- Home
- Privacy
Privacy notice · Accessibility · Data requests
We keep an enquiry 36 months, a chat 6 months and a server log 90 days.
This is what a Seattle plumber actually holds about you after you fill in a form, open the chat or click one of our ads, who else touches it, and how you get it deleted. Five parts, one tab each. If you only came for the form, it is under Your rights.
What lands on our side when you get in touch
Who runs this site
The controller is Bestplumbing, trading at bestplumbing.app as Best Plumbing. The shop is at 8820 Aurora Ave N, Seattle, Washington 98103, United States. That is the address the trucks leave from and the address any letter about your data should go to. Email is [email protected] and the phone is 206-633-1700, answered around the clock because the emergency line is.
Every category, nothing rounded off
The quote and contact forms post to one script, dodu1e1.php. It writes down exactly what you typed: your name, phone, email, the job address, the kind of job you picked from the list, the message, any specification you added (pipe size, fixture count, tank capacity) and the consent tick. Along with that the server records, without you doing anything, the IP address you sent from, your browser's user-agent string, the page you came from, the moment the form was rendered and the moment you pressed send. The two timestamps are there to catch bots that fill a form in half a second.
The support chat runs through gowe40b.php. It keeps the conversation itself, plus whatever name, phone or email you chose to give at the start, and it leaves a token in your browser's local storage so that if you close the tab and come back the thread is still there.
The cookie banner stores your Allow or Decline under the key site_consent_v2. Nothing else on this site persists a choice.
When you arrive from a paid ad, the link carries a click identifier in the address bar: gclid from Google, msclkid from Microsoft, fbclid from Meta. If you allow storage, the platform tags read it and set their own cookies; the second tab explains what that means.
There is no account, no password, no payment and no card data anywhere on this site. Nothing is sold here and no money is taken online. You pay for plumbing on the job, against the written quote.
What each piece is for
- Name, phone, email, address, job kind, message, specification. Calling you back, working out which truck and which parts, and writing the on-site quote. The address matters most: a 1920s Wallingford craftsman with a clay side sewer is a different job from a 2005 Ballard townhouse on ABS.
- Consent tick. Proof that you asked us to contact you about this job, and nothing wider.
- IP, user-agent, referrer, timestamps. Spam filtering and keeping the server running. We look at them when something breaks or when a form floods in at 3 a.m. from a script.
- Chat transcript and token. Answering you, and letting you pick the thread back up.
- Click identifiers and ad cookies. Telling Google, Microsoft and Meta that a click turned into an enquiry, so we can see which ads bring plumbing calls and which burn money. Only after you allow storage.
site_consent_v2. Remembering your answer so the banner does not ask again on every page.
The legal basis for each one
For visitors reaching us from Europe, the GDPR asks us to name a basis for every purpose. Here they are.
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering an enquiry, quoting a job | Form fields, chat | Steps at your request before a contract (Art. 6(1)(b)) |
| Contacting you about that job | Phone, email, consent tick | Consent (Art. 6(1)(a)), and the contract once you book |
| Spam filtering, server security | IP, user-agent, referrer, timestamps | Legitimate interest in a site that works (Art. 6(1)(f)) |
| Ad conversion measurement | gclid, msclkid, fbclid, platform cookies | Consent (Art. 6(1)(a)), given through the banner |
| Remembering your cookie choice | site_consent_v2 | Legitimate interest; strictly necessary storage |
| Keeping job records for tax and warranty | Enquiry and job file | Legal obligation (Art. 6(1)(c)) |
Children
This site is for property owners, tenants and managers arranging plumbing work. It is not aimed at anyone under 16 and we do not knowingly take data from children. If a child has sent us a form, tell us and we delete it the same week.
We pay for clicks, and this is what that costs you in data
The platforms sending traffic here
People searching for an emergency plumber in Seattle or a 24 hour plumber in Seattle find us partly through paid ads. Google Ads and Microsoft Advertising send traffic to this site today. Meta Ads sends traffic here when a campaign is running on Facebook or Instagram.
Each platform tags its own clicks. Google Ads adds gclid to the link, Microsoft Advertising adds msclkid, and Meta Ads adds fbclid. The identifier is a random string; on its own it tells us nothing about you. What it lets the platform do, once you allow storage, is match "this click" to "this click became a quote request", and report that back to us as a count. We see numbers per campaign. We do not get a list of who you are or what else you browsed.
None of these platforms has reviewed or vouched for this site. They sell us ad space; that is the whole relationship.
Consent Mode v2, set to denied until you say otherwise
The Google tag on this site runs in Consent Mode v2. Before the banner is answered, four signals are held at denied: ad_storage, ad_user_data, ad_personalization and analytics_storage. While they are denied, no advertising or analytics cookie is written to your browser and no click identifier is stored. Google receives only a cookieless ping that a page loaded.
Press Allow and all four flip to granted. Press Decline, or withdraw later through the Cookie settings button in the footer, and they are set back to denied on the spot, for that page and every page after. The Microsoft and Meta tags follow the same switch: they do not fire storage until the choice is Allow.
Your choice is held for 12 months under site_consent_v2, then the banner asks again. The full list of cookies, with their lifetimes, is on the cookie notice.
Global Privacy Control
If your browser sends the Global Privacy Control signal (the Sec-GPC: 1 header), we treat it as an opt-out of sale and sharing for advertising. The four Consent Mode signals stay denied and the banner does not pester you for a different answer. You can still choose Allow yourself if you want to; we will not ask.
