Does Omaha Heating and Air sell customer data?

No. We do not sell personal information to advertisers, data brokers, or any third party. Data shared with manufacturers, utilities, payment processors, and financing partners is shared only as needed to complete the service you've requested, and only with the specific recipient required for that purpose.

What happens to my information if I cancel service before any work is done?

If you cancel before any service is performed, you can request deletion of your inquiry data. We will delete the inquiry record after 90 days (the retention period needed for fraud-prevention purposes and for follow-up if you re-engage). Inquiries that result in completed service follow the longer retention schedule above.

Who sees my home access codes if I provide them?

Only the dispatched technician for the specific appointment, plus office dispatch staff (Diana Holcomb and a small admin team). Access codes are stored encrypted in the dispatch system, are only displayed to the assigned technician on the day of service, and access is logged. Codes can be deleted at your request any time.

Can I opt out of marketing emails but still receive service-related communications?

Yes. Marketing emails (seasonal specials, rebate window notifications, financing promotion announcements) and service communications (appointment confirmations, technician dispatch notifications, follow-up satisfaction emails) are managed separately. Unsubscribing from marketing through any email's footer link will not stop service-related messages.

How do I exercise my rights under the Nebraska Data Privacy Act or Iowa Consumer Data Protection Act?

Email privacy@omahaheatingairconditioning.xyz with the subject line 'Privacy Rights Request' and include your name, service address, and a description of which right you wish to exercise. We will acknowledge the request within 10 business days and respond substantively within 45 days (with a 45-day extension available if the request is complex). Verification of identity is required before we release or delete records to prevent fraudulent requests.

Privacy Policy — Omaha Heating and Air Conditioning

Last updated: May 22, 2026. Effective date: September 15, 2025. This policy is compliant with the Nebraska Data Privacy Act (effective January 1, 2025), the Iowa Consumer Data Protection Act (effective January 1, 2025), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (CCPA/CPRA), and the EU General Data Protection Regulation (GDPR) for any EU residents who interact with us. Where multiple frameworks apply, we apply the most protective standard.

Who We Are

Omaha Heating and Air Conditioning is a licensed HVAC contractor founded by Bret Jones in 2014, operating from the Lake Regency Building at 450 Regency Pkwy #370, Omaha, NE 68114. Mechanical contractor licensing through the City of Omaha Permits & Inspections Division (#MC-2014-08847) and the Iowa Plumbing & Mechanical Systems Board (#B-027841). For questions specifically about this privacy policy, the controller of record is Bret Jones, reachable at privacy@omahaheatingairconditioning.xyz or by mail at the office address above.

Information We Collect

Information You Provide Directly

Identity and contact data — name, service address, billing address, telephone number, email address. Collected at the point of service request or quote inquiry.
HVAC equipment data — equipment make, model number, serial number, AHRI certificate reference, refrigerant type and charge, age of equipment, prior service history. Collected to provide accurate diagnosis, warranty registration, and rebate processing.
Home access information — gate codes, lockbox codes, garage door codes, key location notes, alarm system disarm codes (only when you explicitly choose to share these for unattended service visits). This data is stored encrypted in our dispatch system and access is logged.
Utility account information — OPPD, MUD, MidAmerican Energy account numbers and meter numbers when needed for rebate processing. Provided voluntarily by customers pursuing utility rebate paperwork.
Payment information — credit card details are entered through Stripe’s secure payment form and are not stored on our systems. ACH bank routing information for direct payment is encrypted and stored only as long as needed for the transaction. Personal check images are retained for accounting and tax purposes per IRS recordkeeping requirements.
Employment-related data — if you apply for a position with Omaha Heating and Air, we collect resume content, references, background check authorization, drug screening consent, and motor vehicle record consent.

Information Collected Automatically

Website analytics — Google Analytics 4 (GA4) collects page views, session duration, referring URL, device type, browser, approximate geolocation derived from IP address, and event-level interactions. IP addresses are processed under GA4’s IP anonymization. We use the analytics data to understand which content visitors find useful and where the site fails them.
Session recording and heatmaps — Microsoft Clarity is used to record anonymized session interactions (clicks, scrolls, mouse movements) on this site. Form-field content is masked by default; we do not capture text typed into form fields.
Conversion tracking — Meta Pixel (Facebook), Google Ads conversion tags, and Microsoft Advertising UET tags are deployed for advertising attribution and remarketing. These collect device identifiers, page URL, and event timestamps when visitors arrive from paid advertising or social media campaigns.
Cookies — first-party cookies for session state, language preference, and consent storage; third-party cookies from the analytics and advertising platforms above. A consent banner manages cookie preferences per the most protective applicable framework.

