How we handle your information.
A custom home project involves a great deal of personal detail: where you are building, what you can spend, how you want to live. This policy sets out exactly what we collect, why we hold it, who else sees it, and what you can ask us to do about it.
Last updated October 19, 2026
Who this policy covers
This policy explains how Tropical Tides Custom Homes handles personal information collected through tropicaltidesnc.com, including the project inquiry form, the client workspace, and ordinary correspondence by email and phone. Tropical Tides Custom Homes is a design and construction practice based in Southport, North Carolina, working primarily in Brunswick, New Hanover, and Pender Counties.
It applies to prospective clients who contact us, to active clients using the workspace, and to anyone browsing the public pages of the site. It does not cover third-party websites we link to, including our social media profiles, which are governed by their own policies.
Information we collect
Information you give us directly
The project inquiry forms ask for your name, phone number, email address, and project location, and record that you agreed to be contacted and when. If you tick the optional box asking for email updates, the form records that as well, with the time. After you send one, an optional second step asks about the property, the house you have in mind, your budget range, your timeline, who else is involved and how you plan to finance the build, how you prefer to be reached, how you heard about us, and anything else you want to tell us in your own words. Sending an inquiry is your choice, and every answer in the second step is optional.
If you call or email us, we keep that correspondence as part of the project record. If you send us documents such as surveys, plans, covenants, or lender letters, we retain them so the design work can proceed.
Client workspace information
Clients with workspace access have an account secured by a password we store only as a hash, never in readable form. Inside the workspace we hold the material that makes up the project record: drawings and document versions, selection and decision history, message threads, milestone dates, and the identity and timestamp attached to each of those entries. That attribution is the point of the workspace, and it is visible to you and to the Tropical Tides team working on your project.
Information collected automatically
Public pages load Google Analytics, which sets cookies and records pages viewed, approximate location derived from IP address, referring source, and general device and browser characteristics. Analytics does not run on the client workspace, the project manager workspace, the admin workspace, the trade partner pages, the sign-in pages, or the pages our emailed links open; those surfaces are excluded in the site’s code.
The same public pages load the Google Ads tag. When you arrive from one of our Google ads, it sets a cookie that lets Google count whether that visit ends in a submitted inquiry or a click on our phone number or email address. It is excluded from the same workspaces as analytics, and ad personalization is turned off.
The same public pages load the ChatGPT Ads pixel from OpenAI. It sets a cookie that gives this browser a random reference on our site for up to a year, and sends that reference with everything it reports. When you arrive from one of our ads in ChatGPT, it sets a second cookie that keeps an identifier from that ad click for 30 days. The pixel tells OpenAI the address of each page it loads on, and reports a submitted inquiry or a click on our phone number or email address, along with the page it happened on and the page before it. After you send an inquiry form, what it reports also carries a hashed copy of the name, email address and phone number on the form, and, on forms that ask for the town, the town itself, unhashed. A hash is a one-way code made from each detail. OpenAI uses these codes to match inquiries to our ads when no ad-click identifier is present. Every submitted inquiry is reported this way, whether or not you came from an ad. The pixel is excluded from the same workspaces as analytics.
The same public pages load the Microsoft Advertising tag, called UET. It tells Microsoft the address of each page it loads on and the page before it, along with the page title, the browser language and the screen size, and reports a submitted inquiry or a click on our phone number or email address. It sets cookies on this site that tie the pages of a visit together for a day and recognize the same browser until 390 days after your last visit. When you arrive from one of our Microsoft ads, on Bing for example, it sets a third cookie that keeps an identifier from that ad click until 90 days after your last visit. It keeps a copy of each of these cookies in the browser’s local storage. Microsoft also receives your IP address and its own cookies, including one that expires after 13 months. After you send an inquiry form, the tag makes a hash of the email address and phone number on the form in your browser, and only the hashes go to Microsoft with its report of that inquiry. Every submitted inquiry is reported this way, whether or not you came from an ad. Microsoft’s UET Insights feature is turned on for our tag: it records clicks, scrolling, time on the page, which form was sent (without what was typed into it), and browser and device details, and for about one visit in a hundred, a one-time copy of the page’s text with numbers and email addresses removed. The tag is excluded from the same workspaces as analytics.