Who else sees it, and when it gets binned
The third parties, one by one
We do not sell your details and we do not hand a job list to another contractor. The data moves to these parties and no others:
- Google Ireland Ltd / Google LLC. Runs Google Ads. Attaches
gclidto a click and receives the Consent Mode signals. Its policy: policies.google.com/privacy. - Microsoft Ireland Operations Ltd. Runs Microsoft Advertising. Attaches
msclkid. How Microsoft handles what it receives is set out in the Microsoft privacy statement at privacy.microsoft.com/privacystatement. - Meta Platforms Ireland Ltd. Runs Meta Ads. Attaches
fbclidwhere a campaign runs there. - Our hosting provider. Serves these pages, writes the server logs and stores the enquiry database and chat transcripts.
- Our mail provider. Carries the notification of a new enquiry from the server to the shop inbox at [email protected].
The ad platforms get identifiers and conversion events, only after you allow storage. They never get the contents of your message or your address.
Data that crosses a border
The shop is in Seattle, so enquiries from Europe travel to the United States by definition. Google, Microsoft and Meta process data in the US and elsewhere. Where personal data leaves the European Economic Area, the transfer rests on the EU-US Data Privacy Framework for companies certified under it, and on the European Commission's Standard Contractual Clauses where it is not. We do not send your data to any country for any reason other than answering you and measuring ads you consented to.
How long each category is kept
| Category | Kept for | Why that long |
|---|---|---|
| Enquiries and their email copies | 36 months | A water heater or repipe we quoted often comes back within three years, and the job history saves a site visit. |
| Chat transcripts | 6 months | Long enough to follow up a job raised in chat, short enough not to pile up. |
| Server and access logs | 90 days | Spam and fault tracing. Older logs are deleted on a rolling basis. |
| Record of a consent choice | 12 months | Then the banner asks again. |
| Data requests | Answered in 7 days | The request itself is kept with the enquiry records so we can show we acted on it. |
Platform cookies set after you allow storage have their own lifetimes, listed on the cookie notice.
How it is protected
Every page and every form is served over HTTPS, so nothing you type crosses the network in the clear. The enquiry database sits outside the public web root and only the operator's login reaches it. Forms are screened by two hidden trap fields and the render-to-send timer, which keeps bot traffic out of the records. Access is limited to the people who quote and book jobs. Nobody on the truck carries a printed list of customer addresses; the job address goes to the phone of the plumber attending, for that job.
Ask for it, fix it, or have it deleted
If you are writing from Europe: your GDPR rights
Under the GDPR you can ask us for a copy of everything we hold on you (access). You can have a wrong phone number or address corrected (rectification). You can have it deleted (erasure), unless we still need a job record for tax or warranty, in which case we tell you which record and until when. You can ask us to stop using it while a dispute is sorted (restriction), to send it to you or someone else in a usable file (portability), and to stop processing based on legitimate interest (objection). Where we rely on consent, you can withdraw it at any time, and withdrawing does not undo what was lawful before.
US state privacy rights, California first
If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to delete it, to correct it, and to opt out of its sale or sharing for cross-context behavioral advertising. We do not sell personal information for money. Letting ad platforms set cookies after you press Allow can count as sharing under California law, so Decline, or a Global Privacy Control signal, is your opt-out. Residents of Washington and the other states with a privacy law in force have comparable rights to access, correct, delete and opt out, and we honor them the same way. Using any of these rights never changes the price or the treatment you get from us.
If you think we got it wrong
Tell us first; most problems are a misspelled email. You can also complain to your state Attorney General, and in California to the California Privacy Protection Agency. Visitors in Europe can complain to the data protection authority in the country where they live or work.
Making a data request
Use the form below, email [email protected], or write to Best Plumbing, 8820 Aurora Ave N, Seattle, Washington 98103, United States. Tell us the name, phone or email the enquiry was made under so we can find it. We answer every request within 7 days. If we need to confirm it is really you, we ask once, by replying to the contact details already on file.
Data request form
When this notice changes
If we add a platform, change a retention period or start collecting something new, the change goes on this page with a new date at the top, and the cookie banner asks again on your next visit if the change touches cookies. The previous version is kept on file and sent to anyone who asks for it.
Reaching a person about privacy
Email [email protected] or call 206-633-1700. Post goes to 8820 Aurora Ave N, Seattle, Washington 98103. The phone is answered by the shop, the same people who book the jobs, not a call center.
Built to be used by keyboard, screen reader and a wet thumb
What we aim for
The target is WCAG 2.2 at level AA. Most people who need a plumber at night are standing in a basement holding a phone in one hand, so the site is built for that first: the phone number is a tap target on every page, buttons are at least 44 pixels tall, and the layout holds together from a 320-pixel screen up.
What is in place
- A skip link at the top of every page jumps straight to the content.
- Every control can be reached and worked with a keyboard. The menu closes with Esc and hands focus back to the button that opened it.
- Focus is shown with a thick amber outline that does not disappear on any background.
- Body text is near-black on warm white, well past the 4.5:1 contrast minimum.
- The scrolling marquee strips stop when you hover or tab into them, and stand still entirely if your system asks for reduced motion.
- Photographs carry text descriptions. Icons are decorative and hidden from screen readers; the words beside them carry the meaning.
- Form errors are written out in words next to the field, not shown by colour alone.
Known gaps
The chat widget announces new messages through a live region, but the timing can be uneven with some screen readers while a reply is arriving. If that gets in your way, the phone is quicker anyway. Tables on the legal pages scroll sideways on narrow screens; they are labelled regions so a screen reader names them before you enter.
Tell us what is broken
If something on this site stops you booking a job, email [email protected] or call 206-633-1700 and tell us the page and what happened. We will take the booking over the phone straight away and fix the page after.