Privacy Policy | Solrova

Solrova ("Solrova," "we," "us," or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect when you use our solar savings calculator at solrova.com (the "Service"), how we use it, who we share it with, how long we keep it, and your rights as a consumer.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

Replace [COMPANY LEGAL NAME] with the registered entity name once the LLC or C-Corp is formed (Alex Rivera owns L5 — legal entity formation). This placeholder appears in Sections 1 and 12.

Contents

Information We Collect
How We Use Your Information
TCPA Consent & One-to-One Rule
Third-Party Sharing
Google API Services — Limited Use Disclosure
Data Retention
California Residents — CCPA/CPRA Rights
Other State Privacy Rights
Cookies & Tracking
Data Security
Children's Privacy
Changes to This Policy
Contact Us

1. Information We Collect

We collect the following categories of personal information when you use the Service:

Category	Specific Data	Source
Contact information	Full name, email address, phone number	You provide this on the lead form (Screen 5)
Home address & geolocation	Street address, city, state, ZIP code, latitude, longitude	Google Places API autocomplete; geocoding
Roof & property details	Roof material, roof age, electrical panel capacity, roof orientation/direction	You enter these; roof direction auto-detected via Google Solar API
Energy usage data	Monthly electricity bill ($), annual kWh consumption, 12-month bill-by-bill history, utility provider name, rate plan	Manual entry, Supabase utility lookup, or bill upload
Utility bill images	Uploaded PDF or photo of electricity bill	You upload these voluntarily; processed in-browser and permanently deleted within 24 hours
Solar proposal selections	System size (kW), system request preference, finance option selected, battery manufacturer/count, 25-year savings estimate	Generated based on your inputs and slider selections on Screen 4
Device & browser data	IP address, user agent string, browser type, session identifiers	Collected automatically at time of form submission (server-side)
TCPA consent records	Verbatim consent text shown, timestamp, consent method, page URL, consent version	Captured automatically when you submit the lead form

Sensitive Personal Information (CPRA): Under the California Privacy Rights Act (CPRA), the following data Solrova collects qualifies as sensitive personal information: (1) precise geolocation derived from your home address, (2) energy consumption data from your utility bills, and (3) financial information (monthly electricity costs). We collect these categories solely to generate your personalized solar savings estimate and to match you with a qualified installer. We do not use sensitive personal information for profiling, advertising, or any purpose beyond what is disclosed in this policy.

We do not collect Social Security numbers, government-issued IDs, financial account numbers, payment card data, or passwords through the Service.

2. How We Use Your Information

Generate your solar savings estimate: Your address, energy usage, roof details, and utility rate are processed using NREL PVWatts solar irradiance data, EIA state residential rate averages, and national median installed cost data to produce a personalized solar proposal.
Match you with a solar installer: When you submit the lead form and provide explicit TCPA consent, we share your contact information and proposal summary with one vetted, licensed solar installation partner in your area.
Maintain TCPA compliance: We create an append-only consent log recording the exact text you consented to, the timestamp, your IP address, session ID, and all metadata required by the FCC's one-to-one consent rule.
Improve the Service: We use aggregated, de-identified data to improve our estimation models, user experience, and conversion funnel. We use Plausible Analytics, a cookie-free, privacy-first analytics platform that collects no personal data.
Communicate with you: We may send you a copy of your proposal or follow up regarding your solar inquiry, within the scope of the consent you provided.

We do not sell your personal information. Solrova does not sell data to data brokers, lead aggregators, or advertising networks. The only sharing of personal information with third parties occurs when you explicitly consent to be connected with a specific solar installation partner.

3. TCPA Consent & One-to-One Rule

The FCC's January 27, 2025 update to the Telephone Consumer Protection Act (TCPA) requires that consent for telemarketing calls and texts be obtained on a one-to-one basis — each company that may contact you must be specifically identified at the point of consent.

Solrova complies with this rule. When you submit the lead form, the consent checkbox identifies Solrova and the specific solar partner matched to your area. Your consent applies only to those named entities.

For each lead submission, we capture and store the following TCPA compliance record:

Field	Description
Consent text	Verbatim text of the checkbox label at the moment of submission
Consent version	Version identifier (incremented whenever consent language changes)
Timestamp (client)	ISO 8601 timestamp from the user's browser
Timestamp (server)	Server receipt time (authoritative)
IP address	Captured server-side in Edge Function (not from client JavaScript)
User agent	Browser identification string
Page URL	Full URL of the page where consent was given
Session ID	Unique session identifier linking consent to the lead record
Consent method	Documented as "explicit_checkbox" — unchecked by default, requiring affirmative action

TCPA consent records are stored in an append-only database table. They cannot be modified or deleted, even by Solrova administrators. Records are retained for a minimum of 7 years from the date of consent, as required by FCC guidance and industry best practice.

You may revoke your consent at any time by replying STOP to any text message, calling us, or emailing [PRIVACY EMAIL]. Revocation applies to future contacts only and does not affect the legality of contacts made before revocation.

4. Third-Party Sharing

We share personal information only in the following circumstances:

Solar installation partners: Your name, email, phone, home address, and proposal summary are shared with one licensed solar installer matched to your area, only after you provide explicit TCPA consent via the lead form checkbox. The installer is identified at the time of consent.
Service providers: We use the following third-party services to operate the platform. These providers process data on our behalf under their respective privacy policies:
- Google Maps Platform — address autocomplete, geocoding, satellite imagery, Solar API
- NREL PVWatts API — solar production estimates based on location and system size
- Supabase — database hosting and serverless functions
- Plausible Analytics — cookie-free website analytics (no personal data collected)
Legal obligations: We may disclose information if required by law, subpoena, court order, or government regulation, or to protect our rights or the safety of others.

