AC Direct Privacy and Security

1. Introduction and Scope

AC Direct ("AC Direct," "Company," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you visit www.acdirect.com (the "Site"), create an account, place an order online or by telephone, contact our customer service team, register as a VIP contractor, subscribe to our email or SMS communications, use our live chat, or otherwise interact with us (collectively, the "Services").

This Privacy Policy is designed to satisfy applicable privacy laws in the jurisdictions where we operate, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (together, the "CCPA"), other U.S. state privacy laws, the European Union General Data Protection Regulation ("GDPR"), and the United Kingdom GDPR.

Jurisdiction-specific disclosures appear in Sections 12 (California), 13 (EU/EEA and UK), and 14 (Other U.S. States).

This Privacy Policy applies to our Services regardless of the technology platform we use to operate our online store. By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

2. Personal Information We Collect

"Personal information" means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or household. We collect the following categories of personal information:

• Identifiers: name, postal address, email address, telephone number, account username and password, IP address, and similar identifiers.
• Commercial information: products purchased, obtained, or considered; order history; shopping cart and wishlist contents; quotes requested; returns and warranty claims; and other purchasing or consuming histories or tendencies.
• Financial information: payment card type and last four digits, billing address, and financing application status. Full payment card numbers are processed by our PCI-compliant payment processors and are not stored on our systems.
• Internet or other electronic network activity: browsing history on the Site, search history, pages and products viewed, referring URLs, clickstream data, and information about your interaction with our Site, emails, and advertisements, including session-replay data that records on-screen interactions such as mouse movement, clicks, and scrolling (with sensitive fields masked).
• Device and technical data: browser type and version, operating system, device type, screen resolution, language preference, time zone, and cookie identifiers.
• Geolocation data: approximate location derived from your IP address or ZIP/postal code (for example, to estimate shipping costs, display regional efficiency standards, or show local installer options).
• Audio and electronic information: recordings of customer service calls (where permitted by law and with required notice), chat transcripts, and emails.
• Professional or commercial context: for contractor, installer, trade, or business accounts - company name, job title, license numbers, tax identification or resale certificate information, and trade references.
• Inferences: preferences, characteristics, and behaviors derived from the information above, used to personalize your experience and our marketing.

Gift recipients. If you purchase equipment or products as a gift or for delivery to another person, we collect that recipient's name, address, and phone number solely to fulfill the order.

We do not use gift recipient information for marketing purposes.

We do not knowingly collect sensitive personal information (such as government identification numbers, precise geolocation, racial or ethnic origin, health data, or biometric data) except where you voluntarily provide it (for example, a license or tax ID for a VIP contractor account) or where required for financing offered through third-party lenders such as Affirm and PayPal Credit, who collect such information directly under their own privacy policies.

3. How We Collect Personal Information

• Directly from you - when you create an account, place an order online or by phone, request a quote, use our AC tonnage, furnace BTU, or mini split sizing calculators or ductwork design service, enter a contest or sweepstakes, respond to a survey, sign up for our email newsletter or SMS program, register for our VIP contractor program, apply for financing, leave a product review, or contact us by phone, email, or live chat.
• Automatically - through cookies, pixels, web beacons, server logs, and similar technologies when you browse the Site (see Section 5).
• From third parties - such as payment processors, financing partners (e.g., Affirm, PayPal), shipping and freight carriers, fraud-prevention services, analytics and advertising providers (e.g., Google, Meta/Facebook, Microsoft, AdRoll), our email, SMS, and product-reviews providers, social media platforms (if you interact with our pages or ads), and affiliated brands within our corporate family.

4. How We Use Personal Information

We use personal information for the following business and commercial purposes:

• Processing and fulfilling orders, including payment processing, freight and parcel delivery, order status updates, returns, and warranty service;
• Creating and managing your account and verifying your identity;
• Providing customer support, technical assistance, and responding to inquiries, part requests, and quotes;
• Sending transactional communications (order confirmations, shipping notices, service messages);
• Sending marketing emails and SMS messages about new products, special offers, and other information we think may interest you, where permitted by law and subject to your opt-out rights (see Section 6);
• Personalizing your experience, including remembering your cart, showing recently viewed products, and tailoring content and offers;
• Conducting analytics, market research, and internal record keeping to improve our products, Services, and Site;
• Administering contests, promotions, surveys, loyalty, affiliate, and installer/trade programs;
• Detecting, investigating, and preventing fraud, security incidents, and other illegal or harmful activity;
• Complying with legal obligations, enforcing our terms, and protecting our rights, property, and safety and those of others; and
• Evaluating or completing a merger, acquisition, financing, reorganization, or sale of some or all of our assets.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