The public marketing pages also load Microsoft Clarity. It records how a page is used, including clicks, taps, scrolling and mouse movement, and turns that into heatmaps and session recordings that show us where a page is hard to use. It sets cookies that tie the pages of a visit together and recognize the same browser when it comes back, and Microsoft’s own cookies can recognize that browser on other sites, including for advertising. The inquiry forms are masked, so the recordings do not show what you type into them or the thank-you message that repeats your name. Clarity does not run on the workspaces, the trade partner pages, the sign-in pages, or the pages our emailed links open.
Our hosting and content delivery providers keep standard server logs, which include IP addresses, request times, and user agent strings. Signed-in sessions rely on a first-party session cookie that identifies your session to the application. It is required for the workspace to function and is not used for advertising.
How we use information
We use the information described above to operate the design and construction relationship and for no unrelated purpose. Specifically:
- To respond to project inquiries and determine whether a project is a fit for the practice.
- To perform the work: site analysis, design development, documentation, procurement, and coordination with the partners who execute construction.
- To operate the client workspace, including authentication, document access, decision records, and message threads.
- To keep an accurate project record so that decisions, versions, and approvals can be traced later.
- To send you information about your own project. We also send occasional email updates about Tropical Tides to people who tick the optional updates box on an inquiry form and to people we have worked or talked with about a project. Every update carries an unsubscribe link. When you unsubscribe, we keep your address on a do-not-email list so the updates stay stopped until you ask to rejoin.
- To understand which pages of the public site are useful, in aggregate, through analytics.
- To count, in aggregate, how many inquiries and phone or email clicks come from our Google ads, our Microsoft ads and our ads in ChatGPT.
- To see where visitors get stuck on the public pages, through Microsoft Clarity heatmaps and session recordings.
- To meet legal, licensing, insurance, tax, and building-code obligations that apply to a licensed North Carolina residential contractor.
We do not sell personal information. We do not share it with data brokers, and we do not use it to build advertising profiles. Microsoft’s own use of what Clarity and its advertising tag collect, and OpenAI’s own use of what its pixel reports, are described under Sharing.
How long information is kept
Inquiries that do not become projects are retained while there is a realistic prospect of working together, then removed on request or in the ordinary course of cleaning up records.
Project records are kept substantially longer, and deliberately so. Drawings, specifications, decision history, and correspondence are the evidence of what was designed, chosen, and built. North Carolina construction claims can arise years after completion, and warranty, insurance, licensing, and tax obligations all depend on those records existing. We keep them for the period those obligations require, and generally for the life of the structure where the record documents how the building was assembled.
Analytics data is retained according to the retention period configured in Google Analytics. In our Clarity account, recordings are kept for 30 days, and heatmaps, saved recordings and a random sample of recordings for up to nine months. Microsoft Advertising keeps what its tag collects for 390 days, and the hashed contact details for 30 days. Server logs rotate on our providers’ standard schedules.
How information is protected
Traffic to the site is encrypted in transit over HTTPS. Passwords are stored as hashes, not as recoverable text. Database connections are made over TLS.
Access to project material is enforced in the application on every request, not merely hidden in the interface: document downloads, message threads, decision records, and every data mutation check the requesting account’s role and its membership on that specific project before returning anything. The public marketing pages, the client workspace, the project manager workspace, and the admin workspace are separate surfaces with separate access rules.
No system is perfectly secure, and we do not claim otherwise. If you believe your account has been compromised, contact us immediately using the details below and we will disable the session and issue new credentials.
Your choices and rights
You can ask us to do any of the following, and we will respond within a reasonable period:
- Tell you what personal information we hold about you.
- Correct information that is inaccurate or out of date. Workspace users can update their own contact details directly in account settings.
- Delete information, subject to the record-keeping obligations described under retention. We will explain what we must keep and why.
- Provide a copy of the project material associated with your project.
- Stop contacting you, other than where communication is necessary to an active project or required by law.
Depending on where you live, you may have additional statutory rights over your personal information. Tell us what you are asking for and we will honor the request to the extent the law provides, without requiring you to name a particular statute.
Children’s privacy
This is a service for people commissioning residential construction. The site is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will remove it.
Changes to this policy
When this policy changes, the revised version is posted here and the date at the top of the page is updated. Material changes affecting active clients will also be communicated through the workspace or by email.
How to reach us
Questions about this policy, or any request described above, can go to sales@tropicaltidesnc.com or 910-946-5512. Tropical Tides Custom Homes is based in Southport, North Carolina and holds North Carolina Residential Contractor License #109520.