Privacy Policy

Effective date: July 10, 2026 · Last updated: July 10, 2026

This Privacy Policy describes how Carports and More, Inc., doing business as Steel and Stud (“Steel and Stud,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit steelandstud.com (the “Site”), request a quote, design a building in one of our 3D design tools, place a reservation, or otherwise interact with us. It also explains the privacy choices and rights available to you, including rights under U.S. state privacy laws.

1. Who we are

The Site is operated by Carports and More, Inc., an Arkansas corporation doing business as Steel and Stud, operating since 2004.

• Mailing address: 105 Cullen Hills Dr, Bella Vista, AR 72715, USA
• Phone: 1-877-275-7048
• Email (privacy requests): info@steelandstud.com (subject “Privacy Request”)
• Email (orders): orders@steelandstud.com

2. Information we collect

2.1 Information you provide to us

• Quote and contact requests: first and last name, email address, phone number, ZIP code, building type and dimensions, project details, and anything else you include in a message.
• Reservations and orders: the building configuration you reserve, delivery/installation address, order communications, and payment-related details you provide by phone (we do not collect card numbers on the Site — deposits and balances are handled by phone with our specialists and the manufacturer).
• Account information: if you create an account, your login email and order history.
• Reviews, photos, and communications: content you submit for our gallery, testimonials, or reviews, and records of your correspondence with us.

2.2 Information collected automatically

When you use the Site, we and our service providers automatically collect:

• Device and usage data: IP address, approximate (city/region-level) location derived from IP, browser and operating system, device type and screen size, referring pages, pages viewed, links clicked, time on page, and error events.
• Session recordings and interaction data: through PostHog session replay we record your visit as it happens — mouse movement, scrolling, clicks and taps, pages viewed, and text you type into fields on the Site, including our quote and contact forms (for example your name, email address, and phone number), even before you press Submit. Password fields are always masked and never recorded. Recordings are used as described in Section 3.
• Cookies and similar technologies: small files and identifiers described in our Cookie & Tracking Policy, including Google Analytics cookies, Google Ads cookies, PostHog identifiers, and WooCommerce cart cookies.

2.3 Information from other sources

• 3D building designers: our “Design in 3D” tools are hosted for us by third-party providers (Sensei 3D at carportsandmore.sensei3d.com; ACT Building Systems at carportsandmore.actbuildingsystems.com; Easy Building Designer at carportsandmoreinc.easybuildingdesigner.com). When you design a building or request a quote inside those tools, the design details and contact information you enter are collected there and shared with us so we can prepare your quote.
• Manufacturers and installers: order status, delivery scheduling, and installation details for your building.
• Financing / rent-to-own providers: if you apply for financing or rent-to-own, the provider handling your application tells us whether it was approved so we can process your order. Applications are between you and the provider and governed by the provider’s own privacy policy; applying does not affect your credit until approval.

2.4 Sensitive information and children

We do not request, and ask that you do not submit, sensitive personal information (such as Social Security numbers, driver’s license numbers, financial account numbers, health information, biometric data, or precise GPS location). We do not knowingly sell or share sensitive personal information, and we do not use it to infer characteristics about you. The Site is a business/consumer building-products site intended for adults; it is not directed to children under 13, we do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

3. How we use information

We use personal information to:

1. Prepare and deliver quotes — respond to your quote or contact request, calculate state-specific pricing, and connect you with a building specialist by email or a live phone call.
2. Recover failed submissions — if you press Submit on a quote or contact form and a technical error prevents your request from saving or reaching us, we may review our session recordings to recover the information you entered and submitted, so we can respond to the request you intended to send. We do not use session recordings to identify or contact visitors who did not submit a form.
3. Process reservations and orders — take deposits by phone, schedule manufacturing, delivery, and installation, provide order-status updates, and service warranties.
4. Operate and improve the Site — analytics, performance measurement, debugging (including diagnosing form errors and site bugs from session recordings), fraud and spam prevention (including honeypot fields on our forms), and security.
5. Market our products — send follow-up emails about your quote, related products, and promotions (each marketing email includes an unsubscribe link); show you Steel and Stud ads on other sites and services through interest-based advertising (see Section 4 and our Cookie & Tracking Policy).
6. Comply with law — keep records required by tax, accounting, and consumer-protection laws, respond to lawful requests, and establish or defend legal claims.

We collect and use personal information only as reasonably necessary and proportionate to these purposes. If we need to use it for a materially new purpose, we will update this Policy and, where required, notify you or ask for your consent.

