PRIVACY POLICY - KINGDOM SUN Effective Date: 09/07/2026 Last Updated: 09/18/2026 Kingdom Sun ("we," "us") operates kingdom-sun.com, kingdom-sun.app, and their subdomains, including the design configurator, the siting tool, the site planner, and the customer progress tracker. This policy explains what we collect, why, who we share it with, and the choices you have. ================================================================================ 1. INFORMATION YOU GIVE US ================================================================================ We only ask for information when you choose to send it. What we collect depends on what you use: DESIGN & CONSULTATION REQUEST (the configurator, on any of our pages) - Name, email, phone, street address, ZIP code - Your design: product, timber frame size, solar array size, stain color, siding, installation package, and the price quoted for it - Optional notes, and whether you asked to join our mailing list FACT SHEET DOWNLOAD - Your phone number. Nothing else — no name, no email. SUNSHED PREORDER RESERVATION - Name, email, phone, ZIP code, town - Stain color, installation package, and the price quoted - Optional notes - No payment information is collected on this site. The refundable deposit is invoiced to you separately. CONTACT FORM - Name, email, and your message MAILING LIST SIGNUP - Email address SITING TOOL - Name, email, phone, optional notes - The property address you enter, and the placement you draw on the satellite map: coordinates, orientation, and dimensions of the proposed structure SITE PLANNER (beta) - Nothing. The planner runs entirely in your browser and sends us no data. PROGRESS TRACKER - If you are a customer, we maintain a project record: your name, email, phone, install address, the configuration you ordered, project milestones and dates, budget and payment status, internal notes, and files our team uploads to the project (site photos, permits, utility and zoning paperwork, contracts). - You reach your own project with your tracker ID plus the last four digits of the phone number on file. That is a light verification step, not an account with a password. IN-PERSON KIOSK - At the tablet kiosk we host at partner locations: your email, which structure interests you, whether you want mailing list updates, and an optional note. ================================================================================ 2. INFORMATION WE COLLECT AUTOMATICALLY ================================================================================ IDENTIFIERS - Visitor ID (cookie, 180 days) — a random identifier that lets us recognize a returning browser across visits. It is not tied to your name unless you submit a form. Where consent is required, it is set only after you consent (see Section 5). - Session ID (cookie, expires after 30 minutes of inactivity) — groups the pages you view in a single visit. USAGE DATA - Pages viewed, which page you arrived on, how far you scroll, how long a page is visible, which sections you reach, and when you leave - Clicks on calls to action, FAQ items, phone and email links, and directions - Video plays, progress, and completions - Configurator activity: product switches, frame and solar selections, stain, installation package, view and season toggles, ZIP codes entered, information panels opened - Form activity: opening a form, completing fields, and submitting TECHNICAL DATA - IP address, browser and device type, referring website, and which of our pages or embeds you were on LOCATION - Approximate city, state, and country, derived from your IP address by our hosting provider, and the region implied by any ZIP code you enter. We do not collect GPS or precise device location. MARKETING ATTRIBUTION - UTM parameters (source, medium, campaign, term, content), the advertising click identifier in the link you arrived on (for example gclid, msclkid, fbclid), the external website that referred you, and the page you landed on. We record these once per visit. FRAUD AND ABUSE SIGNALS - To keep fake submissions out of our sales queue, we assess each form submission and each recorded event: we compare the IP address against ranges known to belong to data centers and against the Tor Project's publicly published list of exit nodes (which we download — your address is not sent to them), check a hidden field that only automated scripts fill in, and look at how quickly the form was completed. Submissions that fail a hard check are discarded. Others are stored with a flag so a mistake can be reviewed and reversed by a person. THIRD-PARTY ANALYTICS AND ADVERTISING - Google Analytics 4, loaded through Google Tag Manager, collects behavioral data and may set cookies (_ga, _gid). - Google Ads conversion tracking may set a cookie (_gcl_au) to measure whether an ad led to an inquiry. - These are subject to your consent preferences where the law requires it, and we send Google consent signals accordingly (Consent Mode v2). ================================================================================ 3. HOW WE USE YOUR INFORMATION ================================================================================ - Answer your inquiry, prepare a design, and quote your project - Communicate with you about your project, and keep your progress tracker current if you become a customer - Estimate solar production and electricity savings for your location - Send mailing list updates, if you asked for them - Understand which pages and tools work, and improve them - Measure which marketing channels bring us real inquiries - Detect and block fraudulent or automated submissions - Plan where to expand our service area - Meet legal, tax, and contractual obligations WE DO NOT SELL YOUR PERSONAL INFORMATION, and we do not share it with third parties for their own marketing. LEGAL BASES (EU/EEA/UK visitors). We rely on: your consent for analytics and advertising cookies and for mailing list email; performance of a contract, or steps taken at your request before entering one, to handle inquiries, quotes, and projects; our legitimate interests in securing the site, preventing fraud, and understanding aggregate site usage; and legal obligation where a law requires us to retain records. You may withdraw consent at any time. ================================================================================ 4. HOW WE SHARE YOUR INFORMATION ================================================================================ SERVICE PROVIDERS. They process data on our instructions, for us: - Supabase — database and file storage for leads, submissions, project records, and analytics events - Vercel — website hosting, and the approximate IP-based location above - Resend — sends our email notifications and templated customer emails - Google Workspace / Gmail — our email; notifications of new inquiries are delivered there, and it's where we write back to you - Google (Tag Manager, Analytics 4, Ads) — analytics and advertising measurement - Google Maps Platform — satellite imagery and address search in the