Privacy

What our forms collect

When you submit the Repair, Sell, Business & Volume, or Contact form, we store your submission as an inquiry: the answers you gave on that form, your phone and/or email (at least one is required), an optional name and organization, the time, which page you were on, and a reference number we give you.

We do not record your IP address with an inquiry.

How your visit is recorded

The first time you visit this site, we record, as your inquiry attribution, the page you landed on and, if an outside site sent you here, that site’s domain (not its full address) and any of three tracking tags in the link — utm_source, utm_medium, and utm_campaign. For that attribution, we do not read or store any other part of the address bar. This happens on every first visit, not only ones that arrive through a tracking link; most visits simply have nothing to record beyond the landing page.

This is kept in your browser for 30 days from that first visit (see "What your browser stores" below) and is added to an inquiry only if you submit one.

Why we collect it

To read what you told us and get back to you. We do not use it for advertising, we do not sell it, and we do not build a marketing list from it.

Where your inquiry is stored

When you submit an inquiry, we store it in a database that Cloudflare, our hosting provider, runs on our behalf.

After it is stored, we send ourselves an email with what you told us — your contact details and your full answers — so we can follow up, delivered to our own inbox through our email provider.

If you text, call, or email us directly instead of using a form, that message goes straight to our phone or inbox and never enters this database.

Turnstile and anti-abuse

Every form on this site uses Cloudflare Turnstile to check that a submission is coming from a person, not automated abuse, before we accept it. Turnstile sends your IP address and some browser information to Cloudflare as part of that check; Cloudflare handles that under its own terms, described in its Turnstile Privacy Addendum.

We also apply a simple limit — a small number of submissions per minute — using an identifier derived from your IP address to count submissions against that limit. We do not store it with your inquiry.

• Cloudflare’s Turnstile Privacy Addendum

Analytics

We use Cloudflare Web Analytics to see which pages and referral sources get traffic and how the site is performing. It can report general information such as browser, device type, country, and page-load performance. Cloudflare states that Web Analytics does not collect or use visitors’ personal data and does not use cookies or browser storage for analytics.

We do not send form contents to Web Analytics. Analytics failing or being blocked never stops the site from working or a form from submitting.

• Cloudflare Web Analytics: what it collects

What your browser stores

While you use Repair, Sell, or Business & Volume, your browser saves your in-progress choices — such as which machine brand, condition, or region you picked — so you can pick back up where you left off. This is kept for 30 days: from your first visit for the landing-page/referrer information above, or from your last update for a path’s choices. After 30 days we simply stop reading it — your browser does not erase it for us. Clear your browser’s site data yourself to remove it sooner.

Any name, phone, email, or free text you type lives only in your browser tab for that browsing session. It is not written to that longer-lived storage, and it ordinarily disappears when you close the tab, though a browser’s "reopen closed tab" feature can bring a closed tab’s contents back.

Our own code does not set cookies. Cloudflare’s security systems run at the network edge, ahead of our code, and may set their own; we check that against the live site before every publish.

Other websites and tracking signals

The only outside scripts our own code loads are Cloudflare Turnstile, on every lead form, and the Cloudflare Web Analytics beacon described above, on the production site only. We do not load any advertising or cross-site tracking script ourselves, and our Content Security Policy is set to block the browser from loading any other outside script as well.

Cloudflare Web Analytics and Cloudflare Turnstile are Cloudflare’s own products, running under Cloudflare’s own terms and privacy statements — see the links above. We do not audit Cloudflare’s own systems, and we do not know, and do not claim to know, what any other party might do elsewhere on the web.

This site does not check for or respond to a Do Not Track or Global Privacy Control signal from your browser.

How long we keep information

Every three months, we review inquiries and delete any that are 9 months old or older, along with the notification email tied to them. That means an ordinary inquiry is deleted no more than about 12 months after you send it. This review is a manual process we run ourselves, not an automatic system.

If an inquiry leads to a repair, purchase, sale, or other business relationship, we keep records — including receipts — that we reasonably need for accounting, warranty, fraud prevention, legal obligations, or a dispute, separately from this schedule and for as long as those reasons require.

Your requests

You can ask us to see a copy of the inquiry information tied to you, correct it, or delete it. Email hello@boilerandburr.com with "Privacy request" in the subject line, and include your Boiler & Burr reference number if you have one.

Before acting on a request, we check that it comes from the same email address or phone number as the inquiry. A few limits apply: we can only find information tied to the contact details or reference number you give us; we cannot reach into your own browser and clear what it has stored (see "What your browser stores" above); we can delete a notification email but cannot edit one already sent; a copy we delete from our own systems may still exist briefly in a backup our provider keeps, which expires on that provider’s own schedule, not ours; and we may keep information we reasonably need for an actual repair, purchase, or sale, or for tax, warranty, or dispute reasons, even after a delete request.

If you separately ask us to delete direct messages — texts, calls, or emails you sent us outside the website — we do that by hand wherever none of those reasons applies. We respond to these requests as they come in; we do not yet have a fixed response-time commitment for them.

What this site does not do

We do not have customer accounts, a shopping cart, or payment processing on this website, and we do not share your information with data brokers or advertisers.

Changes to this notice

We update the date at the top of this page whenever we publish a change to it. Starting with a revision after this page first goes live, we also describe what changed in a note just below the date, for at least 30 days after that revision.