Privacy Policy

Effective date: November 4, 2026 · Policy version: 2026-11-04

Full Stack HVAC is a product of PitchPipe Technologies Inc., a corporation incorporated under the Canada Business Corporations Act (corporation number 1444994-1). References to "Full Stack HVAC," "we," "us," and "our" on this page mean that corporation. Full entity details: Legal Notice & Company Information.

Who is responsible for your data

The data controller for personal information collected through Full Stack HVAC is:

• PitchPipe Technologies Inc. (corporation number 1444994-1, incorporated under the Canada Business Corporations Act)
• Mailing address: 16 Lowther Lane, Bedford, Nova Scotia B4B 0L6, Canada
• Privacy contact: privacy@fullstackhvac.com
• Telephone: (902) 517-2550

Direct any access, correction, or deletion request — and any complaint about how we handle your personal information — to the privacy contact above.

1. Data We Collect

During the onboarding process and use of our services, we collect:

• Business information: Company name, service types, service areas, certifications, and other details you provide during the onboarding conversation
• Contact details: Your name, email address, and phone number
• Photos and logos: Images you upload for use on your website
• Consent records: Timestamps of when you agreed to our terms and policies
• Usage data: Session information and interactions with the onboarding wizard
• Analytics data: Unless you decline analytics, we collect pageviews, clicks, form interactions, scroll depth, and session replays (recordings of your screen interactions with mouse movements and click coordinates). All form inputs are automatically masked in recordings. PostHog collects this by default; you can stop it with Decline on our cookie banner or with Do Not Track (see 4b).
• Phone number: When SMS verification is enabled, your phone number is collected for trial signup verification and account recovery
• IP address: Your IP address may be logged at signup for rate limiting and fraud prevention purposes
• Feedback reports: If you use our feedback form, we store your words, the kind of report, the site version, the part of the site you came from, your screen size, browser family and reduced-motion setting. A signed-in report is linked to your account. A guest report carries a daily-rotating hash of a random id saved in your browser. Your IP address isn't stored with a report; it's used briefly to limit repeat sends and goes to Cloudflare for the bot check.
• Device information: We may collect a lightweight browser fingerprint hash (canvas, WebGL renderer, timezone, screen resolution, language, platform) for anti-abuse monitoring when this feature is active

2. How We Use Your Data

Website Generation

Your business information is processed by AI language models to generate website content including page copy, service descriptions, and market positioning. Photos are analyzed by AI vision models to generate descriptions and determine layout placement.

Building a Website in Plenum Town

If you build a website from the Agency desk in Plenum Town, you're using the same website builder as at /build/. Your answers, photos and logos are processed, stored, shared with subprocessors, kept and deleted exactly as this policy describes for website generation. Building in the town doesn't change what we collect for your website.

Market Research

We use your business details (service area, service types) to conduct automated research about your local market, competitors, and industry context. This research informs the content generated for your website.

Content Moderation & Community Safety

Your submitted information, along with user reports and platform usage patterns, is used to detect and prevent abuse, fraud, and violations of our Acceptable Use Policy and Community Content Policy. We may use automated systems and manual review to flag suspicious accounts, verify business legitimacy, and moderate community content (reviews, ratings, testimonials).

Communications

If you opt in to email communications, we may send you updates about your website, product features, and tips for improving your online presence. You can unsubscribe at any time.

3. Data Storage

• Structured data (business information, session data) is stored in PostgreSQL databases on our infrastructure
• Uploaded files (photos, logos) are stored in MinIO object storage on our infrastructure
• Generated websites are stored on our hosting infrastructure

4. Third-Party Services & Subprocessors

We use the following third-party services to provide our platform:

• AI language models (Anthropic Claude, OpenAI): for content generation and onboarding conversation
• Research APIs (Jina, Tavily): for automated market and business research

Data shared with third-party services is limited to what is necessary for their specific function. We do not sell your data to third parties.

The following subprocessors may process your personal data on our behalf:

4a. AI Data Disclosure

Your business information is processed by AI models (Anthropic Claude) to generate website content including page copy, service descriptions, and market positioning. We do NOT use your data to train AI models. AI-generated content may contain inaccuracies and should be reviewed and verified before publication.

