How we handle your customers’ data

What we take, where it goes, and who sees it.

For owners, office managers and your counsel

Lead reactivation works the leads your business has already paid for — homeowners who asked for a replacement quote, a second opinion or a tune-up, were followed up once or twice, and then were not. We rank them by likelihood to book and work the list from the top, so your team spends its time on the people most likely to say yes to a visit.

Most of what governs that list is telemarketing law: the TCPA, Do Not Call, and state rules that treat a text as a sales call. On top of it sit the rules for HVAC work — licence numbers in advertising, the federal heat pump and efficiency tax credits that ended with 2025, disclosures that a monthly payment brings with it, and renewal rules for maintenance plans. No federal privacy rule like the one banks follow covers an HVAC business, and most state privacy laws will not reach yours. We protect the data as if they did. This document sets out, control by control, what we do, which rules it answers, and where it goes further than they require.

Sections 02 to 06 are the plain-English part. They show the whole system in pictures, explain the four things the ranking looks at, and follow one example lead from your CRM to your rep’s phone. The sections after them are the detail your counsel will check.

01

Commitments

Ten commitments, before the detail

• 01 · Direct identifiers never reach an AI provider — Names, phone numbers, emails, street addresses and gate or alarm codes stay in a secure environment. The AI provider sees a random ID and a few short facts, nothing more.
• 02 · Nothing goes out without your approval — You, or the person you name, approve every template and every batch before it is used. Our review sits on top of yours, never in place of it.
• 03 · Every message goes out in your name — Under your licensed business name, with your licence number where your state requires it, from your own number or email domain, and logged in your CRM.
• 04 · No evidenced consent, no text message — Consent, opt-outs, Do Not Call status and quiet hours are checked at the moment of sending. Opt-outs are permanent.
• 05 · Your data serves your engagement only — No model training, no reuse across clients, no sale of leads, no outside enrichment without your written instruction.
• 06 · Breach notice within 72 hours — As soon as possible and no later than 72 hours. No law sets that window for your business; we commit to it anyway.
• 07 · Return and destruction, certified — At the end of the engagement your data, including the identity key, is returned or destroyed, and we confirm it in writing.
• 08 · No credit, rebate or payment promises — Messages invite a visit or a call. No tax credits, rebate amounts or monthly payments, no price or savings promises, no made-up reviews.
• 09 · A fee structure that fits your work — A flat fee or a results-based fee. California work and insurance-funded jobs are treated separately, as section 14 explains.
• 10 · Evidence on request — Every control here has something you can inspect. If you send us a security questionnaire, we complete it during onboarding.

02

The whole picture

The system on one page

The system works in three zones. Names, addresses and contact details stay on your side. Our scoring works only with a random ID and a few short facts. The results come back to your side, where you approve and send.

G1 — the agreement and intake review — clears before any data moves. G7 covers retention and destruction.

Dashed gold-edged boxes, marked G1 to G7, are compliance gates. Nothing passes a gate until it clears. Section 03 lists what each one checks.

03

Step by step

From our first conversation to the first message

Seventeen steps in five phases. The gate marks show where a compliance check has to clear before the work moves on.

Onboard (before any data)

• 01 First conversation — How your team follows up on quotes today
• 02 Agreement — Roles, purpose, subprocessors, 72-hour notice G1
• 03 Intake review — Lead sources, consent wording, plan members G1
• 04 Secure environment — In your environment, or our workstation

Prepare (on your side)

• 05 Map your stages — Your CRM statuses to eight shared stages
• 06 Check the list — Opt-outs, Do Not Call, open jobs, complaints G2
• 07 Swap names for IDs — A random ID; the key stays with you
• 08 Notes into facts — Fixed-list answers; job values become tiers G3

Rank (Tez scoring)

• 09 Score — Intent, Opening, Reachability, Fit
• 10 Tier and reasons — A to D, with the top reasons
• 11 Short summary — Why call, and an opening line, checked G4
• 12 Next step — Channel by consent, and timing

