Privacy Policy

1. Who We Are

This website, sprocketrepair.com, is operated by TANNU LLC, a New York limited liability company doing business as Sprocket Appliance Repair(“Sprocket,” “we,” “us,” “our”). We provide residential appliance repair services in Brooklyn, Queens, and Manhattan, NY.

Contact us: hello@sprocketrepair.com  |  (347) 572-7158

For privacy requests specifically, email hello@sprocketrepair.com with the subject line “Privacy Request.”

2. Information We Collect

We collect the following categories of personal information through our booking form and website:

A. Information you provide directly

• Full name — to address you and schedule the repair.
• Phone number (US mobile or landline) — to confirm your appointment by call and SMS, and to send our AI voice agent to collect additional details (see Section 5).
• Email address (optional) — to send a booking receipt.
• Service address and ZIP code — to dispatch a technician to your location.
• Appliance type and symptom description — to diagnose the problem before arrival.
• Photos (optional upload) — to assist in pre-visit diagnosis; stored on our secure servers.

B. Information collected automatically

• IP address — collected server-side for rate-limiting and fraud prevention via Upstash Redis; not linked to your booking record.
• Cloudflare Turnstile token— a cryptographic proof of human interaction generated client-side by Cloudflare's bot-detection service; we do not store the token after validation.
• Page views, referrer URLs, UTM parameters, and device/browser type — collected by Google Analytics 4 (GA4) only if you accept analytics cookies via our consent banner. GA4 is not activated before your consent.
• Address autocomplete queries— partial address strings you type are sent to Google Places API for autocomplete suggestions; these are governed by Google's privacy policy.

C. Sensitive personal information

Your precise service address constitutes geolocation data. We use this information solely to dispatch a technician; we do not use it for behavioral advertising or sell it to data brokers.

3. How We Use Your Information

• Booking confirmation and scheduling — we call or text the phone number you provide to confirm your appointment within approximately 15 minutes of form submission.
• Technician dispatch — your name and address are shared internally to route a technician.
• Job completion records — after the repair is complete, your record is retained for warranty follow-up and accounting purposes.
• Site analytics (consent-gated) — if you opt in, GA4 helps us understand which pages are useful.
• Fraud and abuse prevention — IP addresses and Turnstile tokens are used to block automated spam submissions.

We do not use your personal information for targeted advertising, do not sell or rent it to third parties, and do not share it for any purpose other than those listed here and in Section 4.

4. Third-Party Service Providers

We engage the following service providers who may receive or process your personal information solely on our behalf and under our instructions:

Each provider is contractually prohibited from using your data for their own purposes beyond the service rendered. You may review their individual privacy policies: Google, Twilio, Vapi, Telegram, Cloudflare, Upstash, Vercel.

5. Calls, SMS, and AI Voice Agent — TCPA Consent and A2P Disclosures

AI Voice Agent Disclosure

The outbound call you receive after submitting the form is made by an automated AI voice system (powered by Vapi AI), not a live human representative. The AI agent will identify itself at the start of the call. Calls may be recorded for quality assurance. If you do not wish to speak with the AI agent, you may hang up at any time and call or email us directly; your service request will still be processed.

A2P 10DLC SMS Program Disclosures

Program name: Sprocket Appliance Repair — Service Notifications
Sender: TANNU LLC d/b/a Sprocket Appliance Repair, via Twilio 10-digit long code (10DLC)
Message frequency:Typically 1–3 messages per service request (booking confirmation, technician ETA, post-service follow-up). Message frequency may vary.
Message and data rates may apply. Standard carrier rates for text messages apply based on your plan.

Sample message:“Hi [Name], this is Sprocket Appliance Repair. Your repair request for [appliance] has been received. A technician will contact you shortly. Reply STOP to opt out.”

To opt out of SMS: Reply STOP to any text message from us at any time. You will receive one final confirmation message and no further texts.
For help: Reply HELP to any message or contact us at hello@sprocketrepair.com / (347) 572-7158.

Opting out of SMS does not affect your ability to request repair services. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

6. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary cookies — required for the site to function (Cloudflare Turnstile bot-protection token, vanilla-cookieconsent preference cookie). These are placed without consent.
• Analytics cookies (opt-in)— Google Analytics 4 (GA4) fires only after you click “Accept” on our consent banner. GA4 uses cookies _ga, _ga_*, and _gid. You may withdraw consent at any time via the consent banner or the opt-out link below.
• Global Privacy Control (GPC) — if your browser transmits a Sec-GPC: 1 header (Brave, Firefox with privacy settings, DuckDuckGo), we treat this as a consent withdrawal and do not activate GA4, consistent with California AG guidance.

To manage or withdraw cookie consent at any time, visit our opt-out page.

7. Data Retention

• Booking leads (no repair completed): 24 months from the date of submission, after which records are deleted or anonymized.
• Completed-job records (invoices, service logs): 7 years from the date of service, as required by New York State tax law (N.Y. Tax Law § 1135 and applicable recordkeeping regulations) and for warranty administration.
• Rate-limit IP hashes (Upstash): 1 hour TTL, auto-purged.
• Server/edge logs (Vercel):30 days per Vercel's platform policy.
• Analytics data (GA4, consent-gated): 14 months (GA4 default retention setting).
• AI voice call recordings (Vapi): retained for up to 90 days for quality review, then deleted.

After applicable retention periods expire, records are securely deleted or irreversibly anonymized.

8. Data Security

We maintain reasonable technical and administrative safeguards consistent with the New York SHIELD Act (N.Y. Gen. Bus. Law § 899-bb) and industry standards, including:

• TLS encryption in transit for all form submissions and API calls.
• Server-side rate-limiting and Cloudflare Turnstile bot-protection on the booking form.
• Access to lead data restricted to the business owner and authorized service providers under confidentiality obligations.
• Masked logging — server logs record only partial phone (last 4 digits) and name initial; full PII is stored only in encrypted systems (Google Sheets, Vapi dashboard).
• Periodic review of access permissions and service provider security practices.

