Privacy Policy

When you build a quote or ask us to call you, we collect what you type in:

• Your name, email address and phone number, and your preferred contact method.
• The property address and city for the work, the type of home, and your rough timeline.
• The details of the job itself — rooms, surfaces, measurements, paint choices and any notes you add.

If you create an account, we also store your email address and an authentication record so you can sign back in and see your saved quotes.

We do not ask for and do not want payment card numbers, government identification, or any health or financial information. Please do not send them through this site.

To price your job, to contact you about it, and to schedule the work — or an in-person quote, if you ask for one. Your address determines both travel and the scope of the work, so we cannot quote accurately without it.

If you enter your email address in the quote builder and do not finish, we keep what you have filled in so far so you can return to it — including if you close the page or leave part-way through. We may then send you up to eight follow-up emails about it, spread over about three weeks. Those are the only marketing emails this site sends. They are only ever sent between 10:13am and 11:13am Toronto time. Every one of them carries an unsubscribe link, unsubscribing stops them permanently and immediately, coming back to your quote pushes the next one further out, and we stop sending them after thirty days regardless.

We use a small number of service providers to run the business. They process your information on our behalf and are not permitted to use it for their own purposes.

• Jobber — our scheduling and customer management system. Quote requests, emailed quotes, in-person quote requests and messages from our contact form are all recorded here.
• Supabase — our database and sign-in provider, where quotes and accounts are stored.
• Resend — sends the quote emails and the follow-up emails described above.
• Cloudflare — serves this website, runs the bot check on our forms, and runs the advertising tags described below.

Some of these providers store or process data outside Canada, including in the United States, where it may be subject to the laws of that country.

Google and Meta are different, and we separate them deliberately: they are advertising platforms, not providers acting only on our behalf. They do use what they receive for their own purposes. What we send them is limited to the four events described in the next section — and their own tags observe a little more than that on their own, which the next section also describes.

Google’s address service is a separate use of Google again, and unrelated to the advertising above. When you type a property address into the quote form, what you type is sent to Google so it can suggest matching addresses; choosing one returns the full address and postal code, which we use to record where the job is. It receives what you type in that field whether or not you pick a suggestion, and it never receives your name, email address or phone number. The request is made by our server rather than by your browser, so Google does not see your IP address or set any cookie for it.

We do not sell your information, and we never have.

We advertise on Google and on Meta (Facebook and Instagram), and we measure which ads lead to work. To do that we tell those two companies when one of four things happens on this website: you submit a quote request, you ask us to email you your quote, you request a callback, or you start a quote — that last one being the moment the address you type on the quote page is found to be inside the area we work in. For the first two we also send the estimated value of the quote. The fourth carries no value and nothing about you at all: it is a count of quotes started, and nothing else. Those four are everything we report.

Google’s tag also adds your browser to an advertising audience without being asked. That is how you may see our ads again on other websites after visiting this one. As of 17 August 2026 we have checked what travels with it: no name, no phone number, no email address and no street address — it marks the browser as having been here rather than naming you. Meta’s tag can be used to build a comparable audience from the pages you view here.

The opt-out below stops all four reports we send, and stops your email address and phone number being attached to them.

We also send Meta a scrambled version of your email address and phone number, so that Meta can recognise you as the same person who saw the ad. The scrambling is one-way and is done by Cloudflare before anything leaves for Meta: what Meta receives is a long string of letters and numbers that cannot be turned back into your address or your number. Meta gets this only once you have given us those details in order to be contacted — never for someone who is only browsing.

To make that work across visits, we keep your email address and phone number in your own browser, in a cookie stored under our domain. It is sent to no one from there: it is read only by the Meta tag, and only after being scrambled as described above. We keep it for 30 days, it is never shared with any other website or subdomain, and you can delete it at any time with the button below.

Google receives the same two details, in the same scrambled form, and only on the three events that carry them — a submitted quote, an emailed quote and a callback request. Simply starting a quote never carries them. The scrambling happens in your own browser, by Google’s measurement tag, before the report is sent — your address and your number are not transmitted in a readable form at any point. As with Meta, this only happens once you have given us those details in order to be contacted.

We ask before we do this. Sending your email address and phone number to Google and Meta for matching is a different purpose from quoting your job, so it is not covered by the notice on your first visit. Beside every button that submits your details — the quote request, “email me my quote”, and the callback form — we state plainly that submitting means those two details may be shared in scrambled form with Google and Meta to measure which ads bring us work. Submitting is how you agree; not submitting is how you decline. We record, with your enquiry, that you were shown that statement, which version of it, and when. If you have already opted out below, the statement says so instead and nothing is sent.

One thing worth stating plainly, because it is the limit of what agreeing covers: we never send either company your name, your address, or anything about the job. Only the scrambled email address and phone number, and only on the three events that carry them — never when you merely start a quote. That is a limit on what we send, and neither company is ever sent your email address or phone number by us in a readable form.

Neither company’s script is written into these pages by us. Cloudflare, which serves the site, adds them at the network edge. Meta’s runs entirely at that edge through a tool-management service called Zaraz, so your browser is not asked to load anything from Meta at all. Google’s runs in your browser, but it is delivered from our own domain rather than from Google’s, and it sets a cookie of its own when a conversion is reported.

We also record how the site is used, with Microsoft Clarity, so we can see where people get stuck building a quote and make it easier. It records clicks, scrolling and which screens of the quote builder you reach, and can replay a visit as a simplified drawing of the page. It does not record what you type into a form: every box you fill in is hidden before anything leaves your browser, and so are numbers, email addresses, your name and your address wherever the site shows them back to you. Pages behind a sign-in are hidden entirely. Clarity runs in your browser, is added by Cloudflare in the same way as the tags above, and stores a visitor number of its own in two cookies. We tell it not to use anything for advertising. Microsoft may also set cookies on its own domains, which we cannot see or delete.

