Privacy Policy

Information we collect

Details you provide. When you request a quote or contact us, we collect the name, email address, phone number, preferred contact method, and information you choose to share. Our forms ask about your vehicle, its condition and color, selected services, the work you want, and timing preferences. We also receive comments, reference links, and photos you upload through our inquiry and booking forms, and photos or messages you send separately by email or text.

Bookings and payments. For paid bookings we collect your contact details, vehicle description, package, selected appointment, accepted booking terms, and payment choice. We use Stripe-hosted checkout for invoice deposits and card payments when connected. Stripe processes card and billing information; our server receives transaction identifiers, amounts, payment status, and refund updates. We receive payment status, amount, currency, and payment/session identifiers so we can reserve the date, track the remaining balance, and resolve payment issues. We do not receive your full card number or security code. Invoice records can include customer and vehicle details, billing address, line items, discounts, owner-entered tax, deposits, credits, payment references, and refund history. A private invoice link gives its holder access to that invoice; do not share it publicly. Invoice pages do not run our advertising trackers. Card payment options appear on the invoice when our Stripe connection is available.

Customer records. We keep the request, submission time, reference number, communication preferences, and internal notes needed to respond and manage the work. If you become a customer, related quotes, communications, and service records may also be retained.

Website and security information. Our hosting providers process network and request information, which can include an IP address, browser and device information, requested pages, timestamps, and error or security logs. The inquiry service uses a hashed identifier derived from your IP address and email address to limit repeated submissions. Hashing does not necessarily make information anonymous.

Campaign information. If you arrive through a tagged advertisement or link and submit the detailing form, campaign labels such as the source, campaign name, and content may be included with your inquiry. These labels help us understand where the request came from.

Please do not enter payment-card details, government identification numbers, health information, or other sensitive personal information in the forms. Our forms do not collect card details. Booking photos are stored privately in Cloudflare object storage and are accessible to authorized staff. We resize supported photos before uploading and do not send photo contents to advertising platforms. Stripe hosts card checkout for invoice deposits and balances; do not put payment details in our text fields.

How we use information

We use information to answer questions, assess a vehicle or requested service, prepare and discuss quotes, arrange customer follow-up, manage agreed work, and keep related business records. We also use it to keep the website working, prevent spam and misuse, diagnose problems, and respond to privacy requests.

When optional analytics or advertising tools are active under the choices described below, we may use website activity to understand which pages are useful, improve navigation, measure advertising results, and reach people who may be interested in our services. You do not have to allow optional tracking to request a quote.

Cookies and browser storage

Cookies are small files stored by a website or service. Similar technologies include pixels, scripts, local storage, and session storage. Some support the service you ask for; others measure activity or advertising.

• Essential storage: we use session storage to keep your unfinished form answers, text-contact preference, and submission confirmation available within your browser session. A successful submission clears that form’s draft; the “Clear draft” or “Clear my answers” control lets you remove it earlier. Our background-video preference is also remembered for the session. Submission receipts hold an inquiry reference and timestamp; with advertising permission, a flag records whether its Lead event has been dispatched to avoid counting a refresh twice.
• Privacy preferences: we store your analytics and advertising choices, a notice version, and the time of your choice in local storage to remember your choices for 180 days. Expired records are cleared when you next visit. This preference record does not contain your form answers. Changing browsers, clearing storage, or a material notice update may cause us to ask again.
• Optional analytics: when connected and permitted, Microsoft Clarity may use cookies and similar technology for usage measurement, heatmaps, and session replay.
• Optional advertising: Meta uses cookies, pixels, and identifiers under the advertising choices described below for advertising measurement and personalization. Google Ads is planned and not yet connected.

You can review or change your choices using Privacy choices here or in the footer. On the main website, optional categories start off. On our detailing landing pages, booking page, and thank-you pages, Meta advertising tracking runs by default for visitors identified by Cloudflare as being in the United States, unless they have declined advertising or send Global Privacy Control. These pages do not show a cookie popup. Visitors outside the United States, or whose country cannot be determined, need prior advertising permission. You can opt out using “Privacy choices / Do not sell or share” in the landing-page footer. An explicit saved choice takes priority over the regional default. Rejecting tracking does not disable our inquiry forms. Choices apply to this browser, not automatically to every device or to provider accounts you use elsewhere.

Cloudflare provides a country-level setting for the landing-page default; we do not request your precise location for this. We honor a supported Global Privacy Control signal by keeping advertising permission off in our controls. A browser’s older “Do Not Track” setting is not the same signal. Essential hosting and security requests still occur when optional tracking is off.

