Skip to content

Penrod Construction Company

Privacy Policy

Effective September 30, 2026.

This policy describes the personal information collected by Penrod Construction Company through https://penrodconstructioncompany.com, how that information is used, who receives it, how long it is kept, and how to ask for access, a correction, or deletion. It covers visitors, people who send a project inquiry, people who create an account, and people who submit or appear in a review.

Who we are

Penrod Construction Company is a custom home builder, general contractor, construction consultant, and trim carpentry shop serving Florida and Coastal Alabama. Florida contractor license CGC1516178. The public phone number is (251) 350-0012. This website is the online home of that business. In this policy, “Penrod Construction,” “we,” and “us” mean Penrod Construction Company.

Information you give us

Project inquiries

The contact form asks for:

  • Full name
  • Email address
  • Phone number, if you provide one
  • Project type
  • Project location, chosen as Alabama or Florida
  • Estimated budget, if you select one
  • Desired timeline, if you provide one
  • The project description you write
  • Your confirmation that Penrod Construction may contact you about that project

The form cannot be sent unless that confirmation box is checked. Penrod Construction stores the inquiry in its database, assigns it a reference number, and may email a copy to the notification addresses an administrator has turned on. If email delivery is configured, Penrod Construction also sends you an acknowledgment at the email address you entered. Authorized staff can add internal notes, set a status, and assign the inquiry to an employee. Those notes are part of the inquiry record. Staff with permission can export inquiries to a spreadsheet.

Inquiry details are used to respond to and manage that inquiry. They are not added to a mailing list and they are not sold.

Accounts

If you create an account, Penrod Construction stores:

  • Your name
  • Your email address
  • A one-way Argon2id hash of your password, never the password itself
  • Whether the email address has been confirmed, and when
  • Your role, which is guest for every public signup
  • Account status, active or disabled
  • The dates the account was created and updated

A public signup or a Google sign-in never grants employee or administrator access. Only an existing administrator can assign those roles. Employee and administrator accounts also store the permissions granted to that person. You can change your name and password from the account page after you sign in. Choosing a new password requires the current password.

Email confirmation and password reset links are emailed when email delivery is configured. The link token is stored only as a hash. A reset link expires after one hour. A confirmation link expires after 24 hours. Used and replaced links are deleted.

Reviews

A review submitted through the private review link stores the name you enter, a title, the review text, a star rating from 1 to 5, the source “website,” and a status. New website reviews stay unpublished until an administrator publishes them, unless the company has turned on immediate publishing. A published review is shown on the public website with the name, title, description, stars, and the source label.

An administrator can also type a review by hand, hide it, or delete it.

Information collected while you use the site

Penrod Construction does not run a visitor analytics product, and ordinary browsing does not create a profile of the pages you open.

The site does store a short-lived abuse-prevention record when someone:

  • Submits the contact form
  • Submits a review
  • Tries to sign in

That record contains a key built from the network address in the request, or from the email address used at sign-in, plus a count and the time the limit resets. Contact and review attempts are limited to 5 in an hour. Sign-in attempts are limited to 8 per email address and 20 per network address in 15 minutes. These records are used only to slow repeated submissions. They are not used for advertising.

A hidden field on the contact form and the review form is used to discard automated submissions. A completed hidden field is not saved as an inquiry or a review.

When Cloudflare Turnstile is configured, the form sends a spam-check token to Cloudflare. Penrod Construction uses Cloudflare’s yes-or-no result and does not store the token. When Turnstile is not configured, that check is skipped.

The website is reached through the host and, on the public domain, through Cloudflare. Those providers process connection data such as IP address, browser, and the requested address in order to deliver and protect the site. Penrod Construction’s own application does not keep a log of every page view.

Information from other services

Google sign-in

Google sign-in is offered only when Penrod Construction has configured it. If you choose it, Google tells Penrod Construction your name, email address, and profile image. Penrod Construction does not receive your Google password. The resulting account is a guest account. If you already have an account with that email address, Google sign-in can be used for that account only when the account is not disabled.

Facebook reviews

If an administrator connects a Facebook Page, Penrod Construction can copy reviews from that Page. Each imported review may include the review text, the star rating or recommendation, the reviewer’s name, the time Facebook recorded, and a Facebook identifier used so the same review can be updated instead of duplicated. A published Facebook review appears on the website with the name, title, description, stars, and the source label Facebook. The Page access token stays in the server environment and is not stored in the database.

Photographs uploaded by staff

Employees upload project and page images through the dashboard. The image file is stored on the website server. Penrod Construction’s database stores the image address, file type, size, dimensions, title, alt text, and the account that uploaded it. These are company photographs, not files submitted by site visitors.

Why each category is used

  • Inquiries are used to answer you, keep a record of the request, notify the people assigned to new inquiries, and, if you hire Penrod Construction, carry the conversation into the project. The legal basis is your request that Penrod Construction consider the project, the confirmation you check on the form, and the company’s interest in responding to work it was asked to consider.
  • Accounts are used to sign you in, confirm your email, reset a password, and limit the dashboard to people the company has authorized. The legal basis is the account you asked Penrod Construction to create.
  • Reviews are used to display client feedback the company chooses to publish. The legal basis is the review you submitted, or the company’s decision to display a review already posted on its Facebook Page.
  • Abuse-prevention records and spam checks are used to keep forms and sign-in from being flooded. The legal basis is the company’s interest in keeping the site available.
  • Staff audit records store who published a page, changed a role, deleted media, exported inquiries, or managed reviews. The legal basis is the company’s interest in knowing which employee made those changes.