How We Use Your Information

Service delivery — scheduling, dispatching technicians, performing diagnosis and repair work, ordering parts, providing written estimates, executing installations, conducting follow-up service.
Permit submission — we submit permit applications to the City of Omaha Permits & Inspections Division, the City of Bellevue Building Department, La Vista, Ralston, the Council Bluffs Building Department, the Carter Lake building authority, and Pottawattamie County. Permit applications include the customer’s name, service address, equipment specifications, and our contractor license number. These submissions become public records under Nebraska and Iowa open-records law.
Warranty registration — equipment installations are registered with the manufacturer (Carrier, Trane, Lennox, Rheem, Bryant, Goodman, Mitsubishi Electric, Daikin, Bosch, and others) using the customer’s name, address, equipment model and serial number, and install date. Registration is required to activate the extended manufacturer warranty.
Rebate processing — with your consent, we submit rebate paperwork to OPPD, MUD, MidAmerican Energy, or other applicable utility programs, including your account number, equipment AHRI certificate reference, install photographs, and the permit number. Rebate paperwork triggers utility disbursement to you 4–8 weeks after submission.
Tax credit documentation — we provide the manufacturer certification statement and AHRI Certified Reference Number needed for Section 25C and Section 25D federal tax credits. This documentation is shared only with you (the customer) and is not transmitted to the IRS by us — the customer claims the credit on Form 5695 with their own tax return.
Communication — appointment reminders, service follow-up, warranty registration confirmations, seasonal maintenance reminders, and (with separate explicit opt-in) marketing communications about service specials, financing promotions, and rebate windows.
Business operations — accounting, tax compliance, payroll, insurance underwriting, regulatory reporting, dispute resolution, and fraud prevention.

Who We Share Information With

We do not sell personal information. We share data only with the categories of third parties listed below, and only to the extent necessary for the purposes described:

Equipment manufacturers — for warranty registration and warranty claim processing.
Municipal building departments — for permit submission and closeout inspection. Once submitted, permit data becomes public record under applicable Nebraska and Iowa open-records statutes.
Utility companies — OPPD, MUD, MidAmerican Energy, only with your consent and only for rebate processing tied to the specific equipment you purchased.
Payment processors — Stripe handles credit card processing. We do not store full card numbers; the processor retains card data per PCI-DSS standards.
Financing partners — Wells Fargo, Synchrony Financial, Service Finance Company, Optimus Financing, GoodLeap, or other lenders you specifically apply to. We facilitate the application process; the lender becomes a separate data controller for any data you provide them.
Dispatch software and CRM provider — our service-management software vendor stores customer records, service history, photographs, and dispatch data under a data processing agreement.
Insurance carriers — The Hartford (general liability) and EMC Insurance (workers’ compensation) for claim handling if an incident occurs on customer property.
Professional advisors — CPA, attorney, and similar professional service providers under confidentiality obligations.
Government authorities — when legally compelled by valid subpoena, court order, or applicable regulation, or when required to report worker injuries (OSHA), refrigerant releases (EPA Section 608), or similar regulatory triggers.

Your Rights Under the Nebraska Data Privacy Act

If you are a Nebraska resident, the Nebraska Data Privacy Act (effective January 1, 2025) gives you the following rights, exercisable by contacting us at privacy@omahaheatingairconditioning.xyz:

Right to confirm processing and access your data. You may ask whether we are processing your personal data and obtain a copy of that data.
Right to correct inaccuracies. If our records are wrong, you may request correction.
Right to delete. Subject to legal retention requirements, you may request deletion of personal data we hold.
Right to data portability. You may obtain a copy of your data in a portable, readily usable format.
Right to opt out of targeted advertising, sale of personal data, and certain profiling. We do not sell personal data; opt-out for targeted advertising controls the use of Meta Pixel and similar trackers on this site.
Right to appeal. If we deny a request, you may appeal the denial. Appeals must be acknowledged within 60 days. If your appeal is denied, you may contact the Nebraska Attorney General’s office.

Your Rights Under the Iowa Consumer Data Protection Act

If you are an Iowa resident (including Council Bluffs and Carter Lake customers), the Iowa Consumer Data Protection Act (effective January 1, 2025) gives you parallel rights: access, correction, deletion, portability, and opt-out of certain processing. Iowa’s framework differs from Nebraska’s in the threshold for entities covered and the response timeline. We honor Iowa rights requests under the same workflow as Nebraska requests.

Your Rights Under California Privacy Law (CCPA/CPRA)

California residents have the right to know what personal information we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell or share for cross-context behavioral advertising), the right to limit use of sensitive personal information, and the right to non-discrimination for exercising these rights. Submit California requests to privacy@omahaheatingairconditioning.xyz.