Security breach notification: In the event of a breach of private information affecting New York residents, we will notify affected individuals and, where required, the New York Attorney General, the Department of State, and/or the Division of State Police in the most expedient time possible, consistent with the SHIELD Act.

No system is completely secure. If you believe your data has been compromised, contact us immediately at hello@sprocketrepair.com.

9. Your Rights and Choices

Regardless of your location, you may exercise the following rights by emailing hello@sprocketrepair.com with the subject line “Privacy Request”:

• Right to Access / Know — request a copy of the personal information we hold about you.
• Right to Delete — request deletion of your personal information, subject to legal retention obligations.
• Right to Correct — request correction of inaccurate personal information.
• Right to Data Portability — receive your data in a structured, machine-readable format where technically feasible.
• Opt out of SMS — reply STOP to any SMS from us.
• Opt out of AI calls — email or call us; we will place you on our internal do-not-call list.
• Withdraw cookie consent — via our opt-out page or cookie banner.

We will respond to verified requests within 45 days (or sooner where required). We will not discriminate against you for exercising any of these rights.

10. California Residents — CCPA / CPRA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights.

Categories of personal information collected

In the past 12 months we have collected the following categories as defined by the CCPA:

• Identifiers (name, phone number, IP address)
• Customer records information (address, service history)
• Geolocation data (service address — precise location)
• Internet or network activity (page views, referrers, GA4 events — consent-gated)
• Audio / electronic data (AI voice call recordings, if applicable)

Business or commercial purpose for collection

All categories above are collected for the purpose of providing appliance repair services, scheduling, communication, and fraud prevention. We do not sell or share personal information for cross-context behavioral advertising. We do not use sensitive personal information for purposes beyond service delivery.

Your specific California rights

• Right to Know — categories and specific pieces of personal information collected, used, disclosed, or sold.
• Right to Delete — subject to certain exceptions (e.g., legal obligations, fraud prevention).
• Right to Correct — inaccurate personal information.
• Right to Opt Out of Sale or Sharing— we do not sell personal information; however, if GA4 analytics constitute “sharing” under CPRA, you may opt out via the link below.
• Right to Limit Use of Sensitive Personal Information — you may limit our use of your precise geolocation (service address) to purposes strictly necessary to provide the requested service.
• Shine the Light (Cal. Civ. Code § 1798.83) — we do not disclose personal information to third parties for their own direct marketing purposes.
• Non-discrimination — exercising any CCPA right will not result in denial of service or different pricing.

To exercise California rights, email hello@sprocketrepair.com (subject: “CCPA Request”) or submit via our opt-out page. We respond within 45 days and may extend by an additional 45 days with notice.

GPC signal: A browser-level Sec-GPC: 1 header is treated as an opt-out request per California Attorney General guidance.

11. EU and UK Visitors — GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and/or UK GDPR applies to our processing of your personal data.

Legal basis for processing

• Contract performance (Art. 6(1)(b) GDPR) — processing your booking data to schedule and perform the repair service you requested.
• Legitimate interests (Art. 6(1)(f) GDPR) — fraud prevention, rate-limiting, and security (IP hashing, Turnstile).
• Consent (Art. 6(1)(a) GDPR) — analytics cookies (GA4); you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

International data transfers

TANNU LLC is based in the United States. All third-party service providers listed in Section 4 are US-based entities. Transfers of personal data from the EEA/UK to the US are made under one or more of the following safeguards:

• EU Standard Contractual Clauses (SCCs) incorporated into data processing agreements with each provider, where available.
• Participation in the EU-US Data Privacy Framework (DPF) by the relevant provider (Google LLC, Cloudflare Inc., and others are certified participants).

Your GDPR rights

You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), and to lodge a complaint with your local supervisory authority (e.g., your national data protection authority or, for UK residents, the ICO at ico.org.uk).

To exercise GDPR rights, contact us at hello@sprocketrepair.com (subject: “GDPR Request”). We respond within 30 days.

We do not have a formal EU representative under Art. 27 GDPR, as our processing of EU residents' data is occasional and not systematic. We are not required to appoint a Data Protection Officer.

12. Children's Privacy

Our services are directed to adults and are not directed to children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe we have inadvertently collected data from a minor, please contact us at hello@sprocketrepair.com and we will promptly delete it. Under the Children's Online Privacy Protection Act (COPPA), if we discover we have collected information from a child under 13 without verifiable parental consent, we will delete it immediately.

13. Governing Law and Dispute Resolution

This Privacy Policy and any disputes arising from it are governed by the laws of the State of New York, without regard to its conflict-of-law provisions. Any dispute that cannot be resolved informally will be submitted to the exclusive jurisdiction of the state or federal courts located in Kings County, New York.

To raise a privacy concern, please first contact us at hello@sprocketrepair.com. We are committed to resolving complaints promptly and in good faith. You also retain the right to file a complaint with the New York Attorney General's Consumer Frauds Bureau or the FTC at reportfraud.ftc.gov.

14. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be communicated by a notice on our home page for at least 30 days before taking effect, or by direct notification to affected users where required by law. Your continued use of our services after the effective date of a revised policy constitutes your acceptance of the changes.

15. Contact Us

For privacy requests, questions, or concerns:

TANNU LLC d/b/a Sprocket Appliance Repair
Service Area Business — Brooklyn, NY
Email: hello@sprocketrepair.com
Phone: (347) 572-7158

Please include “Privacy Request” in your subject line for fastest routing. We will respond within 45 days for CCPA requests and 30 days for GDPR requests.