5. Cookies and Tracking Technologies

Cookies are small files placed on your device that allow us and our partners to recognize your browser, remember your preferences, keep items in your shopping cart, analyze Site traffic, measure the effectiveness of advertising, and deliver interest-based ads. We and our service providers use cookies and similar technologies (such as pixels, web beacons, tags, and software development kits) in the following categories:

• Strictly necessary cookies - required for the Site to function (e.g., session, cart, checkout, security, fraud-prevention, and load-balancing cookies). This includes cookies set by Cloudflare, our content-delivery and security provider, to protect the Site against malicious traffic and maintain availability. These cookies cannot be disabled through our consent tools.
• Functional cookies - remember your preferences such as currency, language, recently viewed and compared products, and wishlist contents, and whether you have already seen a sign-up prompt.
• Analytics and performance cookies - help us understand how visitors use the Site so we can improve it. We use Google Analytics 4 (GA4), which uses first-party cookies to measure traffic, user behavior, and Site performance, managed through Google Tag Manager. We also use Microsoft Clarity to understand how visitors interact with the Site through behavioral metrics, heatmaps, and session replays that record interactions such as mouse movements, clicks, scrolling, and navigation paths (sensitive form fields are masked by default). Clarity data is collected using first- and third-party cookies, and Microsoft may use this data for its own purposes, including advertising, in accordance with the Microsoft Privacy Statement (privacy.microsoft.com). Because Microsoft may use Clarity data for advertising, where consent is required we treat Clarity as a non-essential technology and load it only after you consent.
• Advertising and targeting cookies - set by us and third parties to deliver ads relevant to you on our Site and elsewhere, to measure ad performance, and to retarget you on other websites and platforms. These include the Meta/Facebook Pixel (measuring actions such as purchases and page views to deliver and measure targeted ads) and AdRoll (cross-site retargeting and display advertising), as well as Google Ads remarketing and conversion tracking if you reach us through Google Shopping or Search campaigns. In addition, our email and SMS platform, Klaviyo, and our email and product-reviews platform, BayEngage (TargetBay), may set cookies to recognize you and to track on-site activity such as products viewed, in order to support features like abandoned-cart and abandoned-browse messaging. These technologies may constitute a "sale" or "sharing" of personal information under the CCPA and similar state laws (see Section 12).

Tools that do not track you on the Site. Certain services we use to operate, secure, and monitor the Site - including our search-performance tools (Google Search Console), our product-listing feed to shopping channels (Google Merchant Center), and our uptime and availability monitoring (Uptime.com) - do not place cookies on your device or collect personal information about you through the Site, and so are not listed above.

Managing cookies. Where required by law (including in the EU/EEA and UK), non-essential cookies are deployed only with your consent, which you can give, refuse, or withdraw at any time through our cookie banner or the "Cookie Settings" link in the Site footer. You can also configure your browser to refuse or delete cookies, though parts of the Site may not function properly. We honor recognized opt-out preference signals, such as the Global Privacy Control (GPC), as required by applicable law.

Do Not Track. Other than GPC signals where legally required, the Site does not currently respond to browser "Do Not Track" signals because no uniform standard has been adopted.

6. Email and SMS Marketing; Your Opt-Out Choices

• Email. You may unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email, by updating your preferences in the "My Account" section of the Site, or by contacting us at [email protected]. Due to email production schedules, you may receive emails already in production after opting out. We will continue to send transactional emails related to your orders and account.
• SMS/Text. If you opt in to our SMS program, we may send recurring promotional and cart-reminder messages. Message and data rates may apply, and carriers are not liable for delayed or undelivered messages. Reply STOP to any message to opt out, or HELP for assistance. Consent to SMS marketing is not a condition of purchase.
• Interest-based advertising. You can limit targeted advertising through our Cookie Settings, the "Do Not Sell or Share My Personal Information" link (Section 12), industry tools at optout.aboutads.info, youradchoices.com, and optout.networkadvertising.org, and your device or browser settings.

