Privacy Policy
Effective: 31 July 2026 · Last updated: 31 July 2026
This page explains what openshowerco.com collects about you, why, who else ends up seeing it, how long we keep it, and how to make us delete it. We have written it in plain English and we have not left out the awkward parts.
The short version
- We collect what you type into our forms, plus ordinary information about how you use the site.
- We do not sell your information. We never have and we do not intend to.
- We do rely on other companies to run this site — an email relay, a payment processor, analytics, a mapping lookup. Section 4 names every one and says exactly what reaches each.
- You can ask us to show you what we hold, correct it, or delete it. Email start@openshowerco.com and we will do it within 30 days.
What's in here
1. Who we are
This site is operated by Open Construction, LLC, doing business as The Open Shower Co., of 7385 State Rt 3, Unit #306, Westerville, OH 43082. We are a bathroom and shower remodeling company working in Central Ohio.
We are the ones responsible for the information described here. If you want it dealt with, section 12 tells you how to reach a human.
2. What we collect, and where it comes from
Things you type
| Where | What |
|---|---|
| Homepage quote form | First and last name, phone, email, project type, street address, and your description of the project. City is optional. You may attach up to 5 photos or PDFs. |
| Estimate Builder | The choices you make — bathroom size, project scope, products. To unlock the full breakdown: name, phone, email, and a username and password. City, address, notes and photos are optional. |
| Portal account | Name, phone, email, username, password. City, address and notes optional. |
| Design Studio | A photo of your bathroom and your design choices. After two free designs, your name and email; phone and city optional. |
| Store checkout | Name, email, phone, and a delivery address where one is needed. Notes optional. |
| Consultation booking | Your chosen time, attached to your account. |
| Chat | Whatever you type. If you ask for a person, your name and how to reach you. |
| Project photos | Progress or warranty photos you upload to your own project. |
Your password is never stored. It is converted by a one-way process (bcrypt) into something that cannot be turned back into your password. Nobody here can read it, and we will never email it to you or ask you for it.
Things collected automatically
- How you use the site — pages viewed, how far you scrolled, how long you engaged, which estimate options you selected, which price range you were shown, and whether you completed a form.
- How you arrived — the site that referred you, and any campaign or advertising tags in the link you followed.
- Your device — browser, operating system, device type and screen width, worked out from what your browser tells every website. We do not fingerprint your device. There is no canvas, font or hardware fingerprinting on this site.
- A visitor ID and a session ID — random numbers in cookies that let us count one person visiting three times as one person, not three.
About your IP address. For our own analytics we never store it. It is converted immediately into a one-way scrambled value used only to stop abuse, and the original is discarded. We do keep the real IP address in a few narrow places: the last address you logged in from, the address behind a Design Studio render, a staff access log, and the short-lived counters that stop our forms being abused — logging in, asking for a password reset, signing up, the address lookup, photo uploads and store checkout. Those counters exist to slow down attacks, and nothing in them is used to build a picture of you.
Being straight with you about one thing. The anonymous browsing described above is linked to a visitor ID before we know who you are. If you later submit a form, that earlier browsing becomes connected to your name. We do this to understand which parts of our own marketing work — not to build a profile to sell. But you should know it happens, because most sites do not say so.
3. Why we collect it
- To answer you — quote you, price your bathroom, reply to your question, book your consultation.
- To do the work — plan your project, produce proposals, invoice you, keep your records for your warranty.
- To run the store — take orders, take payment, arrange pickup or delivery.
- To keep accounts safe — log you in, stop brute-force attempts, block spam.
- To understand our own marketing — which channels bring real customers, so we spend money sensibly.
- To meet our legal and tax obligations.
We do not use your information to make automated decisions about you, and we do not use it to set your price. Our prices are published on the site and are the same for everyone.
4. The other companies involved
We do not sell your personal information, and we do not share it for anyone else's advertising. But this site could not run without some other companies, and being vague about that would be dishonest. Here is every one and exactly what reaches it.
