Legal · CCPA / CPRA · Effective 2026-05-29

Privacy policy

This notice explains what personal information Sierra Mechanical Corporation collects through this website, what we do with it, and the rights you have under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). We are not a consumer business - our customers are general contractors, property managers, restaurant operators, healthcare facility teams, and similar B2B buyers - but we still collect and process personal information from individuals visiting this site, and CCPA/CPRA applies.

Who we are

Sierra Mechanical Corporation. California State Contractors License Board (CSLB) license #614027, C-20 (HVAC) and C-43 (Sheet Metal). Headquartered at 3253 Fitzgerald Road, Rancho Cordova, California 95742, USA. Phone (916) 638-8605. Privacy contact: contact@sierramechcorp.com with subject line "Privacy request."

Notice at collection

When you submit our bid request form, contact form, or interact with our AI chat assistant, we collect personal information described below. We collect this information directly from you when you give it to us. We do not "sell" personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under CCPA/CPRA. We retain this information for the duration of any active business relationship and for at least one year following the last interaction for project-record and tax-compliance reasons (commercial mechanical contracting generates audit and warranty obligations that outlast typical e-commerce retention windows).

Categories of personal information we collect

Mapped to the CCPA category framework (Cal. Civ. Code § 1798.140):

  • Identifiers: name, business email address, business phone number, company name, role/title.
  • Customer records (Cal. Civ. Code § 1798.80(e)): the same identifiers above, used in the context of a business inquiry or contract.
  • Commercial information: the project details you provide - project name, location, target start, budget range, scope notes - and any files you upload (PDF/DWG/RVT/IFC).
  • Internet or network activity information: pages viewed, referring URL, browser type, approximate location derived from IP address, interactions with the AI chat assistant (if used). Collected via Google Tag Manager / Google Analytics 4 only after you grant consent through our consent banner.
  • Inferences: none drawn for advertising or profiling purposes.

We do not intentionally collect: race, ethnicity, religion, union membership, genetic data, biometrics, precise geolocation (better than ZIP-code resolution), health/medical information, sexual orientation, social-security or driver-license numbers, or financial-account credentials. If you upload a project file that incidentally contains any of these, please tell us so we can isolate and securely delete it.

Why we collect it (business and commercial purposes)

  • To respond to your bid request, quote, or general inquiry.
  • To estimate, schedule, and execute commercial mechanical work for which you have engaged us.
  • To maintain project records as required by California construction law, lien-rights statutes, and our insurance carriers.
  • To maintain and improve this website (analytics, error logging - consent-gated).
  • To detect and prevent spam and fraudulent submissions (via Cloudflare Turnstile, honeypot, and rate limiting).
  • To provide the AI chat assistant. Your messages to the chat assistant are sent to OpenAI for processing under OpenAI's data-processing terms. Do not paste confidential project details, contract values, or proprietary plans into the chat.

Third parties who receive your personal information

We engage the following service providers as our processors. They process your information only on our written instructions and only for the purposes described:

  • Web3Forms (form-submission relay): receives your bid form contents and forwards them to contact@sierramechcorp.com. Web3Forms's privacy policy applies during this transit.
  • OpenAI (chat AI processing): receives the text content of your chat messages if you choose to use the chat widget. Per OpenAI's API data-processing terms, chat content sent via the API is not used to train OpenAI's general models. Chat content may be retained by OpenAI for up to 30 days for abuse-prevention purposes before deletion.
  • Cloudflare (Turnstile bot-mitigation, when enabled): receives a session token and basic browser fingerprint to verify you are not a bot. Cloudflare's privacy policy applies.
  • Google (Google Tag Manager / Google Analytics 4, only after consent): receives aggregated pageview and event data. Set to anonymize IP addresses; no remarketing, no advertising-feature signals.
  • Vercel (serverless hosting for the chat API): processes requests in transit; standard hosting-provider data handling.
  • Hostinger (static site hosting): processes requests in transit; standard hosting-provider data handling.

None of these arrangements constitute a "sale" or "share" of personal information under CCPA/CPRA.

Your rights under CCPA/CPRA

If you are a California resident:

  • Right to know. You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
  • Right to delete. You may request that we delete personal information we collected from you, subject to exceptions (e.g., information needed to complete a transaction, comply with legal obligations, or maintain warranty/lien records).
  • Right to correct. You may request that we correct inaccurate personal information.
  • Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising. The "Do Not Sell or Share My Personal Information" right therefore does not apply to us in practice, but you may still exercise it as a precaution.
  • Right to limit use of sensitive personal information. We do not collect or use sensitive personal information for purposes beyond those listed in Cal. Civ. Code § 1798.121(d), so there is no separate limit to request.
  • Right to non-discrimination. We will not deny services, charge different prices, or provide a different level or quality of service because you exercised any of these rights.

To exercise any of these rights, email contact@sierramechcorp.com with subject line "Privacy request" and describe what you want. We will verify your identity (typically by confirming your request from the email address we have on file with you, or by matching identifying details against our records) and respond within 45 days. There is no fee.

Cookies and analytics

This site uses cookies and similar technologies only after you grant consent through our consent banner. By default, all non-essential cookies and analytics are denied. The categories we may set after consent:

  • Strictly necessary: consent-preference cookie (`smc_consent`), and short-lived session/CSRF tokens used by the bid form. These are always set; they are required for the site to function.
  • Analytics (consent required): Google Analytics 4 via Google Tag Manager. Used to count pageviews and understand which pages help GC and operator buyers. IP anonymization enabled.
  • Bot mitigation (consent required when active): Cloudflare Turnstile session token, set only when the bid form is rendered.

You can withdraw consent at any time by clicking the "Privacy settings" link in our site footer, which re-opens the consent banner with your current selections.

Children

This site is intended for commercial B2B audiences. We do not knowingly collect personal information from individuals under 16. If you believe a minor has submitted personal information through this site, please contact us and we will delete it.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. This includes TLS encryption in transit, server-side rate limiting and bot mitigation on form and chat endpoints, restricted access to project files, and the security headers documented in our deployment configuration. No method of transmission or storage is perfectly secure, but we err on the side of caution.

Changes to this notice

We may update this notice from time to time. When we do, we will update the "Effective" date at the top of the page. Material changes will be highlighted on the home page or at the top of this notice for at least 30 days.

Contact

Privacy questions, rights requests, complaints: contact@sierramechcorp.com, subject line Privacy request. By mail: Sierra Mechanical Corporation, Attn: Privacy, 3253 Fitzgerald Road, Rancho Cordova, California 95742, USA.

This notice is provided for transparency and CCPA/CPRA compliance. It is not legal advice and does not create an attorney-client relationship.