4. How we disclose information

We do not sell personal information for money. We disclose personal information in these ways:

Recipient	Role	What they receive
PostHog, Inc. (analytics & session replay; data hosted on PostHog US Cloud, AWS United States)	Service provider / processor	Session recordings (including form-field text as described above), usage events, device data, identifiers
Google LLC — Google Analytics 4	Service provider / measurement	Cookie and device identifiers, usage and event data, approximate location. See “How Google uses information from sites or apps that use our services”: google.com/policies/privacy/partners
Google LLC — Google Ads (remarketing & conversion measurement)	Advertising partner (“sharing” / “targeted advertising” under some state laws)	Cookie/device identifiers and site-activity signals used to build advertising audiences and measure ad performance
Amazon Web Services	Hosting provider	Site data stored on our servers (US regions)
Google Workspace (Gmail)	Email provider	The contents of form-notification and business emails, which include your contact details
HubSpot, Inc.	Email marketing/service platform (service provider)	Contact details of quote requesters and customers (name, email, and related quote details) used to send our follow-up and marketing emails, plus email engagement data (whether an email was delivered, opened, or a link clicked)
WordPress/WooCommerce & Elementor (self-hosted)	Our own site software	Form submissions stored in our site database
3D designer providers (Sensei 3D; ACT Building Systems; Easy Building Designer)	Design-tool operators	Building designs and contact/quote details you enter in those tools
Manufacturers, delivery carriers, and installation crews	Fulfillment partners	Name, delivery address, phone, order/building details needed to build, deliver, and install
Financing / rent-to-own providers	Independent lenders	Information you choose to give them in an application
Professional advisors and authorities	Legal/compliance	What is required for audits, legal compliance, or to protect rights, safety, and property
Business transfers	Corporate	If we sell or reorganize the business, information may transfer with it, subject to this Policy

State-law “sale”/”share” disclosure: Some state laws define “sale” or “sharing” broadly to include making identifiers and internet-activity data available to advertising platforms in exchange for services. Under those definitions, our use of Google Ads remarketing is a “share” (and in some states a “sale”) of: device/online identifiers and internet activity. We may “sell” or “share” this data, as those laws define it, to/with Google LLC. We do not sell or share sensitive personal information, and we do not knowingly sell or share the personal information of consumers under 18. You can opt out on our Your Privacy Choices page; Global Privacy Control signals are treated as a valid opt-out from the date our consent banner is live (see Section 8).

5. Session recording — full disclosure

Because it is the least familiar technology we use, here is exactly how session replay works on our Site:

• What is recorded: a reconstruction of your visit — pages, clicks, scrolling, mouse movement, browser console/error logs, and the text you type into Site fields (name, email, phone, ZIP, project details). Recording currently begins when you load the Site; as our consent banner rolls out, recording will instead begin only after you accept analytics in the banner.
• What is never recorded: passwords (always masked); payment card fields (we have none on the Site — payments are taken by phone).
• Who processes it: PostHog, Inc., as our service provider, on U.S. servers. PostHog may not sell this data or use it for its own purposes.
• What we use it for: fixing bugs and usability problems; understanding how visitors use the Site; and recovering quote requests that you submitted but that failed to reach us due to a technical error.
• What we do not use it for: we do not contact visitors who never submitted a form; we do not build advertising audiences from recorded keystrokes; we do not capture data from other websites.
• Retention: recordings are retained for 30 days and then automatically deleted.
• Your choices: decline analytics in our cookie banner (rolling out with this policy — if you don’t see it yet, the opt-outs on our Your Privacy Choices page work today), enable Global Privacy Control, or contact us to have recordings associated with you deleted.

6. Cookies, analytics, and interest-based advertising

Full details, including a cookie table and opt-out instructions, are in our Cookie & Tracking Policy. In summary:

• Google Analytics 4 measures Site usage. Learn how Google uses this data at google.com/policies/privacy/partners. You can opt out with the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).
• Google Ads remarketing (including Google Analytics Advertising Features such as Remarketing with Google Analytics and, where enabled, Google signals) uses first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as Google advertising cookies) together to show you our ads on other sites based on your past visits to this Site, and to report how ad impressions and interactions relate to visits. Opt out via Google Ads Settings (adssettings.google.com), the Network Advertising Initiative opt-out (optout.networkadvertising.org), or our Your Privacy Choices page.
• PostHog provides analytics and the session recording described in Section 5.