7. How We Disclose Personal Information

We do not rent or lease your personal information, and we disclose it only as described below:

• Service providers and processors - companies that perform services on our behalf under contract, including payment processing (e.g., card networks, PayPal), financing (e.g., Affirm), shipping and freight, warehousing, order fulfillment, ductwork design services, website hosting and e-commerce platform services, content delivery and security (e.g., Cloudflare), email and SMS marketing (e.g., Klaviyo), product reviews and email engagement (e.g., BayEngage/TargetBay), analytics, and fraud prevention. These parties are permitted to use personal information only to provide services to us and must keep it confidential.
• Affiliates and our family of brands - our parent company, subsidiaries, and affiliated websites under common ownership, which are required to honor this Privacy Policy.
• Advertising partners - third-party advertising and social media companies that receive identifiers and internet-activity data through cookies and pixels, including Meta/Facebook, AdRoll and Google in connection with Google Ads/Shopping, as described in Sections 5 and 12.
• Manufacturers and warranty administrators - to register equipment, process warranty claims, and arrange parts or service.
• Business transfers - in connection with, or during negotiations of, any merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, in which case personal information may be among the transferred assets.
• Legal and safety - to comply with law, regulation, subpoena, or other legal process; to respond to valid requests from public authorities; to enforce our terms and agreements; or to protect the rights, property, or safety of the Company, our customers, or others.
• With your consent - for any other purpose disclosed to you at the time of collection or with your direction.

8. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, tax, warranty, and reporting obligations, to resolve disputes, and to enforce our agreements. The criteria we use to determine retention periods include: the length of our ongoing relationship with you (e.g., active account or open warranty); whether a legal obligation requires retention (e.g., transaction records retained for tax purposes); and whether retention is advisable in light of our legal position (e.g., statutes of limitations, litigation, or regulatory investigations). Usage and analytics data are generally retained for shorter periods unless needed for security or legal purposes.

When personal information is no longer required, we delete, de-identify, or securely destroy it.

9. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include TLS encryption of data in transit, PCI-DSS-compliant payment processing, access controls limiting personal information to employees who need it to perform their job functions, and personnel training. Where we use session-replay analytics, sensitive form fields (such as passwords and payment details) are masked so that they are not captured. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law.

10. Children's Privacy

The Services are intended for a general audience and are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies), and we do not sell or share the personal information of consumers we know to be under 16 years of age. If you believe a child has provided us personal information, please contact us at [email protected] and we will delete it.

11. Third-Party Websites and Links

The Site may contain links to third-party websites, including manufacturer sites, financing providers, installer networks, and social media platforms. We do not control those websites and are not responsible for their privacy practices. We encourage you to review the privacy policy of every site you visit.

12. California Privacy Notice (CCPA/CPRA)

This Section 12 applies solely to California residents and supplements the rest of this Privacy Policy. Terms used in this Section have the meanings given in the CCPA.

12.1. Categories Collected, Disclosed, Sold, or Shared

In the preceding 12 months, we have collected the categories of personal information listed in Section 2 from the sources listed in Section 3, for the purposes listed in Section 4, and disclosed them as shown below:

Category	Disclosed for a Business Purpose To	Sold or Shared To
Identifiers	Service providers (payment, shipping, fulfillment, hosting, security, support); affiliates; manufacturers/warranty administrators	Advertising partners (e.g., Meta, AdRoll) via cookies/pixels
Commercial information	Service providers; affiliates; manufacturers/warranty administrators	Advertising partners (e.g., Meta, AdRoll) via cookies/pixels
Financial information	Payment processors; financing partners; fraud-prevention services	None
Internet/network activity & device data	Analytics providers (e.g., GA4, Microsoft Clarity); hosting and security providers	Advertising partners (e.g., Meta, AdRoll) via cookies/pixels
Geolocation (approximate)	Service providers (shipping estimates, regional compliance)	Advertising partners via cookies/pixels
Audio/electronic information	Customer support and telephony providers	None
Professional information (trade accounts)	Service providers; tax/compliance vendors	None
Inferences	Analytics and marketing service providers	Advertising partners

We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA (such as performing the Services), and therefore do not offer a separate "Limit the Use of My Sensitive Personal Information" right. We do not knowingly sell or share the personal information of minors under 16. Because we use the Meta/Facebook Pixel and AdRoll and Google Ads for targeted advertising, and Microsoft Clarity (which Microsoft may use for advertising), identifiers, internet activity, and commercial information are "shared" for cross-context behavioral advertising as defined by the CCPA; you may opt out as described in Section 12.2.