4b. Analytics & Session Replays

We use two analytics services. Umami is self-hosted and cookie-free — it collects anonymous pageview counts without identifying individual users and requires no consent.

PostHog provides product analytics, session replays, and heatmaps. PostHog runs by default. It stops when you click Decline on our cookie banner: from then on it isn't loaded in that browser (or, if your browser blocks site storage, for the rest of that tab's session), and nothing more is collected. Clicking Accept, or leaving the banner alone, keeps it on. Session replays are never recorded on our feedback page.

When PostHog is active, it collects:

• Pageviews, clicks, form submissions, and scroll depth
• Session replays: recordings of your interactions including mouse movements and click coordinates. All form inputs are automatically masked in recordings.
• Heatmaps: aggregated click and scroll patterns

PostHog data is processed by PostHog Inc. on their US Cloud infrastructure (Virginia, United States). Analytics data is retained for 1 year; session recordings are retained for 1 month. You can request deletion of your PostHog data by contacting us at privacy@fullstackhvac.com.

We respect the Do Not Track (DNT) browser signal. If your browser sends DNT, PostHog records no events or session replays, whatever you chose on the banner. See our Cookie Policy for details on specific cookies used.

4c. Cross-Border Data Transfers

PitchPipe Technologies Inc., which operates Full Stack HVAC, is based in Nova Scotia, Canada, and the service is operated from there. Some of your data may be processed in the United States by our subprocessors (see table above). By using our services, you acknowledge that your data may be transferred to, stored, and processed in jurisdictions outside Canada, including the United States, where data protection laws may differ from those in your jurisdiction.

4d. Plenum Town

Plenum Town is the optional game at /play/. This section covers what the town collects on top of the rest of this policy. Typing to the people in the town is covered in 4e.

Playing without an account

As a guest, the town keeps your progress in your browser's local storage, not on our servers: the characters you've met, what you've unlocked and your place in the story. Nothing you unlock is sent to us until you create an account and choose Claim; then it moves to your account and is kept with it. Clearing your browser storage deletes guest progress.

Your browser also keeps a random visitor id. It's sent when you enter the town, so the town can call you "Visitor" with a number. When a character greets a guest, the browser sends which characters you've met and which rooms you've entered, so the conversation can pick up where it left off. That record carries no name, account or time.

Playing with an account

We store the following with your account:

• Your character and Shop: class, look, Shop name and colours, and your town settings
• Progress: XP, achievements, quests, service calls, pledges, arcade best scores, and what you've unlocked or claimed
• Town activity: rooms and events you've visited, doors you've used, arcade plays and the like, which the town uses to award progress
• Characters' memory of you: when you first and last visited, and the last topic, as a short label and never your words. You can make a character forget you from its chat panel

We keep this for as long as your account exists, and deleting your account deletes it. Town progress has no effect on product scores, rankings, recommendations or reviews.

Your name in the town

Where the town shows players, it shows the short form of your account name (for example "Ben R."), your look and, if you choose, your level. You can hide yourself from other players with the Show me to other players switch. Turning it off also takes you off the pledge board and the public arcade boards, which list the ten best scores by short name (you still see your own best score). We can also remove an arcade entry if you ask.

The room server

While you're in the town, your browser keeps a live connection to our room server. It receives your moves and emotes, holds them in memory only, and stores nothing. It tells our servers about visits, plays and similar activity, which is stored with your account as described above. On fullstackhvac.com, other players are not shown to you, and you are not shown to them.

Analytics in the town

Umami counts page views on /play/ the same way as on the rest of the site: cookie-free, with no account id, no query string, and only the origin of the referring page. When PostHog is active for you (see 4b), the town also sends a few events: entering the town, low-data mode, opening a terminal, leaving for the rest of the site, choosing or changing a class, and opening or saving the wardrobe. These events carry no account id, XP or personal data. PostHog also counts clicks in the town, as on the rest of the site, but in the town it masks the text of what you click. Session replays are never recorded in the town.