7. How long we keep information (retention)

We keep personal information only as long as reasonably necessary for the purposes above, then delete or de-identify it:

Category	Retention period
Session recordings	30 days
Quote/lead records (form submissions, emails)	24 months after our last interaction with you, unless you become a customer
Customer & order records	Life of the order + 7 years (tax, warranty, and legal requirements)
Analytics data	Google Analytics event data: up to 14 months; PostHog analytics events: up to 7 years (platform standard)
Advertising audience memberships	180 days from your last visit
Email platform (HubSpot) contact records	Until you unsubscribe or 24 months of inactivity, then deleted; unsubscribe suppression kept indefinitely
Marketing suppression (opt-out) lists	Kept indefinitely so we don’t contact you again

8. Your privacy rights

Depending on your state of residence (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), you may have the right to:

• Know / access the personal information we have about you, including (in some states) a list of the specific third parties to which we have disclosed personal data;
• Correct inaccurate personal information;
• Delete personal information we hold about you;
• Portability — receive a copy in a usable format;
• Opt out of targeted advertising, “sale”/”sharing” of personal data, and profiling in furtherance of significant decisions (we do not conduct such profiling);
• Limit the use of sensitive personal information (we do not collect it);
• Non-discrimination — we will never deny you products, charge different prices, or provide a different level of service because you exercised a privacy right.

How to submit a request (two methods, no account required):

1. Email info@steelandstud.com with the subject “Privacy Request”, or
2. Call 1-877-275-7048 and say you want to make a privacy request.

We will confirm receipt and respond within 45 days (extendable once by 45 days for complex requests — we will tell you if we need the extension). We verify requests by matching the information you provide (such as your email or phone number) against our records; we will not require you to create an account or provide a government ID for an opt-out request. You may use an authorized agent to submit an opt-out request on your behalf; for access/deletion requests we may ask the agent for proof of your written permission and verify your identity directly.

Appeals: if we decline your request, you may appeal by replying to our decision email with “Appeal” in the subject line within 45 days. We will respond to appeals within 45 days. If your appeal is denied, you may contact your state Attorney General (for example, at oag.ca.gov for California or texasattorneygeneral.gov for Texas) to submit a complaint.

Global Privacy Control: from the date our consent banner is live on the Site (look for “Cookie Preferences” in the footer), we treat a GPC signal from your browser as a valid request to opt out of targeted advertising / “sale” / “sharing” for that browser. Until then, use the opt-outs on Your Privacy Choices.

California notice at collection: the categories we collect are listed in Section 2; purposes in Section 3; recipients, and the categories sold/shared, in Section 4; retention in Section 7. We do not use or disclose sensitive personal information other than as permitted, and we do not knowingly sell/share data of consumers under 16.

9. Communications and marketing choices

• Email: we send follow-up and marketing email through HubSpot. Every marketing email includes our postal address and a working unsubscribe link; unsubscribes are processed by the platform and take effect within 10 business days (usually immediately). Like most email platforms, HubSpot uses a small tracking pixel and tracked links, so we can see whether an email was opened and which links were clicked — this helps us stop emailing people who aren’t interested. We may still send you transactional messages about an active quote or order.
• Phone: our specialists place live, human-dialed calls about quotes you have requested. We do not use autodialers, prerecorded messages, or AI voice calls. Tell the specialist, or email us, if you do not want further calls and we will add you to our internal do-not-call list within 10 business days. We check the National Do Not Call Registry before placing marketing calls to numbers we did not receive as part of an inquiry or order.
• Text messages: we do not currently send marketing text messages. If we introduce them, we will first ask for your express written consent with a separate checkbox.

10. Security

We use HTTPS across the Site, restrict administrative access, use spam-prevention measures on our forms, and rely on established providers (AWS, Google, PostHog) that maintain their own security programs (for example, PostHog is SOC 2 Type II audited). No method of transmission or storage is 100% secure; if a breach affecting your personal information occurs, we will notify you and regulators as required by law.

11. Do Not Track; other disclosures

Because there is no common standard for legacy “Do Not Track” browser signals, the Site does not respond to DNT; we do honor the Global Privacy Control as described above. The Site is operated from the United States and intended for U.S. customers; if you access it from elsewhere, you understand your information is processed in the U.S.

12. Changes to this Policy

We will post any changes on this page and update the “Last updated” date. For material changes, we will provide more prominent notice (such as a banner on the Site or an email). Your continued use of the Site after changes take effect means the updated Policy applies, except where law requires fresh consent.