Microsoft Clarity, Google Ads and Meta

Microsoft Clarity

Clarity can help us understand page navigation, clicks, scrolling, and interactions through aggregated reports, heatmaps, and session replays. When enabled, Microsoft may process device and browser information, identifiers, approximate location derived from network information, and interaction data. This helps us find usability problems and improve the site. We plan to exclude the private admin area and mask personal information in forms and displayed inquiry summaries. Microsoft also processes information under its own Privacy Statement.

Google Ads

Google Ads tracking can help connect an ad interaction with a later website visit or completed inquiry. Depending on the enabled features and your choice, Google may receive online identifiers, device information, pages or events visited, and advertising-interaction data. Advertising features can also support remarketing. See how Google uses information from partner sites and Google’s ad controls.

Meta Pixel and Conversions API

We use Meta Pixel to measure Facebook and Instagram advertising and support relevant advertising. When advertising tracking is active, Meta receives page-view events, a ViewContent event for the detailing landing page, and a Lead event after a successfully saved inquiry. Private invoice pages do not load Meta Pixel, and Stripe invoice payments are not currently reported as advertising Purchase events. These events include browser and device information, online identifiers, and page information. An opaque event identifier helps avoid counting the same inquiry twice. Our browser Pixel events do not include form answers. For server-side Lead and Purchase reporting through Conversions API, we send SHA-256 hashes of your normalized email address and phone number, along with the inquiry event identifier, event time, source page, IP address, browser user agent, and available Meta browser or ad-click identifiers. Hashing helps match events without sending those contact details in readable form; it does not make them anonymous. We do not send your name, vehicle details, written answers, or photos in these events. Automatic event configuration is disabled in our integration. Meta may associate information with an account under its own policies. See the Meta Privacy Policy and Meta Cookies Policy.

Meta Pixel and Conversions API respect the advertising choice and Global Privacy Control, including on the U.S. landing flow that otherwise defaults to tracking. The planned Clarity integration will use a separate analytics choice. Permission for website tracking is separate from permission to receive texts. We do not upload historical inquiry contact lists, use Google enhanced conversions or Meta automatic advanced matching, or send inquiry text and photos as advertising-event data. Server-side matching is limited to eligible new inquiries and payments.

Who receives information

Access is limited to the people and providers involved in operating Blackout Bay, responding to you, and supporting the services described here.

• Stripe: when checkout is connected, we share the invoice reference, payment amount, and customer email with Stripe to process the requested transaction. See Stripe’s Privacy Policy.
• Our business: authorized staff can review inquiries and associated internal notes. A new inquiry is also emailed to the owner, so the information is processed by our business email provider.
• Infrastructure providers: Cloudflare hosts and protects the website, stores inquiry records, and delivers inquiry notifications and customer invoice emails. Email, telecommunications, and other service providers may process information needed for communications and operations.
• Website resources: our current pages request fonts from Google Fonts. Google receives the network information needed to deliver those font files. This is distinct from Google Ads tracking.
• Analytics and advertising providers: Microsoft, Google, and Meta may receive the information described above when their integrations are active under the choices described in this policy.
• Other recipients where necessary: we may disclose information to comply with applicable law, respond to valid legal requests, protect people or property, resolve disputes, or support a business transfer subject to appropriate protections.

We do not sell inquiry contact lists for money. Certain disclosures to advertising platforms may be considered a “sale,” “sharing,” or targeted advertising under some privacy laws even without a cash payment. Advertising controls are intended to let you decline those optional disclosures when the tools are enabled.

Text-messaging permission is not shared with third parties for their own messaging campaigns. Communications providers may process phone numbers to support our customer communications. Separately, when advertising tracking is allowed, a hashed phone number may be shared with Meta for conversion matching as explained above.

Calls, emails and text messages

Sending a request asks Blackout Bay to follow up about the vehicle, quote, services, and appointment details. You can indicate how you prefer to be reached. Website tracking choices do not change the contact method you select in a form.

We use Twilio for business calls and text messages. Twilio processes phone numbers, message contents and attachments, delivery information, and call connection details. Photos received by text remain stored with Twilio until deleted there. Authorized staff can view supported photos privately in our dashboard; attachment references are saved with the conversation. Our staff workspace keeps messages, call times, duration, and status to manage customer conversations. Calls may be forwarded to a staff member’s phone or made through a browser. When call recording is enabled, we may record business conversations to maintain accurate service records and resolve customer questions, subject to applicable notice and consent requirements. Call recordings and voicemail recordings are stored with Twilio and are available only to authorized staff through our dashboard. Voicemail recording begins after the greeting.

When staff use VIN lookup, we send the vehicle identification number and optional model year to the U.S. National Highway Traffic Safety Administration’s vPIC service to retrieve manufacturer-supplied vehicle details. We do not send your name, phone number, or email address with that lookup.

