Legal

Privacy Policy

Last updated: August 22, 2026

This Privacy Policy explains how Master’s Touch Upholstery (“we,” “us,” or “our”) collects, uses, and protects information when you visit this website or request an estimate. By using the site, you agree to the practices described here.

Information we collect

When you submit an estimate or contact request, we collect the details you choose to provide, such as your name, phone number, email address, the dimensions of your piece, any photographs you upload, and a description of your project.

This website uses tracking and analytics only after you accept cookies in the banner. If you decline, or if your browser sends the Global Privacy Control (GPC) signal, no tracking or analytics load at all. We do not run advertising networks and we do not sell or share your personal information for cross-context behavioural advertising. Every service embedded in our pages — the map, the anti-spam check, the form submission, and the tracking and analytics — is listed one by one under Third-party servicesbelow, with when each one loads and what each one receives.

Categories of personal information

This is every category of personal information we collect, set out one category at a time: why we collect it, where it comes from, who else receives it, and how long we keep it. Nothing below applies “in general” — each category is answered on its own terms.

How we use your information

• To respond to your inquiry and prepare an estimate.
• To schedule quotes, pickups, and project updates.
• To improve our services and this website.
• To send updates or promotions only where you have consented.

Communications consent

If you opt in, we may contact you by phone, text, or email regarding your inquiry, estimate, scheduling, and project updates, which may use automated technology. Consent to marketing messages is not a condition of any purchase, and you may opt out at any time.

Sharing your information

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We share it only with the service providers named below, only as needed to run the business, or where the law requires it.

Third-party services

Some parts of this site are provided by other companies. When your browser loads or submits to them, it contacts their servers directly, which means those companies receive your IP address and may set their own cookies on your device under their own privacy policies rather than ours. This is what each one is, when it happens, and what is sent.

Google Maps — loads automatically on most pages

• What it is: the embedded map showing our workshop location, which appears in the footer of most pages on this site.
• When it loads: automatically, as the page loads, before you click anything.
• What Google receives: your IP address, the fact that you loaded a page containing the map, and any cookies Google has already set in your browser. Google may set additional cookies.
• Their policy: policies.google.com/privacy

Cloudflare Turnstile — only when you start filling in a form

• What it is: the anti-spam check that protects our quote forms from automated abuse. It runs in the background rather than asking you to solve a puzzle.
• When it loads: only once you click into or type in one of our quote forms. Nothing is loaded from Cloudflare while you are simply reading the page.
• What Cloudflare receives: your IP address and technical signals about your browser used to distinguish people from bots. Cloudflare sets a cookie to record the result of that check.
• Their policy: cloudflare.com/privacypolicy

LeadConnector — only when you submit a form

• What it is: the system that receives quote requests and stores them so we can reply to you.
• When it loads: only at the moment you press the submit button. Nothing is sent to it while you are simply reading.
• What it receives: everything you entered in the form — your name, email address, phone number, item dimensions, project details, and any photographs you attached — together with your IP address and the page you submitted from.

Google Analytics (Google LLC)

• What it is: Google Analytics 4, operated by Google LLC. It records which pages visitors view on the site and how they got there, so we can understand site usage in aggregate. Our GA4 property identifier is G-2EH2WCXHFX.
• When it loads: Google Analytics is loaded on every page you visit, but with Google’s Consent Mode v2 set to denied by default. Until you accept cookies in the banner, Google receives only aggregated, cookieless pings — no _ga cookies are set, no advertising signals are sent, and no individual visitor is identified. When you accept, consent is updated to granted and full analytics begin. If your browser is sending the Global Privacy Control (GPC) signal, Google Analytics does not load at all — not even the cookieless pings.
• What Google receives: the pages you visit on this site, the referring URL, basic browser and device information, and events emitted automatically by GA4’s enhanced measurement (such as scroll depth, outbound-link clicks, and file downloads). We also emit custom events for a few high-value interactions:contact_phone_click when a phone link is clicked, contact_email_click when an email link is clicked, fabric_cta_click when the fabric banner is clicked, and generate_lead when a quote form submits successfully. Google uses your IP address transiently for geolocation and service security but, per Google’s own documentation, does not log or store the IP address in Google Analytics 4. Before you accept cookies, the data above is reduced to cookieless, aggregated pings only.
• Cookies set: _ga and _ga_2EH2WCXHFX. Both are first-party cookies on this site’s domain, used by Google Analytics for visitor and session identification. Google sets them with a 2-year lifetime; in practice browsers cap this (Chrome at 400 days, Safari sooner without a return visit). GA4 does not use _gid or _gat; those were Universal Analytics cookies.
• Data retention: Google Analytics 4 lets us choose a data-retention period of 2 months or 14 months for event-level data. The retention period currently configured for this property is published in the Google Analytics admin console under “Data Settings → Data Retention”. User-level data follows the same choice. Age, gender and interest data are retained for 2 months regardless.
• How to opt out: decline cookies in the banner at the bottom of the page, or install the official Google Analytics opt-out browser add-on from tools.google.com/dlpage/gaoptout.
• Their policy: policies.google.com/privacy