siting tool. Your use of that map is also subject to Google's privacy policy. - Webflow — hosts the content of parts of kingdom-sun.com, and its Optimize product (Intellimize) personalizes and A/B-tests those pages, which involves recording how you use them and setting its own cookies DATA WE SEND FOR CALCULATIONS ONLY (no contact information is included): - Zippopotam.us — turns a ZIP code into a town, state, and coordinates - NREL PVWatts (U.S. Department of Energy) — solar production estimate for those coordinates - U.S. Energy Information Administration — average electricity price for your state, used in savings estimates LEGAL AND SAFETY. We may disclose information if required by law or legal process, or where necessary to protect our rights, prevent fraud, or protect the safety of any person. BUSINESS TRANSFER. If Kingdom Sun is sold or merged, customer and inquiry records may transfer with the business. ================================================================================ 5. COOKIES & SIMILAR TECHNOLOGIES ================================================================================ ESSENTIAL (always active) - ks_consent — remembers your cookie choices (365 days) - ks_geo_region — records which privacy rules apply to your visit (24 hours) - ks_session_id — groups the pages of one visit (30 minutes of inactivity) - ks_tracker_session — keeps you signed in to your progress tracker (60 days; set only after you sign in) ANALYTICS (consent required in the EU/EEA/UK; on by default elsewhere) - ks_visitor_id — recognizes a returning browser (180 days) - _ga, _gid — Google Analytics (up to 2 years / 24 hours) ADVERTISING (consent required in the EU/EEA/UK; on by default elsewhere) - _gcl_au — Google Ads conversion measurement (90 days) BROWSER STORAGE (not cookies; cleared when you close the tab or the browser) - Your configurator progress and form entries, this visit's marketing attribution, and, if cookies are unavailable, a temporary per-tab identifier CONSENT BY LOCATION - EU/EEA/UK: analytics and advertising cookies are set only after you opt in. Until then, no visitor ID cookie is created. - California: analytics and advertising cookies are active by default and you may opt out at any time. - Everywhere else: cookies are active by default. MANAGING YOUR CHOICES. Use the "Cookie Settings" link in our site footer to change your preferences at any time, or email us at kingdomsunVT@gmail.com and we will apply your choice. You can also block or delete cookies in your browser settings, or browse in a private window. We do not currently respond to browser "Do Not Track" or Global Privacy Control signals. ================================================================================ 6. DATA RETENTION ================================================================================ - Inquiries, quotes, and design requests: kept for as long as we may reasonably do business with you, and thereafter as needed for our records. - Customer project records, contracts, and financial records: kept for the life of the project and at least seven years afterward, for warranty, tax, and legal reasons. - Analytics events, including IP addresses: kept for up to 26 months, then deleted. - Mailing list: until you unsubscribe. - Submissions identified as automated or fraudulent: kept up to 12 months so we can audit and correct our filters, then deleted. You may request deletion at any time (Section 8). We will honor it except where we are required to keep a record. ================================================================================ 7. SECURITY ================================================================================ We use HTTPS encryption in transit, database row-level security policies, server-side API keys that are never exposed to your browser, signed short-lived links for project files, and signed session cookies for tracker access. Access to customer records is limited to Kingdom Sun staff who need it. No system is completely secure, and we cannot guarantee absolute security. ================================================================================ 8. YOUR RIGHTS ================================================================================ Wherever you live, you may ask us to: - Tell you what personal information we hold about you - Correct anything inaccurate - Delete your information - Send you a copy in a portable format - Stop sending you marketing email - Change or withdraw your cookie consent Email kingdomsunVT@gmail.com and we will respond within 30 days. We may need to verify your identity before acting on a request — usually by confirming details we already hold, such as the email address or phone number on your inquiry. EU/EEA/UK RESIDENTS (GDPR/UK GDPR). You additionally have the right to restrict or object to processing, the right to withdraw consent at any time (which does not affect processing carried out before withdrawal), and the right to lodge a complaint with your national data protection authority. Kingdom Sun is the data controller. CALIFORNIA RESIDENTS (CCPA/CPRA). You have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to limit the use of sensitive personal information (we do not collect any); to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights. We do not sell personal information. To opt out of cross-context behavioral advertising, use "Do Not Sell or Share My Info" in the cookie banner or "Cookie Settings" in the footer. You may use an authorized agent to submit a request on your behalf. In the past 12 months we have collected the categories of information described in Sections 1 and 2 (identifiers, commercial information, internet activity, and approximate geolocation), for the purposes in Section 3, and disclosed them for a business purpose to the service providers in Section 4. ================================================================================ 9. ADDITIONAL INFORMATION ================================================================================ INTERNATIONAL VISITORS. Kingdom Sun is based in Vermont, USA, and our service providers store data in the United States. If you use our site from outside the United States, your information is transferred here. Where required for EU/EEA/UK transfers, we rely on the European Commission's Standard Contractual Clauses through our providers. CHILDREN. Our services are not directed to anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it. THIRD-PARTY LINKS. Our site links to other websites. We are not responsible for their privacy practices. CHANGES. We may update this policy. We will change the "Last Updated" date above, and for material changes we will show a notice on the site. Continued use after a change means you accept the updated policy. ================================================================================ CONTACT ================================================================================ Kingdom Sun West Glover, VT Email: kingdomsunVT@gmail.com Phone: 802.472.1113 (6am - noon, M-F)