Privacy Policy

This policy applies to Astro Epoxy's public website, customer proposal pages, estimate and consultation workflows, customer communications, and our internal customer relationship management tools. Astro Epoxy is operated by Astro R&M LLC in the Greater Houston area. In this policy, “Astro Epoxy,” “we,” “us,” and “our” refer to that business.

Other services that you choose to use—such as Facebook, Instagram, Stripe, Google, or DocuSign—also process information under their own terms and privacy notices. This policy describes Astro Epoxy's handling of information and does not replace those providers' notices.

The information we handle depends on how you interact with us and may include:

• Contact information: name, email address, phone number, company name, social-media username or account-scoped identifier, and your contact or marketing preferences.
• Project information: project address or ZIP code, property and space type, approximate square footage, slab or surface condition, desired system or appearance, priorities, timeline, consultation preference, descriptions, photos, and other files you choose to provide.
• Communications: email, Messenger, and Instagram message content; attachments; message timestamps; delivery or read status; and notes our team creates after calls, consultations, or project activity.
• Estimate and project records: appointments, estimates, options, approvals, contracts, change orders, invoices, job notes, warranty or service communications, and related documents.
• Transaction information: amount, currency, payment status, refund status, and processor transaction identifiers. Payment card details are entered on Stripe's hosted checkout and are processed by Stripe rather than entered into Astro Epoxy's CRM.
• Advertising and technical information: landing and conversion pages, referring page, campaign parameters, click identifiers such as GCLID or FBCLID, call or form conversion events, timestamps, and technical or security information such as an IP address or a one-way hash derived from it.
• Authorized team account information: authentication identifiers, role, and activity needed to protect and operate private CRM tools.

• Directly from you when you submit a website form, upload photos, call, email, message us, schedule a consultation, respond to an estimate, sign a document, or make a payment.
• From Meta when you message Astro Epoxy through Messenger or Instagram, submit a Meta Instant Form, or when Meta reports message delivery and read events.
• From service providers when they confirm email delivery, document status, payment status, advertising attribution, or other requested business operations.
• From referral partners or contractors who introduce a prospective project, subject to the information and permissions available to them.
• Automatically from your browser through local storage, URL campaign parameters, the configured Google Ads tag, and normal infrastructure or security logs.

• Respond to inquiries and recommend a coating or concrete-flooring direction.
• Prepare, deliver, and administer consultations, estimates, proposals, contracts, deposits, projects, change orders, warranties, and customer support.
• Communicate by phone, text, email, Messenger, or Instagram about an inquiry or active customer relationship, consistent with the permission or context you provided.
• Send marketing communications when you opt in or when otherwise permitted, and honor unsubscribe or consent-revocation requests.
• Maintain our CRM and communication history so our team can follow up consistently and avoid duplicate or conflicting messages.
• Measure website, advertising, form, and call performance; attribute inquiries; and improve our services and marketing.
• Protect the website and CRM, detect spam or abuse, troubleshoot, keep audit records, and enforce our agreements.
• Meet legal, tax, accounting, insurance, safety, and dispute-resolution obligations.

We disclose information only as reasonably needed for the purposes above. Depending on the feature you use, recipients may include:

• Supabase and Lovable for application infrastructure, database, private file storage, authentication, and server functions.
• Resend for outbound and inbound business email, delivery events, and supported email attachments.
• Meta for Messenger, Instagram, Lead Ads, message delivery, and—only when an authorized team member requests a draft—the Meta Model API used for an AI-assisted response draft.
• Stripe for hosted payment checkout, payment processing, fraud prevention, and payment-status events.
• Google for Google Ads tags, conversion measurement, and advertising attribution when those features are configured.
• DocuSign if we send a contract for electronic review and signature through DocuSign.
• Professional advisers, insurers, subcontractors, or project partners when reasonably necessary for a project, dispute, compliance obligation, or business operation.
• Courts, regulators, law enforcement, or other parties when required by law or reasonably necessary to protect rights, safety, and the integrity of our services.
• A successor or transaction adviser in connection with a proposed or completed merger, financing, sale, or transfer of all or part of the business, subject to appropriate safeguards and applicable law.

