale, cross-context behavioral advertising, or other vendor use must be assessed and, if applicable, disclosed with appropriate opt-out controls before activation.
6. Cookie-free visitor analytics
Visitor analytics is enabled for the published site. Lovable’s analytics uses no cookies, stores nothing on a visitor’s device, does not keep IP addresses, and does not identify visitors or recognize returning visitors. Each visit is counted separately; editor previews are not counted.
It records pages visited, where visitors came from, country, browser, operating system and device type, time on the site, page-load speed, and errors. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it (linked below).
There is no consent banner or Google Consent Mode configuration in the reviewed site. The analytics described here records page visits, time on page, speed and errors for every visitor, without cookies or identifying anyone. Click-tracking status could not be verified, so this notice does not assert that clicks are collected. The application does not send custom tracking events through Lovable’s event-tracking interface; runtime error reporting is included in errors.
This cookie-free counting must not be confused with information you intentionally submit in a form or call, staff sign-in storage, or data handled by external services. Privacy requirements vary by jurisdiction; the business must review the practices applicable to its visitors before final approval.
7. Browser storage, sign-in and external resources
Staff sign-in uses persistent browser storage for authentication sessions through Lovable Cloud. Google and Sign in with Lovable are offered as optional staff authentication providers. Account, session and access information supports restricted staff access; public service forms do not require a customer account. Sign out on shared devices and do not share staff credentials.
The site loads fonts from Google Fonts and sourced images from hosted asset services. Those requests expose technical request information, such as IP address and browser request headers, to the receiving service. Hosting and network infrastructure also necessarily process requests; the statement that Lovable analytics does not retain IP addresses does not apply to every network provider.
There is no advertising-cookie or cookie-consent preference system implemented in this draft. Your browser can restrict storage and external requests, although doing so may affect staff sign-in, images or fonts. External destinations can use their own cookies and technologies.
8. Contact preferences and promotional communications
Submitting an inquiry supplies information for reviewing and responding to that inquiry. It does not constitute consent to unrelated marketing texts, prerecorded or AI-generated outbound sales calls, or enrollment in a membership. The current website does not send marketing SMS.
Tell staff through the contact form or email if you prefer a particular contact method or do not want promotional follow-up. Any future marketing SMS, automated outbound calling, or email campaign needs its own legally appropriate notice, consent or opt-out process. This policy does not create that authorization. Essential communications about work you have authorized may still be needed, as permitted by law.
9. Retention, security and international processing
The website inquiry retention schedule and call-recording/transcript retention periods have not been confirmed. No arbitrary deletion period is promised. Before approval, the business must document periods or objective criteria for inquiries, contracted-work records, recordings, transcripts, security logs and backups, taking account of purpose, applicable obligations and legal holds. Visitor analytics has the specific periods described above.
Service requests have restricted staff access and are not publicly readable. Validation and abuse checks protect submissions. No internet transmission, cloud service or access-control system is perfectly secure. Use care when sharing information and contact the team if you believe a record or account has been compromised.
Hosting, phone and AI providers may process information outside your state or country. The actual storage regions, international-transfer arrangements and safeguards have not been verified. This draft does not promise that all information stays in California or the United States.
10. Privacy requests and California residents
To request access to, correction of, or deletion of information you supplied, email admin@paulsonac.com with “Privacy request” in the subject or use the contact form. Explain the request and how staff can find the relevant inquiry or call, for example its approximate date and the number used. Do not send sensitive identity documents unless a secure, necessary verification method has been arranged.
Applicable rights depend on the law, the business’s legal status and the circumstances. If the California Consumer Privacy Act as amended applies, eligible consumers may have rights to know/access information, request deletion or correction, opt out of sale/sharing, limit qualifying uses of sensitive information, and receive equal treatment for exercising rights. An authorized agent may submit a request subject to proof of authority and appropriate identity verification. These rights can be subject to legal exceptions.
The business’s CCPA applicability, response procedures and sale/sharing classification remain to be assessed. Requests must be handled within applicable statutory periods where the law applies; this draft does not create a shorter contractual deadline. Information needed for legal compliance, security, completed transactions or legal claims may be retained where permitted.
There is no custom advertising opt-out or Global Privacy Control handler implemented in the site code. Lovable’s analytics treats Global Privacy Control as described by its service, but that does not certify all phone or business practices. If sale or sharing subject to an opt-out right is introduced, the required notices and recognized preference-signal handling must be configured before use.
11. Children and sensitive submissions
The site and AI phone service are intended for adults arranging home services, not children under 13. Children should not submit information or contact the AI agent on their own. If you believe a child supplied information, contact the team so the matter can be investigated and addressed under applicable law. Only share information you are authorized to provide.
12. Changes and contact
Draft last revised November 12, 2026. Material practice changes require corresponding notice updates and any additional notices or consent required by law. Questions and privacy requests can be sent to admin@paulsonac.com or through the contact page.
The parent website lists 4901 Morena Blvd, Suite 322, San Diego, CA 92117. This is a sourced parent-company address, not a represented Solana Beach branch or verified dedicated privacy-mail address. The business must confirm its final privacy contact and mailing process before approval.
Provider privacy resources
Provider policies do not establish which optional settings, subprocessors, retention periods, or data-use restrictions apply to the business’s accounts.
Questions or a privacy request?
Email admin@paulsonac.com or send a message. For an alternative to an AI or recorded call, request human follow-up by email or form.