Book Visit

Privacy Policy

Effective date: June 18, 2026

This Privacy Policy describes how H & E Building Material Corp ("H&E," "we," "us," or "our") collects, uses, discloses, and protects information when you visit hestonemc.com or hestonemc.com(the "Site"), use our AI chat assistant, fill out a form, subscribe to communications, text or call us, or visit our showroom at 11768 Clay Rd, Houston, TX 77043 (collectively, the "Services"). By using the Services, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Services.

At a glance: we collect contact information you give us through forms and conversations, technical data about your visit, and (if you opt in) email and SMS marketing consent. We do not sell your personal information. We share data only with vendors who power the Site (hosting, email, payments, analytics, AI). California, EU/UK, Texas, Virginia, Colorado, Connecticut, and Utah residents have specific rights described below. Email stoneprohubinc@gmail.com or call (832) 569-8899 to exercise any right.

1. Information We Collect

(a) Information you provide directly

When you fill out a contact form, request a quote, book a showroom visit, submit a Saturday-sale RSVP, use our cost calculator, subscribe to emails, or chat with our AI assistant, you may give us:

  • Name
  • Phone number (mobile or landline)
  • Email address
  • Property address or service location (only if you provide it)
  • Service type or project type (countertop, kitchen remodel, Cambria, etc.)
  • Project details you describe — square footage, cabinet style, budget range, preferred time of visit, materials of interest
  • Photos you upload (e.g., kitchen photo to help us match slabs)
  • Communications content (chat messages, voicemail, text replies, emails)
  • Payment information (collected and processed by Stripe — we never see your full card number; we only see the last four digits and brand)
  • Review submissions (name and review text, if you choose to leave one)

(b) Information we collect automatically

  • IP address (full IP is logged for security, rate-limiting, and fraud prevention; truncated IPs are used in analytics)
  • Browser type, version, and language
  • Device type (mobile, desktop, tablet) and screen size
  • Operating system
  • Pages visited, time on page, and scroll depth
  • Referring website or search engine
  • UTM parameters from links you click to reach us
  • Click events on buttons, phone-link taps, and form interactions
  • Cost-calculator inputs (square footage, material, edge profile selections — used to refine the on-site estimate the team gives you)
  • Approximate location derived from IP (city/region; never precise GPS)

(c) Information from third parties

  • Google Business Profile (Google Maps) for reviews you choose to post publicly about H&E
  • Stripe, regarding subscription, billing, or payment events (when applicable)
  • Resend, regarding email deliverability and bounces
  • Cloudflare Turnstile, regarding bot/spam signal verification

2. How We Use Your Information

We process personal information for the following purposes:

  • Service delivery: respond to quote requests, schedule showroom visits, coordinate template/fabrication/install work, send appointment reminders, and answer questions.
  • Billing and payment: process payments, issue invoices and receipts, and reconcile balances.
  • Communications: send transactional emails and texts (booking confirmations, install dates, invoices, review requests post-install). These are not marketing.
  • Marketing (only if you opt in): send seasonal remodel tips, design ideas, financing offers, and Saturday-sale promotions by email or SMS. You can opt out at any time.
  • Site analytics and improvement: understand traffic sources, page performance, conversion paths, and technical errors.
  • AI chat triage: route project inquiries, draft initial responses, and capture lead details so our team can follow up. See Section 6 for details.
  • Fraud prevention and security: rate-limit abusive traffic, block bots, and protect against fraudulent payment or booking activity.
  • Legal compliance: respond to lawful requests from courts, regulators, or law enforcement.

3. Legal Bases for Processing (EU/UK/EEA Residents)

If you are in the European Union, the United Kingdom, or the European Economic Area, we process your personal information under one or more of the following legal bases under the General Data Protection Regulation (GDPR) or UK GDPR:

  • Performance of a contract — to deliver services you request (e.g., process a quote, schedule a visit, complete an install).
  • Consent — for non-essential cookies, analytics, and marketing emails or SMS. You may withdraw consent at any time without affecting prior processing.
  • Legitimate interests — to operate the Site securely, prevent fraud and abuse, improve performance, and respond to inquiries. We balance these interests against your rights and freedoms.
  • Legal obligation — to comply with applicable law (tax, accounting, regulatory reporting, lawful requests).