12.2. Your California Rights

• Right to Know/Access - to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties to whom we disclosed, sold, or shared it.
• Right to Delete - to request deletion of personal information we collected from you, subject to legal exceptions (e.g., completing transactions, security, legal compliance).
• Right to Correct - to request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing - to direct us not to sell your personal information or share it for cross-context behavioral advertising. Exercise this right via the "Do Not Sell or Share My Personal Information" link in our Site footer, by enabling the Global Privacy Control in your browser, or by contacting us as described below.
• Right to Non-Discrimination - we will not deny you goods or services, charge different prices, or provide a different level of quality because you exercised your CCPA rights.

12.3. How to Submit a Request

You may submit a request by emailing [email protected] or by calling us toll-free at 866-862-8922. You can also modify or delete certain information yourself at any time by signing into the "My Account" section of the Site, where you can update your email preferences and remove saved shipping addresses, billing addresses, and payment information. Please note that we may retain information about individual sales transactions in order to service those transactions and for record keeping, warranty, tax, and legal compliance purposes.

We must verify your identity to a reasonable degree of certainty before fulfilling access, deletion, or correction requests; we typically do so by matching information you provide against information in our records (e.g., name, email, and recent order details). You may designate an authorized agent to make a request on your behalf; we will require proof of the agent's authority and may still require you to verify your own identity. We will respond to verifiable requests within 45 days, with one 45-day extension where reasonably necessary (we will notify you of any extension).

12.4. Shine the Light

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, contact us at [email protected].

13. Notice to Individuals in the EU/EEA, UK, and Switzerland (GDPR)

This Section 13 applies if you are located in the European Economic Area, the United Kingdom, or Switzerland. For purposes of the GDPR and UK GDPR, AC Direct, 7319 Sandscove Court, Ste 1, Winter Park, FL 32792, USA, is the data controller of your personal data.

13.1. Legal Bases for Processing

• Performance of a contract - processing necessary to fulfill your orders, manage your account, and provide the Services you request.
• Legitimate interests - operating, securing, and improving the Services; preventing fraud; first-party analytics; and marketing to existing customers where permitted, balanced against your rights and freedoms.
• Consent - for non-essential cookies, electronic direct marketing where consent is required, and any other processing for which we request it. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation - retaining transaction records for tax and accounting and responding to lawful requests.

13.2. Your Rights

Subject to conditions and exceptions in applicable law, you have the right to: (a) access your personal data and obtain a copy; (b) rectify inaccurate or incomplete data; (c) erase your data ("right to be forgotten"); (d) restrict processing; (e) data portability - receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller; (f) object to processing based on legitimate interests, and to object at any time to processing for direct marketing, in which case we will stop; (g) withdraw consent at any time; and (h) not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. To exercise these rights, contact us at [email protected]. We will respond within one month, extendable by two further months for complex requests. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

13.3. International Data Transfers

We are based in the United States, and your personal data will be transferred to and processed in the United States and other countries that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement, as applicable) and adequacy decisions. You may request a copy of the relevant safeguards by contacting us.

14. Other U.S. State Privacy Rights

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) may have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sales of personal data, and certain profiling. You may exercise these rights using the contact methods in Section 12.3. If we decline to take action on your request, you may appeal our decision by replying to our response email with the subject line "Privacy Appeal"; if your appeal is denied, you may contact your state attorney general.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page with an updated "Last Updated" date and, where required by law or where changes are material, provide additional notice (such as email notification or a prominent Site banner). Your continued use of the Services after the effective date constitutes acknowledgment of the revised policy.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, or wish to exercise your rights, contact us:

AC Direct

Attn: Privacy Office

7319 Sandscove Court, Ste 1, Winter Park, FL 32792, USA

Email: [email protected]

Phone (toll-free): 866-862-8922

Phone (local): 407-951-8908

Hours: Monday-Friday 8am-9pm EST; Saturday 8am-8pm EST; Sunday 8am-8pm EST