Where you are changes what we do by default. If you are in the European Economic Area, the United Kingdom or Switzerland, none of the advertising or measurement described above runs until you press Accept on the notice we show you — nothing is loaded, nothing is stored, and no report is sent before then. Everywhere else, including here in Ontario, those tags run from the start and the notice tells you so, with the opt-out below always available. We work this out from your internet connection, and if we cannot work it out we treat you as though you were in Europe.

You can switch off the reporting. Outside Europe these tags run unless you tell us otherwise — we show a notice about them on your first visit, and the button below turns the reporting off for good on this browser. Opting out stops the four reports described above from being sent to either company, ends any Clarity recording and deletes its cookies, stops us storing your email address or phone number for this purpose, and deletes the email address, phone number and visitor number already stored here along with the cookies Google’s tag left behind. It takes effect immediately and we remember it, so you are not asked again.

For Meta, opting out stops everything. Not just the four reports: once you have opted out, Meta is told nothing about your visits at all — no page addresses, no technical details, and not the internet address your device connects from. The tool that reports to Meta runs on Cloudflare’s network rather than in your browser, and your choice is checked there, before anything is sent. Verified on the live site, not merely intended.

Two limits on that, stated plainly. Meta keeps its own identifier for your browser, held on Cloudflare’s side rather than in a cookie we can reach, so we cannot delete it — what we can do, and do, is stop it being used, because no further event is sent. And it does not reach back in time: reports sent before you opted out have already been received. If you would rather none of it had happened, Meta’s own ad preferences on your Facebook or Instagram account control how information about you is used there, and a tracking blocker or your browser’s cookie settings will stop the rest.

Google is different, and we would rather say so than let you assume the two behave alike. Google’s tag runs inside your browser, so opting out switches it off there: it stops reporting, stops the advertising audience described above, and we delete the cookies it left behind. That is effective, and it is not the same as Meta’s case, where the reporting is stopped before it leaves Cloudflare.

Two further limits, honestly. Because we act on your choice rather than waiting for it, the page you are reading when you opt out has already been counted — everything after it is not. And the setting is remembered in a cookie, so it applies to this browser on this device: clearing your cookies clears it too, and you would need to opt out again. You can also use browser settings, a tracking blocker, or Google’s ad-preference controls on your Google account. None of this affects your quote, your callback, or our ability to serve you.

Cloudflare also counts page views for us in two ways of its own. One is a lightweight page-view counter that sets no cookies and reports only totals — how many people visited a page, not who. The other runs alongside the advertising tags above and stores a randomly generated visitor number in your browser so a repeat visit is not counted twice. Neither identifies you by name, and neither follows you to other websites.

We use browser storage to keep your quote in progress so you do not lose it on refresh, and to keep you signed in if you have an account. Neither is used to follow you around other websites, and neither can be switched off — the site does not work without them.

Cloudflare Turnstile runs a bot check on our forms. It is there to stop automated abuse and does not track you across other websites.

The advertising and measurement tags described above set their own cookies — Google’s in your browser, Microsoft Clarity’s two, plus the visitor number Cloudflare stores for its own counting. Meta’s identifier for your browser is held on Cloudflare’s side rather than as a cookie here, which is why the delete button below cannot remove it and we do not claim that it does. We set three of our own, all under our domain only and none of them shared with any other site:

• A randomly generated visitor number, so Meta can recognise a return visit as the same browser. It holds no name, email address or phone number, and expires after 90 days.
• Your email address and your phone number, kept for 30 days, and only once you have given them to us in order to be contacted. These are what get scrambled before being sent to Meta, as described above.
• A record of your choice about the tags above — whether you dismissed the notice or opted out. It holds one short word and nothing about you, and it lasts about 13 months. This is the one cookie that has to stay for an opt-out to be remembered: deleting it means we no longer know you objected, and the notice will appear again.

All of these are marked so they are only ever sent over a secure connection, are not available to any other website, and are not shared with subdomains. You can delete the first three at any time with the button in the section above, and clearing your browser’s cookies removes them too. That button also deletes the cookies Google’s measurement tag has stored under our domain. Blocking or clearing the rest is done the ways listed in that section.

Unfinished quotes are kept for up to thirty days, while the follow-up emails described above can still be sent, and then become eligible for deletion. Quotes you actually submit, and the customer records that follow from them, are kept as business records for as long as we need them for tax, warranty and dispute purposes.

If you unsubscribe or your email address bounces, we keep that address on a suppression list indefinitely. That record exists precisely so we do not email you again, and deleting it would defeat its purpose.

You can ask us to:

• Tell you what information we hold about you.
• Correct anything that is wrong.
• Delete your information, where we are not required to keep it.
• Stop emailing you — the unsubscribe link does this immediately.
• Stop reporting your activity to Google and Meta — the opt-out button above does this immediately, without asking us.
• Withdraw your agreement to us sharing your scrambled email address and phone number with Google and Meta — the same opt-out button does this too, and it applies from that moment on.

Email hello@prepprimepaint.ca or call (647) 646-8877 and we will respond within 30 days.

If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada.

Traffic to this site is encrypted in transit. Access to our database and customer records is restricted to people who need it to do the work. No system is perfectly secure, and we will not pretend otherwise — but we do not keep the categories of data that make a breach catastrophic.

This site is meant for adults arranging work on a property. We do not knowingly collect information from children.

If we change what we collect or who processes it, we will update this page and the date at the top. Material changes will be reflected here before they take effect.

Prep Prime Paint · Richmond Hill, Ontario · hello@prepprimepaint.ca · (647) 646-8877

See also our Terms of Service.