LeadConnector tracking and analytics — only after you accept cookies

• What it is: a tracking and analytics script from our CRM (loaded from link.msgsndr.com) that records how visitors move through the site, measures time spent on each page, and tags your browser with an anonymous session identifier so that if you later submit a quote, our CRM can see the pages you visited and where you arrived from. It is tied to the same CRM that receives your quote submission.
• When it loads: only after you accept cookies in the banner at the bottom of the page. If you decline, or if you have the Global Privacy Control (GPC) signal turned on in your browser, this script never loads at all.
• What it receives, on each page: the page URL and path, the page title, the referring URL, your user-agent string (browser and operating system), a derived device-type label (desktop, mobile, or tablet), the session identifier below, and timestamps for when the session on each page starts and ends (idle after 18 minutes of no activity). Your IP address is not read in the browser, but the CRM’s server receives it inherently as part of each request, same as any website visit.
• What it receives, when you submit a form on the site:in addition to the page-view data above, the script sends the name, label, and value of every field in the submitted form to the same CRM endpoint. Fields it identifies as passwords are excluded. Your browser’s timezone is also sent. This is in addition to the form submission that the “Get my quote” button itself makes to the CRM.
• Cookie set: lc_session_tk_629488fd039e4941a5a95547bf37bc59— a first-party session cookie on this site’s domain, value is a random identifier, lifetime is 1 day. If your browser refuses the cookie, the same value is stored in session storage instead.
• Local storage set: a key named _udthat holds the same session identifier plus any contact identifier the CRM has already associated with you.
• Their policy: gohighlevel.com/privacy-policy

What this site stores on your device

This site sets no cookies of its own. If you accept cookies in the banner, two third-party scripts may set cookies and local-storage keys on this domain: Google Analytics sets two cookies (_ga and _ga_2EH2WCXHFX) for session identification, and the LeadConnector tracking script sets one session cookie (lc_session_tk_629488fd039e4941a5a95547bf37bc59) plus one local-storage key (_ud) — see the Google Analytics and LeadConnector entries above for details. If you decline, or if the Global Privacy Control signal is on, nothing is set at all. The site itself stores a single value in your browser’s local storage:

• mtu-cookie-consent: remembers whether you accepted or declined the cookie notice, so you are not asked on every visit. It is held on your device only and is never sent to us or to anyone else. Clearing your browser storage removes it.

You can block or delete cookies and local storage through your browser settings; blocking the third parties above may stop the map or the form’s spam check from working.

Data retention & security

How long we keep each category of personal information is stated with that category under Categories of personal information above, because the answer is different for each one. There is no single site-wide retention period.

We take reasonable measures to protect the information we hold. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your choices

You may request access to, correction of, or deletion of your personal information, and you may unsubscribe from marketing messages at any time. To make a request, contact us using the details below.

Authorized agents

A consumer may use an authorized agent to make a privacy request on their behalf. The agent should email the privacy contact with written permission signed by the consumer, and we may contact the consumer directly to confirm they made the request. We may also require the consumer to verify their own identity before we act.

Sensitive personal information

We do not collect sensitive personal information as the CCPA/CPRA defines it. Photographs you upload are stripped of their embedded metadata in your browser before they are sent to us, so no location data from your camera reaches us.

California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA) gives you the following rights with respect to your personal information:

• Right to know what personal information we have collected about you, where we got it, why we have it, and whom we have shared it with.
• Right to delete the personal information we have collected from you, subject to the exceptions the law permits.
• Right to correct inaccurate personal information we have about you.
• Right to opt out of sale or sharing of your personal information. We do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of — see “Do Not Sell or Share My Personal Information” below.
• Right to limit use of sensitive personal information.We do not collect sensitive personal information as the CCPA/CPRA defines it.
• Right to non-discrimination for exercising any of these rights. We will not deny service, charge a different price, or provide a different quality of service because you exercised your privacy rights.

To exercise any of these rights, contact us using the details under “Contact us” below. We will respond within 45 days as the CCPA/CPRA requires. We verify requests by matching the contact details you provide against the information already in our records.

Global Privacy Control (GPC)

We honour the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information under the CCPA/CPRA, without requiring any further action from you. Because we do not sell or share personal information in the first place, the GPC signal has no further effect on how we handle your data, but we respect the signal on principle.

Do Not Sell or Share My Personal Information

Master’s Touch Upholstery does not sell your personal information for money or other valuable consideration, and does not share it for cross-context behavioural advertising. We have no advertising, analytics, or data-broker relationships that would make such a sale or share possible. There is nothing to opt out of, but if you wish to confirm this status in writing or submit a formal opt-out request, contact us using the details below and we will respond in writing within 15 business days.

Contact us