We do not share personal information with advertising networks, data brokers, or any other third parties for marketing purposes.

5. Google API Services — Limited Use Disclosure

Solrova's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google Maps Platform APIs (Places, Geocoding, Solar) solely to provide address autocomplete, geolocation, and solar potential data for your savings estimate.
We do not use data obtained from Google APIs for advertising, retargeting, or building user profiles unrelated to the Service.
We do not transfer Google API data to third parties except as necessary to provide the Service (e.g., including your verified address in a lead shared with an installer with your consent) or as required by law.
Human review of data obtained from Google APIs is limited to customer support, debugging, and legal compliance purposes.

6. Data Retention

Data Type	Retention Period	Reason
TCPA consent logs	7 years from date of consent	FCC regulatory requirement; append-only, immutable records
Lead records	3 years from submission	Business operations, installer performance tracking, dispute resolution
Uploaded utility bill images	24 hours maximum	Bills are processed in-browser; any server-side copies are permanently deleted within 24 hours. Account numbers are discarded immediately after parsing.
Analytics data (Plausible)	Per Plausible's retention policy	Aggregate, anonymous site usage metrics — no personal data

When a data retention period expires, records are permanently deleted or de-identified, except where a longer retention period is required by law.

7. California Residents — CCPA/CPRA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know: You may request that we disclose the categories and specific pieces of personal information we collected about you, the sources, the business purposes for collection, and the categories of third parties with whom we shared it.
Right to Delete: You may request deletion of your personal information. We will delete your lead record and associated data, with the following exception: TCPA consent logs are subject to a mandatory 7-year federal retention requirement and cannot be deleted. Upon a deletion request, we will redact personally identifying details from the TCPA log (e.g., remove name and phone) while retaining the core consent record through the mandatory retention period.
Right to Correct: You may request correction of inaccurate personal information we hold about you.
Right to Opt-Out of Sale/Sharing: Solrova does not sell personal information as defined by the CCPA. We share personal information with solar installers only with your explicit, affirmative consent. You may withdraw this consent at any time by contacting us.
Right to Limit Use of Sensitive Personal Information: You may direct us to limit the use of your sensitive personal information (precise geolocation, energy consumption data, financial information) to what is strictly necessary to provide the Service. To exercise this right, contact us at the email below.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

How to exercise your rights: Submit a verifiable request to [PRIVACY EMAIL]. We will acknowledge your request within 10 business days and respond substantively within 45 calendar days. If we need additional time, we will notify you of an extension (up to an additional 45 days).

Do Not Sell or Share My Personal Information
Solrova does not sell personal information to third parties. The only sharing occurs when you provide explicit consent to be connected with a solar installation partner. To opt out of any future sharing or to confirm our practices: [PRIVACY EMAIL]

Limit the Use of My Sensitive Personal Information
To request that Solrova limit the use of your sensitive personal information (precise geolocation, energy usage, financial data) to only what is necessary to provide the Service: [PRIVACY EMAIL]

CPRA requires that "Do Not Sell or Share" and "Limit Use of Sensitive PI" links be prominently displayed in the footer of solariq_v3.3.html — currently only a general "Privacy Policy" link exists. Maya Chen (Frontend) needs to add these two links to the prototype footer before launch.

8. Other State Privacy Rights

Residents of states with consumer privacy laws — including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and others — may have similar rights to access, delete, correct, and opt out of certain data processing activities. To exercise your rights under any applicable state privacy law, contact us at [PRIVACY EMAIL].

9. Cookies & Tracking

Solrova does not use tracking cookies, advertising pixels, retargeting tags, or third-party marketing trackers of any kind.

We use Plausible Analytics, a privacy-first, cookie-free analytics platform. Plausible does not use cookies, does not track users across websites, and does not collect any personally identifiable information. No cookie consent banner is required because we deploy no tracking cookies.

We may use strictly necessary session-based mechanisms (such as browser sessionStorage) to maintain form state during your visit. These do not persist after you close your browser and are not used for tracking.

10. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information:

All data is encrypted in transit using HTTPS/TLS
Row-level security (RLS) policies restrict database access at the application layer
TCPA consent logs are stored in append-only tables with database triggers that prevent any modification or deletion
API keys are restricted by HTTP referrer and proxied through serverless Edge Functions (not exposed in client-side code)
Utility bill images are processed client-side (in-browser) and permanently deleted within 24 hours; account numbers are discarded immediately
IP addresses are captured server-side only (never via client-side JavaScript)

No method of electronic transmission or storage is 100% secure. If you have reason to believe your interaction with us is no longer secure, contact us immediately at [PRIVACY EMAIL].

11. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page indicates when the policy was most recently revised. We encourage you to review this page periodically. Material changes will be highlighted on the Service for 30 days following the update. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Solrova
Las Vegas, Nevada
Email: privacy@solrova.com

We will respond to all privacy inquiries within 45 calendar days.

The following placeholders must be replaced before this page goes live: (1) [COMPANY LEGAL NAME] — registered LLC or C-Corp name; (2) [REGISTERED ADDRESS] — company's physical or registered agent address; (3) [PRIVACY EMAIL] — e.g., privacy@solrova.com. These require the legal entity to be formed first (L5).