Your Rights Under GDPR

For EU residents: rights of access, rectification, erasure, restriction, portability, and objection apply. The lawful bases we rely on are contract performance (delivering HVAC service you requested), legal obligation (permits, tax, regulatory reporting), legitimate interest (fraud prevention, business operations), and consent (marketing communications). EU residents may lodge complaints with their supervisory authority.

Data Retention

We retain personal data only as long as needed for the purposes described, or as required by applicable law:

Service records and project files — 10 years from project completion. This duration covers the manufacturer extended warranty period (typically 10 years on registered residential equipment) plus a buffer for warranty-claim disputes.
Permit documentation — retained indefinitely; permit data becomes a permanent public record once filed with the municipal authority.
Financial records — 7 years from transaction date per IRS recordkeeping requirements.
Marketing consent records — for the duration of consent plus 3 years after withdrawal.
Background check and drug screening records (employment) — 5 years from completion per applicable federal and state employment recordkeeping requirements.
Website analytics — GA4 default retention of 14 months for event data; Microsoft Clarity default retention applies separately.

Data Security

We implement administrative, technical, and physical safeguards reasonable for a small business handling residential and light-commercial service records. These include: TLS encryption on the website and all customer-facing portals; encrypted data storage for dispatch and CRM records; role-based access controls limiting which employees can view which records; multi-factor authentication on administrator accounts; physical access controls at the office; and incident response procedures including breach notification per applicable state law (Nebraska Revised Statute 87-801 et seq. and Iowa Code 715C.2). No data security program is perfect, and we do not represent ours as such.

Children’s Privacy

Our services are not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us at privacy@omahaheatingairconditioning.xyz and we will delete the data and any related account.

Do Not Track

Most browsers offer a Do Not Track signal. Industry consensus on how to honor this signal has not formed and we currently do not respond to it. We honor the Global Privacy Control (GPC) signal as an opt-out request under CCPA/CPRA for California residents.

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, our service offerings, or applicable law. The “Last updated” date at the top of this policy will change when a revision is made. Material changes that materially expand the categories of data we collect or share will be communicated through the site’s consent banner or by email to active customers.

Frequently Asked Questions

Does Omaha Heating and Air sell customer data?: No. We do not sell personal information to advertisers, data brokers, or any third party. Data shared with manufacturers, utilities, payment processors, and financing partners is shared only as needed to complete the service you’ve requested, and only with the specific recipient required for that purpose.
What happens to my information if I cancel service before any work is done?: If you cancel before any service is performed, you can request deletion of your inquiry data. We will delete the inquiry record after 90 days (the retention period needed for fraud-prevention purposes and for follow-up if you re-engage). Inquiries that result in completed service follow the longer retention schedule above.
Who sees my home access codes if I provide them?: Only the dispatched technician for the specific appointment, plus office dispatch staff (Diana Holcomb and a small admin team). Access codes are stored encrypted in the dispatch system, are only displayed to the assigned technician on the day of service, and access is logged. Codes can be deleted at your request any time.
Can I opt out of marketing emails but still receive service-related communications?: Yes. Marketing emails (seasonal specials, rebate window notifications, financing promotion announcements) and service communications (appointment confirmations, technician dispatch notifications, follow-up satisfaction emails) are managed separately. Unsubscribing from marketing through any email’s footer link will not stop service-related messages.
How do I exercise my rights under the Nebraska Data Privacy Act or Iowa Consumer Data Protection Act?: Email privacy@omahaheatingairconditioning.xyz with the subject line “Privacy Rights Request” and include your name, service address, and a description of which right you wish to exercise. We will acknowledge the request within 10 business days and respond substantively within 45 days (with a 45-day extension available if the request is complex). Verification of identity is required before we release or delete records to prevent fraudulent requests.

Contact Omaha Heating and Air Conditioning

For all privacy-related questions, requests, complaints, or appeals, contact our privacy team at privacy@omahaheatingairconditioning.xyz or by mail at the office address below. For general service inquiries, dispatch, scheduling, and after-hours emergencies, use the contact information below.

Emergency Line (24/7): (402) 258-6703
Privacy Inquiries: privacy@omahaheatingairconditioning.xyz
General Email: info@omahaheatingairconditioning.xyz
Address: Lake Regency Building, 450 Regency Pkwy #370, Omaha, NE 68114
City of Omaha Mechanical Contractor License: #MC-2014-08847
Iowa Plumbing & Mechanical Systems Board License: #B-027841
EPA Section 608 Universal: #608U-2014-227841

Office Hours

Emergency Service: 24 hours a day, 7 days a week
Office Staff: Monday – Saturday, 8:00 AM – 5:00 PM
Closed: Sundays and State/Federal Holidays (emergency line always active)

Privacy Policy | Omaha Heating and Air Conditioning