We do not knowingly transfer personal information of EU/UK residents outside their region except where the transfer is covered by Standard Contractual Clauses or an adequacy decision. Our hosting and database vendors (Vercel, Neon) are U.S.-based and rely on these mechanisms.

4. How We Share Information

We do not sell, rent, or trade personal information. We do not share personal information for cross-context behavioral advertising. We share information only with the following categories of recipients, and only as needed:

  • Hosting and infrastructure: Vercel (application hosting), Neon (managed Postgres database) — both U.S.-based.
  • Email delivery: Resend Inc., for transactional and marketing email.
  • Payment processing: Stripe Payments, for subscriptions and any direct online charges. Stripe is a separate data controller for payment data.
  • AI processing: Anthropic PBC, for the AI chat assistant. Anthropic does not use chat content to train its models under our commercial agreement.
  • Spam protection: Cloudflare Turnstile, for bot-signal verification on forms.
  • Analytics: Google Analytics (Google LLC) and our internal first-party analytics, only with your consent for non-essential analytics.
  • Professional advisors: attorneys, accountants, and insurers when reasonably necessary.
  • Authorities and legal compliance:in response to a lawful subpoena, court order, or government request; to enforce our Terms; to protect rights, property, or safety of H&E, our customers, or others.
  • Business transfer: in connection with a merger, acquisition, financing, or sale of all or part of our business, in which case personal information may be transferred subject to the same protections in this Policy.

All vendors are bound by contractual confidentiality and data-protection obligations.

5. Data Retention

We retain personal information only as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law.

  • Contact form, booking, RSVP, and chat lead records: up to 5 years from last contact, to support warranty, return-customer service, and historical records.
  • Email subscriber records: until you unsubscribe, then up to 90 days in a suppression list to honor your opt-out.
  • SMS opt-in records: until you reply STOP, then we retain proof of opt-out indefinitely as required by TCPA.
  • Invoices, receipts, and contracts: 7 years, for tax and accounting compliance.
  • Analytics + click events: up to 26 months at user-resolution; aggregate metrics retained indefinitely.
  • Chat messages without a captured lead: not retained past the AI processing call.
  • Server logs (IP, request paths): up to 90 days for security and abuse prevention.

6. AI Chat Assistant

Our Site includes an AI-powered chat assistant powered by Anthropic PBC (Claude). By using it, you understand and agree:

  • You are interacting with artificial intelligence. The assistant is clearly labeled. It is not a human employee.
  • What is processed.Your messages, any contact information you give, and the page you were on are sent to Anthropic's API to generate a response. Anthropic does not train on this data under our commercial agreement.
  • What is stored. If a lead is captured, we store your name, contact info, project summary, and source in our database (see Section 5 retention). Otherwise the messages are not retained beyond the API call.
  • Automated decision-making. The assistant may decide which information to ask for and may classify your inquiry by urgency. It does not make legally binding decisions, set prices, or schedule services. A human always reviews any captured lead before contact, fabrication, or installation work is committed.
  • Accuracy disclaimer. AI responses may be incorrect or out of date. Do not rely on the AI for pricing, safety, scheduling, or warranty decisions. Always confirm in writing with our team.
  • Opting out. You may always reach us by phone (832) 569-8899, email, or walk-in. None of those channels use AI.

7. Text Messages (SMS) and TCPA Consent

When you give us your mobile number on a form, in chat, by phone, or in person, you consent to receive text messages from H&E related to your inquiry, appointment, or active project (booking confirmations, install updates, invoice receipts, review requests). These are transactional messages; standard message and data rates may apply.

Marketing texts (Saturday-sale promotions, seasonal offers, new arrivals) are only sent if you specifically opt in to marketing SMS on a form or by replying YES to an opt-in invitation. You can opt out of marketing texts at any time by replying STOP to any message; you can opt back in by replying START. We retain proof of your opt-out indefinitely as required by the Telephone Consumer Protection Act (TCPA).

Reply HELP at any time for help. Message frequency varies (typically 1–4 messages per month for marketing).

8. Cookies and Similar Technologies

We use the following categories of cookies and storage:

  • Strictly necessary: session cookies for login, CSRF tokens, cookie-consent preferences, rate-limit signaling, and load-balancing. These cannot be disabled because the Site would not function.
  • Analytics (opt-in): Google Analytics and first-party page-view tracking. Only loaded after you accept analytics cookies in the banner.
  • Marketing (opt-in): none currently in use. If we add ad pixels (Meta, Google Ads, etc.), they will be gated behind explicit marketing consent.