Penrod Construction does not use this information to make automated decisions that produce legal or similarly significant effects. Penrod Construction does not ask for Social Security numbers, payment card numbers, government identification, precise GPS location, health information, or biometric identifiers through this website.

Who receives personal information

Personal information is available to Penrod Construction staff whose role allows them to see it. It is also processed by service providers that host or deliver the site:

  • The database host, MongoDB Atlas, stores the records described in this policy.
  • The server that runs the website processes requests and holds the session secret.
  • Cloudflare delivers the public site and, when Turnstile is turned on, performs the spam check.
  • Resend sends inquiry notifications, inquiry acknowledgments, email confirmations, and password resets when an administrator has configured email. Until then, messages are saved and marked unconfigured, and no email is sent.
  • The website server stores uploaded image files.
  • Google receives the sign-in request when you choose Google.
  • Meta receives the request for Page reviews when an administrator runs a Facebook sync.

These providers process the information so Penrod Construction can operate the website. Penrod Construction does not sell personal information and does not share it for cross-context behavioral advertising. Penrod Construction may disclose information if a law, court, or regulator requires it, or if disclosure is needed to protect the company, its clients, or the site from fraud or abuse.

What appears in public

Published reviews are visible to anyone who visits the website. Team profiles are public only after an employee publishes them. A profile can include a name, title, biography, photograph, and links. An email address on a profile is shown only when the company chooses to show it. Project pages show the text and photographs the company publishes. Draft projects, draft profiles, unpublished reviews, inquiries, account passwords, and dashboard records are not public.

Cookies and storage in the browser

Signing in sets a session cookie so the site can recognize you. The session lasts 12 hours. The cookie carries a signed token with your account id, role, and permissions. It is used to keep you signed in and to restrict the dashboard. Signing out ends that session.

The public marketing pages do not set an analytics cookie or an advertising cookie. The website builder stores one flag in the browser, on that employee’s computer, to remember that the editor tour was dismissed. Cloudflare may set its own cookies in order to route and protect traffic.

How long information is kept

  • Inquiries, staff notes, and email delivery records are kept so Penrod Construction can respond and keep a record of the request. They remain until the company no longer needs them for that purpose, or until a verified deletion request is completed. If an inquiry becomes a construction contract, the related records may be kept for as long as needed to perform the work and to meet licensing, tax, insurance, warranty, and dispute requirements.
  • Accounts are kept while the account is active. A disabled account remains so the company can prevent reuse of that login. You may ask for an unused guest account to be deleted.
  • Password reset and email confirmation tokens expire on the schedule above and are deleted when they are used or replaced.
  • Reviews stay in the database while they are pending, published, or hidden. An administrator can delete a review.
  • Abuse-prevention counters remain in the database so the limits above can be enforced. They are not kept as a browsing history.
  • Audit records of staff actions are kept so the company can review who changed the site.
  • Uploaded images remain until an employee deletes them from the media library, which also removes the file from the server.

How information is protected

Passwords are stored as Argon2id hashes. Reset and confirmation tokens are stored as hashes. The dashboard is limited to signed-in employees and administrators, and sensitive actions are checked against the current account in the database. The public site is served over HTTPS. No method of storage or transmission is perfect, and Penrod Construction cannot promise that unauthorized access is impossible.

Your requests

You may ask Penrod Construction to:

  • Tell you what personal information it holds about you
  • Correct information that is wrong
  • Delete information, including an inquiry or a guest account
  • Give you a copy of the inquiry or account information you submitted
  • Stop contacting you about an inquiry
  • Review a refusal of one of these requests

Send the request through the contact form at https://penrodconstructioncompany.com/contact or call (251) 350-0012. Describe the request as a privacy request and include the email address or inquiry number involved so the right record can be found. Penrod Construction may ask for enough information to confirm that the request comes from the person the record is about. A deletion request will be refused only where Penrod Construction must keep the record for a contract, a licensing or tax duty, or a legal claim.

If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with the supervisory authority where you live. The purposes and bases in this policy are the ones Penrod Construction relies on for those requests.

Personal information is not sold. Penrod Construction will not discriminate against you for making a privacy request.

Children

This website is a business site for people planning construction work. It is not directed to children under 13, and Penrod Construction does not knowingly collect personal information from children under 13. If you believe a child submitted personal information, contact Penrod Construction and the record will be deleted.

Where information is processed

Penrod Construction operates in Florida and Coastal Alabama. The database, email, image host, sign-in provider, Facebook, and Cloudflare may process information in the United States and in other countries where those companies operate. Those transfers happen so the website can run.

Changes to this policy

Penrod Construction will post changes on this page and change the effective date. A change that uses inquiry information for a new purpose will be described here before that use begins, and Penrod Construction will ask again where the law requires a new consent.

Contact

Privacy requests and questions go to Penrod Construction Company, (251) 350-0012, or through the contact form at https://penrodconstructioncompany.com/contact. License CGC1516178.