Podcasts in the town

The town's Radio and Media can play podcast episodes. Nothing loads from a show's host until you choose Play here. Then the audio comes from that host, which receives your IP address and may set its own cookies. The episodes you've played are remembered in your browser only.

Feedback to Amos

Feedback you give Amos in the town is handled like the feedback form in section 1, and kept for the periods in section 5. Card numbers, codes and personal contact details are masked before it's stored. It isn't sent to an AI model.

4e. Typing to the People in Plenum Town

Typing to a character is available only to signed-in players who confirm they are 18 or older, and only while characters can answer with AI. Until then a character's chat panel shows a short note in place of the text box, nothing you could type is sent or kept, and nothing in this section applies to you. You don't have to type: greetings and suggested replies work without it. Before anything you type is stored or sent anywhere, we mask card numbers, one-time codes and personal phone numbers and email addresses. Please don't share personal information in the town.

Who sees what you type

Many replies come from lines we wrote. When a character answers with AI, your message (masked) is sent to OpenAI or Anthropic in the United States, along with your recent turns with that character, your first name, class, level band and Shop size, a coded id that isn't your account id, and, if you let the character remember you, your visit history. OpenAI also checks each typed message for safety and matches it to the right topic, whichever way that message is answered. Neither provider uses this data to train its models; each may keep it for up to 30 days for abuse monitoring.

What we keep

• The last few turns with a character, for 30 minutes, so the conversation makes sense. They're cleared sooner when the character closes the chat for the day, when you withdraw your 18+ confirmation, or when you make the character forget you.
• A chat log of each typed turn: what you typed (masked, up to 500 characters), how it was answered and technical details. We use it to check replies for safety and quality. Each entry is deleted after 90 days.
• The character's memory described in 4d, if you allow it.

Deleting your account deletes all of this.

Business contact details. A company phone number or email address you type isn't masked: it may reach the AI provider and the chat log. Leave it out if you don't want it kept.

5. Data Retention

We retain your data for as long as your account and website are active. If you request account deletion, we will remove your personal data and uploaded content within 30 days, except where retention is required by law.

Feedback reports sent without an account are deleted after 90 days. Reports linked to an account are deleted 90 days after we resolve them, and no later than 180 days after they were sent. Deleting your account deletes its reports. Copies in our backups age out on our normal backup schedule.

5a. Data Deletion

Upon a verified deletion request, we will permanently delete your data within 30 days. This includes database records, file storage (photos, logos, generated content), and backup systems. Some data may be retained beyond this period where required by applicable law (for example, billing records required for tax compliance).

5b. Breach Notification

In the event of a confirmed data breach that affects your personal information, we will notify all affected customers within 72 hours of becoming aware of the breach, via email to the address on file and via a notice in your account dashboard. The notification will describe the nature of the breach, the data affected, and steps we are taking to contain it.

6. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data and uploaded content
• Opt out: Unsubscribe from marketing emails at any time
• Analytics opt-out: Decline analytics via the consent banner, or enable Do Not Track in your browser

These rights apply to the personal data we hold about you even if you do not have a Full Stack HVAC account. As part of building our HVAC product and vendor catalog, we may hold business-contact information collected from public sources. That information is internal-only — we do not sell it and we do not publish it on the site. To access, correct, suppress, or delete contact data we hold about you, or to unsubscribe from outreach, use the request form on our Listing, Corrections & Removal Policy page or email privacy@fullstackhvac.com. (Correcting or removing a public catalog listing is a separate matter — distinct from your personal contact data — and is also covered by that policy.)

7. Security

We implement reasonable technical and organizational measures to protect your data, including encrypted connections, access controls, and secure storage. However, no method of transmission or storage is 100% secure.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account.

9. Related Policies

This Privacy Policy works in conjunction with our other legal documents:

• Cookie Policy: Details on cookies and tracking technologies we use
• Terms of Service: Your rights and responsibilities when using our platform
• Acceptable Use Policy: Rules for platform conduct
• Community Content Policy: How we manage reviews and user-generated content
• DMCA & Content Dispute Policy: How to report copyright or trademark infringement

10. Contact

For privacy-related questions or to exercise your data rights, contact us at privacy@fullstackhvac.com.