Your reading should not become a sales ambush.
This site is publicly accessible. This notice describes the current repository implementation; it has not been fully reconciled with live vendor settings. Publisher identity, mailing address, retention periods, and the handling of privacy requests still require owner confirmation against actual operations.
Review record
- Author
- Understanding Roofing. No individual author is credited yet.
- Legal review
- Not completed. This notice has had no review by a qualified adviser.
- Publisher entity
- Not supplied in the publisher record. Legal entity and mailing address remain unverified.
- Last substantive update
- 2026-09-08. Current-code description corrected; production settings remain unverified.
- Next review due
- Overdue for the publicly accessible site. Owner and qualified adviser must confirm operational details.
This disclosure is incomplete while publisher and operational details remain unverified. See the editorial policy for how corrections to this page are handled.
Optional analytics
Google Tag Manager is configured for Basic Consent Mode: the analytics container is not requested until a visitor allows analytics. After consent, the site may measure query-free page views and referrers; coarse section, scroll, active-reading, navigation, and call-to-action milestones; worksheet progress and whether print preview opened; destination paths or an external site’s hostname; coarse calculator material, area, cost, pitch, complexity, and input-status bands; form type, stage, outcome, and controlled error code; and the page-performance measurements described below. Exact checklist item states, calculator entries, and estimates stay local. Names, email addresses, phone numbers, street addresses, raw form values, exact project locations, Turnstile tokens, query strings, fragments, and credential-bearing URLs must never enter GTM or GA4.
Advertising storage, ad user data, and ad personalization are denied at all times in the current code, including after a visitor allows analytics. Before consent, page views and interactions are dropped and GTM itself stays unloaded, so GA4 receives no denied-state cookieless ping. Your choice is stored only in this browser and applied to the local data layer; a denial is not sent to GA4 as an analytics event.
The one thing that is measured before you choose
Page-performance measurements are produced by the first paint, before any consent decision can exist. Up to twelve of them are held in the page’s memory rather than discarded: each is a metric name, a number, and a good, needs-improvement, or poor rating, and none of them describes who you are or what you typed. They are sent only if you then choose “Allow analytics” during that visit. Choosing essential only discards them, and so does closing the page. Nothing leaves your browser in between.
What this site stores on your device
The consent code stores your choice in browser local storage after you choose. It also attempts to expire accessible Google Analytics cookies when consent is withdrawn. Saving a lesson creates a separate local bookmark list. Calculator and worksheet entries stay in page memory.
| Name | Type | Purpose and values | Lifetime |
|---|---|---|---|
| understanding-roofing-analytics-consent | Local storage, first party | Records your analytics choice as the literal value “granted” or “denied”. Written only when you answer the consent dialog, and read on each page load to restore that choice. It stays on your device and is never sent to our server. | Until you clear site data for this domain |
| roofing-saved-lessons-v1 | Local storage, first party | Stores the title and path of lessons you choose to save in this browser. It is not sent to the site or synced between devices. Remove an individual bookmark with “Saved” or use “Reset saved lessons” on the learning page. | Until you remove saved lessons or clear site data |
| Google Tag Manager and Google Analytics | Third-party cookies and storage | Loaded only after you allow analytics. Google documents the usual GA4 first-party cookies as _ga and a property-specific _ga_<container-id>; they distinguish browser sessions and users for measurement. The container denies Google Signals, advertising storage, ad user data, and ad personalization. | Google documents a two-year default, refreshed on use; browser settings and later configuration can shorten it. |
| Cloudflare Turnstile | Third-party storage | The human-verification widget loads only where an email form is present and only when a site key is configured. What it stores is controlled by Cloudflare and is not documented here yet. | Not documented yet |
Email and buying guides
Newsletter enrollment is paused until an address-confirmation flow and durable consent records are available. The newsletter area does not accept an address. The buying-guide form requests an email address and optional first name only to send the requested resource. You can also read the buying kit directly without providing an email address.
What a submission actually sends today
- Your email address, and a first name if you choose to give one.
- The form type and a false newsletter-consent value. Older clients may send a newsletter request, but the current endpoint does not enroll it.
- A hidden timestamp for when the form was opened, used to reject scripted submissions.
- A Cloudflare Turnstile verification token.
The request goes to this site’s endpoint, which checks the human-verification token when configured. The implementation uses Cloudflare for human verification and hosting-related request processing, and Resend to send the requested buying-kit email. It does not create newsletter contacts, update mailing-list preferences, or reactivate unsubscribed addresses. A successful response means the provider accepted the send request; it does not establish inbox delivery. Cloudflare receives connection information, and the server uses the connecting IP address for configured verification and abuse checks. Delivery failures are logged as a stage and controlled error code without the submitted address. Provider retention, deletion procedures, and actual deployment settings remain unverified.
Installer sharing
No contact or project information will be sent to installers without a later, separate consent flow that identifies what will be shared, with whom, and why.
Your choices and requests
Use the “Privacy choices” control at the foot of any page to allow or deny optional analytics; it opens the consent dialog and applies your choice. If you turn analytics off after Google Tag Manager has loaded and the browser can save that choice, the page reloads once to remove the running container, then returns with analytics off. The choice also synchronizes across other open tabs. If storage is blocked, the dialog says that the choice is visit-only and the site will not risk reloading into an older stored grant. Clearing site data in your browser removes the key and returns the site to its denied-by-default state. Newsletter enrollment is currently paused.
Global Privacy Control
If your browser sends a Global Privacy Control signal, this site treats it as a request to keep optional analytics off. The signal is read before any stored choice is, so it also overrides a stored “Allow analytics” for as long as your browser sends it. The stored value is left in place rather than erased: turning the signal off restores the choice you made instead of silently discarding it. There is no control here to override the signal, and the consent dialog does not offer you one — it says the signal is being honored instead.
Access, correction, and deletion
The listed contact is hello@understanding-roofing.com; mailbox delivery and staffing have not been verified. You can clear the consent key through your browser. Provider-held data requires action by the account operator, and deleting a contact may not remove delivery records or suppression data. A verified request process, response window, and retention schedule have not been documented.
What this notice does not cover yet
- The Global Privacy Control signal is detected and honored as described above, but whether that satisfies every state’s opt-out mechanics—an authorized-agent route, a “Do Not Sell or Share” link, or a specific response window—has not been checked by a qualified adviser.
- There is no named legal entity, mailing address, data-protection contact, or governing-law statement.
- Retention periods, sub-processor list, and international transfer terms are not stated.
- The site is not offered to children, and no age-verification mechanism exists.