| Company | What reaches them | Why |
|---|---|---|
| FormSubmit | Your full form submission — name, email, phone, address, project details — and links to any photos you attach, rather than the photos themselves. Also chat handoffs including the conversation, order details, consultation details, and Design Studio enquiries. | It delivers our forms to our inbox. Practically speaking, everything you send us passes through it. |
| Intuit (QuickBooks & QuickBooks Payments) | Your card details go from your browser directly to Intuit — they never reach our server. Also your name, email, phone, billing address and the amounts, so we can invoice you and keep our books. | Taking payment and accounting. |
| Google Analytics | Pages viewed, scroll depth, time engaged, and that a form was submitted. Not your name, email, phone or address — the site actively blocks those from being sent. | Understanding how the site is used. Runs on our public pages, not inside your account area — and not at all if you have opted out in section 9 or your browser sends Do Not Track, in which case Google's script is never even requested. |
| Google Fonts | Your IP address, on every page — this is unavoidable when a browser loads a font from Google's servers. | The typefaces the site is set in. |
| Google (Gemini) | Only the bathroom photo you chose to upload, with its location data already removed, plus a description of your design choices. No name, email, phone or IP address. | Generating your Design Studio image. |
| US Census Bureau | The address you are typing, as you type it, before you submit anything. | Suggesting and checking addresses so yours is right. |
| Google Calendar | If we subscribe our own calendar to our booking feed, your consultation details — name, phone, email, city, project — are read by Google's servers. | Putting your appointment on our calendar. |
| Stripe | Nothing today — it is built in but switched off. If we turn it on, card payments would go to Stripe's own hosted page and we would update this policy first. | An alternative card processor. |
Each of these companies handles your information under its own privacy policy, which we do not control.
We may also disclose information where the law requires it, to protect someone's safety, to enforce our terms, or to a professional adviser such as our accountant or attorney. If our business is ever sold or merged, customer records would transfer with it, and we would tell you first.
5. Photographs of your home
Photos deserve their own section, because they are the most personal thing this site asks for. There are three ways to send us one, and they are kept for different lengths of time.
Design Studio photos
- Location data is removed before the image is stored or sent anywhere. Phone photos usually carry the GPS coordinates of where they were taken; we strip that.
- They are stored on our server with a long random filename, and deleted after about 30 days.
- They are sent to Google's image service to produce your design, without any of your contact details attached.
- Anyone who has the exact image link can open it. The link is unguessable, but it is not password-protected — so please do not post it publicly.
Photos attached to the quote form or the Estimate Builder
- Location data is removed twice — once by your own browser before the photo is uploaded, and again by our server when it arrives. Phone photos normally carry the GPS coordinates of the house they were taken in. For any photo we can process, those coordinates never leave your device — with one exception, below.
- They are stored on our own server, under a long random filename, so we can price your project properly.
- The email that reaches us contains links to those photos, not the photos themselves. Anyone holding an exact link can open it — the link is unguessable, but it is not password-protected, so please do not post one publicly.
- One exception, and we would rather tell you than not. A few formats — chiefly Apple's HEIC on a non-Apple device, and PDFs — cannot be re-processed by every browser. When that happens we store the file exactly as you sent it, including any location data. You are told on screen before you submit, and can remove the file. Our own copy of the message flags it too, so we know.
Project photos in your account
Photos you upload to your own project have their location data removed, are stored where only you and our team can reach them, and are kept for the life of your project and its warranty.
6. Cookies and what's stored in your browser
We use a small number of cookies. We do not use advertising cookies of our own.
| Name | What it does | How long |
|---|---|---|
OSCSESS | Keeps you logged in. Essential. | Until you close the browser, or 2 hours idle |
osc_v | A random visitor ID so repeat visits count as one person | 400 days |
osc_s | A random ID for the current visit | 30 minutes |
osc_optout | Remembers that you turned analytics off (or that you said it was fine). This is the one cookie that exists to reduce what we collect, so it is set whichever way you answer. | 400 days |
_ga, _ga_* | Set by Google Analytics. Never set at all once you have turned analytics off — the Google script is not loaded in the first place, so there is nothing to set it. One left over from before you opted out will just sit there unused; clearing your browser data removes it. | Google's own periods, typically 2 years |
Your browser also stores a few things locally so the site is less annoying: your shopping cart, your estimator selections, your chat conversation for the current tab, and — if you have unlocked an estimate — your name, email and phone so you are not asked twice. That information stays on your device. Clearing your browser data removes all of it.
The notice you may have seen at the bottom of the page
On your first visit, a small card appears in the bottom corner. It says we use a few cookies to see how the site is used, links here, and offers you two buttons: No thanks and OK.
- "No thanks" really does switch analytics off. It is not a preference we file away and think about later — the measuring code stops on the spot, the Google script is never loaded again, and nothing further is sent from your browser. Section 9 has the same switch, permanently, if you want to change your mind either way.
- "OK" simply closes it and we carry on as described above.
- Either way we never show it to you again, on any page, on this browser.
- You never see it at all if your browser already sends Do Not Track or Global Privacy Control. You answered that question before you arrived, and asking again would be pestering you.