You can change your cookie preferences any time by clicking Cookie Preferences in the footer, or by clearing cookies in your browser. We honor the Global Privacy Control (GPC) browser signal — if your browser sends GPC, we treat it as a valid opt-out of non-essential cookies and analytics for residents of California, Colorado, and Connecticut.

9. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act and the California Privacy Rights Act give you the following rights:

  • Right to know what categories of personal information we have collected about you, the sources, the business purposes, and the categories of recipients.
  • Right to access the specific pieces of personal information we hold about you.
  • Right to delete personal information we collected about you, subject to legal exceptions.
  • Right to correct inaccurate personal information.
  • Right to opt out of sale or sharing for cross-context behavioral advertising. H&E does not sell or share personal information. You may still confirm or opt out by visiting our Do Not Sell or Share My Personal Information page.
  • Right to limit use of sensitive personal information. We do not use sensitive personal information for inferences or any purpose beyond providing the requested services.
  • Right of non-discrimination for exercising your privacy rights.
  • Right to designate an authorized agent to submit requests on your behalf. We will require the agent to provide written permission and verify your identity.

To submit a request, email stoneprohubinc@gmail.com with the subject "CCPA Privacy Request," call (832) 569-8899, or mail us at 11768 Clay Rd, Houston, TX 77043. We will verify your identity by matching the information you provide against records we already hold, and we will respond within 45 days (extendable once by 45 days with notice).

10. Texas, Virginia, Colorado, Connecticut, Utah Residents

Residents of Texas (TDPSA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have similar rights to California residents, including the right to access, correct, delete, obtain a copy, and (where applicable) opt out of targeted advertising, sale, or profiling for legal effects. H&E does not engage in targeted advertising, sale, or profiling for legal effects, so opt-outs there are noted but do not materially change processing.

To exercise any state-level right, use the same contact methods listed in Section 9. We will respond within 45 days (or the applicable state law's deadline) and provide an appeal procedure if your request is denied.

11. EU/UK Privacy Rights

If you are in the EU, UK, or EEA, you have the following rights under GDPR / UK GDPR:

  • Right of access to your personal information.
  • Right to rectification of inaccurate or incomplete data.
  • Right to erasure("right to be forgotten"), subject to legal exceptions.
  • Right to restrict processing in defined circumstances.
  • Right to data portability for data you provided to us in a machine-readable format.
  • Right to object to processing based on legitimate interests and to direct marketing.
  • Right to withdraw consent at any time without affecting prior processing.
  • Right to lodge a complaint with your local supervisory authority.

Submit requests to stoneprohubinc@gmail.com. We will respond within 30 days of receipt (extendable by two months for complex requests).

12. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information. These include encrypted connections (TLS/HTTPS), encrypted database storage, access controls, regular software updates, least-privilege access, and rate-limiting. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we ever learn of a personal-information security incident affecting your data, we will notify you and the appropriate authorities in accordance with applicable law.

13. Children's Privacy (COPPA)

The Site is intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has submitted information through the Site, email us at stoneprohubinc@gmail.com and we will promptly delete it.

14. Do Not Track (DNT) Signals

Web browsers may send a "Do Not Track" signal. There is no consensus industry standard for how to respond. We do not currently treat DNT as a binding opt-out, but we do honor the more recent Global Privacy Control (GPC) signal described in Section 8 for residents of California, Colorado, and Connecticut.

15. Third-Party Links and Services

The Site may link to third-party websites (Google Maps, Instagram, Facebook, YouTube, Enhancify, Synchrony, Hearth, Cambria). We are not responsible for the privacy practices of those services. Review their privacy policies before sharing information with them.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Effective date" at the top, and for material changes we will notify you by a prominent notice on the Site or by email. Your continued use of the Services after changes take effect indicates acceptance of the updated Policy.

17. Contact Us

Questions, complaints, or privacy requests should be directed to:

  • H & E Building Material Corp
  • 11768 Clay Rd, Houston, TX 77043
  • Phone: (832) 569-8899
  • Email: stoneprohubinc@gmail.com