Analytics or advertising disclosures may be treated as “sharing,” targeted advertising, or a similar regulated activity under some privacy laws even when no money is exchanged for personal information. Your rights depend on where you live and which laws apply.

When you contact Astro Epoxy through Messenger or Instagram, we may receive an account-scoped identifier, message content, attachments, conversation identifiers, timestamps, and delivery or read events from Meta. An inbound direct message initially remains a social prospect in our Message Center. We do not treat the act of messaging us as marketing consent. A Meta Lead Ad may provide the fields you submitted, along with form, campaign, ad-set, and ad identifiers.

An authorized Astro Epoxy administrator may request an AI-assisted reply draft. For that request, our system removes common direct identifiers and known contact details from a limited portion of the conversation before sending it to Meta's Muse model. The request is configured with model storage disabled. The resulting draft, summary, and classification are stored in our CRM for human review; the system does not automatically send the draft.

Our website stores first-party campaign attribution in browser local storage for up to 90 days so a later estimate request can be connected to the landing page, referral source, campaign, or ad click that led to it. You can clear this information through your browser settings.

On public pages, a configured Google Ads tag may record visits, completed lead forms, and phone-link clicks. Google may use cookies or similar technologies under its own policies. The site does not intentionally send the contact fields typed into Astro Epoxy's forms as part of these browser conversion events. Private CRM, proposal, and other restricted paths are excluded from this advertising tag by our application.

Browser controls, ad-platform settings, and device settings may let you limit cookies or advertising identifiers. Blocking these technologies may reduce measurement but should not prevent you from contacting Astro Epoxy by phone or email.

We keep information for as long as reasonably necessary for the purpose for which it was collected and for legitimate business, legal, tax, insurance, warranty, security, and dispute-resolution needs. The period therefore varies by record type and relationship.

• First-party browser attribution expires after up to 90 days unless refreshed.
• One-way identifiers used to rate-limit lead forms are designed to be removed after about 48 hours.
• The short-lived raw event ledger for Meta webhook processing is configured to expire after 30 days. Normalized messages, lead records, and related CRM history may be kept longer under the general retention criteria above.
• Contract, project, payment-status, and accounting records may need to be kept after a deletion request when law, fraud prevention, tax, warranty, claims, or an active dispute requires it.

Backup copies and service-provider records may take additional time to cycle out or may be retained independently where required by law or the provider's obligations.

You may:

• Decline the optional marketing checkbox on our forms or ask us to stop marketing communications. Service messages about an active request or project may still be sent.
• Clear first-party campaign attribution through your browser's storage controls.
• Request access, correction, deletion, or a copy of information, or object to certain processing, where applicable law provides that right.
• Withdraw contact permission for future communications. Withdrawal does not invalidate processing that occurred before the request.

Email info@astroepoxy.com or call 713-485-9889. We may need to verify your identity and clarify the records involved before acting. We may deny or limit a request where permitted or required by law and will explain the applicable reason.

For the specific steps to remove information received through Facebook, Messenger, Instagram, or Meta Lead Ads, see our Meta User Data Deletion Instructions.

We use administrative, technical, and organizational measures intended to protect information. Examples in our current application include restricted team access, role checks, signed webhook verification, private storage, bounded uploads, secret-managed provider credentials, and audit records for sensitive workflows.

No internet transmission, storage system, or security program can guarantee absolute security. Please do not send passwords, access tokens, full payment-card details, Social Security numbers, or other information that is not needed for your flooring project.

Our services are intended for property owners, businesses, contractors, and other adults. They are not directed to children under 13, and we do not knowingly seek personal information from children under 13. If you believe a child provided information to us, contact us so we can review and address it.

We may update this policy when our services, providers, or legal obligations change. The “Last updated” date identifies the current version. Material changes may also be communicated through the website or another appropriate channel.

Privacy questions and requests can be sent to Astro Epoxy at info@astroepoxy.com or 713-485-9889. Astro Epoxy serves Greater Houston and surrounding areas.