What we deliberately have not built is a wall. Nothing is blocked, nothing greys out, and no button is hidden behind a dialog you have to clear first. Most of our customers are in their sixties, seventies and eighties, and a full-screen consent box between someone and a bathroom quote is a barrier dressed up as a courtesy. The card is small, it does not cover the buttons underneath it, it does not move the page when it appears, and the Escape key closes it.
If you would rather block cookies altogether, every browser can, and this site will still work — you may just have to re-enter your details.
7. How long we keep things
| What | How long |
|---|---|
| Your account, proposals, invoices and project records | For as long as you have an account, and afterwards as long as we need for warranty, tax and legal reasons |
| Enquiries and quote requests | Kept indefinitely, so we can pick up where we left off if you come back |
| Design Studio photos and renders | About 30 days, then deleted |
| Photos you attach to a quote request or estimate | Taken off the website after 90 days, so the link stops working. We keep a copy in our own records after that, because your photo is what your price was worked out from — archived rather than deleted, and we would rather say so than imply it is gone. Ask us and we will delete it outright. |
| Store orders | Kept for accounting and warranty purposes |
| Analytics about visits | 400 days. Visits that turned into an enquiry are kept longer, tied to that enquiry |
| Rate-limit counters behind our forms, including failed logins | 24 hours |
| Password reset links | 30 minutes, and single-use |
| Our record that you asked us to see, correct or delete your information | Kept indefinitely. It holds your name, email address, what changed and when — it is our proof that we did what you asked |
8. How we protect it
Only what we actually do — we have not listed protections we do not have:
- The whole site is served over an encrypted connection, and requests for the insecure version are redirected.
- Passwords are stored as one-way bcrypt hashes, upgraded automatically as standards improve.
- Password reset links are single-use, expire in 30 minutes, and are stored only as a hash.
- Logins are rate-limited to blunt guessing attacks, and forms are rate-limited against abuse.
- Every action that changes something is protected against cross-site request forgery.
- Uploaded files are checked by content rather than filename, re-encoded, and stored so they cannot be executed.
- Access is role-based and enforced on the server, not just hidden in the interface.
- Our database sits outside the public web folder and is blocked from the web besides.
- We never see or store your card number. It goes from your browser to our payment processor. Our records keep only the card brand and last four digits.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your information, we will tell you and the authorities as the law requires.
9. Your choices and your rights
Whatever state you live in, we will honour these:
- See it — ask what we hold about you and we will send you a copy.
- Correct it — tell us what is wrong. Account details you can edit yourself in the portal.
- Delete it — ask and we will delete what we are not legally obliged to keep. Most of what must stay does not stay attached to you: invoices, payments, orders and the record of the work keep their figures but lose your name, email, telephone number and address. Two things stay in full — a contract you signed, and the address of a completed or contracted job, because a warranty is against a particular installation at a particular house. We will tell you exactly what we kept and why.
- Opt out of analytics — use the switch below. It works immediately, it does not need our permission, and you do not have to ask anyone.
- Stop hearing from us — just say so. We do not run a marketing mailing list; email from us is about your project or your order.
Email start@openshowerco.com. We will confirm within 5 business days and complete it within 30 days. We may need to check you are who you say you are before handing over personal records — that protects you.
We do not charge for any of this, and asking will never affect your price, your project or your warranty.
Turn analytics off
Loading…
Your browser's own setting works too, and it outranks everything here. If you switch on Do Not Track or Global Privacy Control, we honour it: no measuring code runs, the Google Analytics script is never loaded, and our server does not hand out a visitor ID either — it sees the same signal in the request your browser sends, before any of our code has run. You do not have to tell us, and you do not have to trust us to throw anything away afterwards — the point of doing it this way is that nothing is sent in the first place, which you can check for yourself in your browser's own network view.
A tracker blocker has the same effect. And if none of that suits you, email start@openshowerco.com and we will add an exclusion by hand.
One honest limitation. Your choice is remembered in the browser you made it in, for 400 days. It does not follow you to a different browser, a different device, or a private window — nothing that respects your privacy could, because knowing it was you across all of them is exactly the thing you asked us not to do. Clearing your browser data also clears the choice, and the notice will ask you once more.
10. Children
This site is meant for adults and is not directed at children. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, email us and we will delete it promptly.
11. Changes to this policy
When our practices change, this page changes — and we will update the "Last updated" date at the top. If a change is significant, we will make it obvious rather than quietly editing the page.
We will not apply a new use to information we already hold without telling you first.
12. How to reach us
- Email: start@openshowerco.com
- Chat: the chat button on any page
- Post: Open Construction, LLC, dba The Open Shower Co., 7385 State Rt 3, Unit #306, Westerville, OH 43082
A real person reads these, and we reply within one business day.