We use Cloudflare Workers AI to automatically transcribe completed recorded calls and prepare summaries, customer notes, and suggested appointment or invoice details. Generated customer notes are saved automatically to the linked customer profile and identified as AI-generated; staff can review them against the source call. Audio is processed in separate customer and shop channels when available. A private working copy may be stored in Cloudflare R2 during transcription and removed when transcription completes; interrupted jobs may retain that copy until resumed or deleted. Transcripts, customer notes, and draft suggestions are stored in our private customer workspace. Staff review appointment and pricing suggestions before applying them. Call-summary tools do not independently approve purchases or charge a card. For customers who agree to texts, we also use Cloudflare Workers AI to understand incoming messages and draft service-related replies. Form details and recent message history are processed for that purpose. Ara, our text assistant, sends messages on behalf of Blackout Bay and identifies herself as AI if asked. She gathers information, explains services, checks our calendar and can save an appointment after you approve its details by text. Customer-provided details may be saved in an AI-labeled profile note with source-message references. Pricing, changes to existing appointments and unresolved questions go to staff. Ara does not take payments or change invoices. Staff can pause the assistant or take over a conversation.

The form includes an optional “You can text me” checkbox. It is unchecked by default; check it to agree to text updates, or leave it unchecked and request a call or email instead. We record the submitted choice, disclosure version, source form, phone number, and time. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

If text messaging is enabled, messages may be automated or handled by an AI assistant and may relate to inquiries, quotes, scheduling, or agreed work. Message frequency varies and message and data rates may apply. Text permission is not a condition of purchase. Reply STOP to opt out or HELP for help, or contact us directly. Request-related text permission does not enroll you in unrelated promotional campaigns. More information is in our Text Messaging Terms.

How long we keep information

We retain information for as long as reasonably needed for the purpose it was collected: responding to an inquiry, completing or documenting services, maintaining business records, resolving disputes, preventing abuse, or meeting legal obligations. The appropriate period depends on the record and whether you become a customer.

Form drafts are stored in your browser session as described above. Our privacy-preference record expires after 180 days. Submitted inquiries, owner-notification emails, and internal notes are separate business records; clearing your browser does not delete them. You can ask us to delete information by contacting us. Some records may need to be retained for legal, security, accounting, or dispute-resolution reasons, and backups may be removed on a different schedule.

Server-side conversion payloads are removed from our delivery queue after acceptance or final failure. Temporary delivery failures may be retried for up to 48 hours; we retain delivery status and the inquiry reference for diagnostics. Meta’s retention periods depend on its policies and the type of information. Its first-party _fbp and _fbc advertising cookies may last up to about 90 days and may be renewed during permitted visits. When you withdraw advertising permission, our site revokes Pixel consent and removes these first-party cookies. This does not delete data already received by Meta. We will update this notice when other optional services are connected.

Your choices and privacy requests

You may contact us to ask what personal information we hold about you, request a correction or deletion, ask for a copy, or object to a use. Depending on your location and the laws that apply, you may also have rights to restrict processing, portability, withdraw consent, or opt out of sale, sharing, targeted advertising, or certain profiling.

Send requests to hello@blackoutbay.com with the subject “Privacy request,” or call 507-707-7788. Include enough information for us to locate your records, such as the email address used for your inquiry or its reference number. Do not send sensitive identity documents unless we specifically request an appropriate verification method.

We may verify your identity and, when relevant, an authorized agent’s authority before disclosing or changing records. We respond within the time required by applicable law and explain any applicable exception. Where you have an appeal right, reply to our decision and ask for a privacy appeal. You may also contact the relevant privacy regulator or your state attorney general. We will not unlawfully discriminate against you for exercising a privacy right.

You can withdraw optional tracking permission through Privacy choices. Withdrawal affects future processing; it does not automatically erase previously collected information or provider records. To request deletion, contact us and use relevant provider controls where applicable.

Security and processing locations

We use measures designed to protect information, including HTTPS, restricted access to the inquiry inbox, and controls against repeated automated submissions. No website, storage system, email, or text channel can be guaranteed completely secure.

Blackout Bay operates in Rochester, Minnesota. Information may be processed in the United States and other locations where our service providers operate. Privacy laws in those locations may differ from those where you live. Where applicable law requires safeguards for a transfer, those requirements apply to the relevant processing.

Children and external websites

Our website and services are intended for adults arranging vehicle services. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, please contact us so we can review and remove it as appropriate.

Links to reference material, photo credits, social platforms, and other external websites lead to services with their own privacy practices. This policy covers Blackout Bay’s website and customer-inquiry process, not those independent services.

Updates and contact

We may update this policy when our services, tools, or practices change. The date at the top identifies the latest revision. Where a change requires renewed consent or additional notice, we will provide it before relying on that permission.

Blackout Bay
2345 26th St NE
Rochester, MN 55906
hello@blackoutbay.com
507-707-7788