Act (on your side)

• 13 Match back — The ranked list appears in your CRM
• 14 Your approval — You approve the wording and the batch G5
• 15 Send — Re-checked at sending; from your channels G6

Learn (ongoing)

• 16 Record outcomes — Booked, sold, lost; a held-back group
• 17 Improve and report — Your ranking only; results you can check G7

04

The ranking

How the list is put in order

Every lead is checked first, then looked at through four factors. The factors combine into one score, and the list is sorted by it. The sorting is plain arithmetic, not an AI model, so every score can be explained in a sentence.

How the ranking gets better

• 01It starts from your team’s experience — Your team tells us how often each kind of stalled replacement quote comes back. Those estimates set the first odds. Until your results come in, the scores are educated estimates, and we say so.
• 02It corrects itself from your results — As visits are booked and systems are sold or lost, the odds for each reason move toward what actually happened at your business.
• 03It becomes a model of your business alone — After about 300 recorded outcomes, the ranking is fitted to your own results. It is never trained on, or pooled with, another company’s data.
• 04A held-back group keeps us honest — With your agreement, about one lead in ten is held back and not contacted for a set period. Comparing the two groups shows what the outreach actually changed, rather than what would have happened anyway.

05

A worked example

One lead, from your CRM to your rep

Renee Calloway is fictional. Her record is shaped like a real HVAC replacement lead. Follow it through the four cards, left to right and top to bottom.

1 · Your CRM record (stays with you)

2 · What we receive (leaves your side)

Never leaves your side: her name, phone, email, address, the note itself, the quote figure, the system’s exact age, exact dates.

3 · What comes back (back to you)

4 · In your CRM (stays with you)

Her quote request carried written consent to texts, so a text may go once you approve it. Your rep sees her name here, in your own CRM, for the first time.

• 01Her note became a few facts, and a flag — “Tax credit” and “monthly payment” left only as a do-not-mention flag. The federal credit she asked about ended for systems installed after 2025, and a payment figure in a message brings in Regulation Z disclosures, so the draft says neither (section 12).

06

The suggestion

How the “why call” note is written and checked

Each lead comes back with a reason line in fixed wording and a short summary drafted by an AI model, both written only from the facts in card 2 of section 05. The AI writes; it does not decide. The order comes from arithmetic, and you approve anything sent.

The four checks at gate G4

• No personal data — The draft may not contain a name, number, email or address. Names appear only as a placeholder, filled in on your side at sending.
• No credit, rebate or payment promises — No tax credits, rebate amounts, monthly payments, rates, prices or savings figures. No efficiency or refrigerant claim the facts do not support. The draft invites a visit, nothing more.
• Nothing made up — Every statement must trace back to one of the facts it was given. No invented reviews, neighbours or results. A statement that does not trace is a failure.
• Your never-say list — Phrases and topics you rule out are blocked, on top of the general rules above.

07

Roles

Your business stays in charge of the list

Your business owns the leads and decides how they are used. We work on your instructions as a service provider. Where a state privacy law reaches your business, we are your processor under it; under state breach laws we hold data on your behalf. The federal financial-privacy rule, GLBA, does not apply to an HVAC business, unless you lend to customers yourself. Telemarketing law is different: the business a message promotes and the party that sends it can both be liable. So consent is enforced in software, and responsibility is divided in writing.

08

Data

What we take, and what we never take

The least data that lets the list be ranked and worked. Where a figure carries signal, we keep a tier and drop the figure.

09

The privacy layer

Where AI sits, and what it sees

Notes are the most sensitive part of a record and the most useful — one line can hold a gate code and a health condition. So they are read where they already are, and only short answers leave.

10

Where it runs

Two ways to run the secure environment

The secure environment is where identifiable data lives during the engagement, and you choose where it sits. In both options the key table never leaves it, and the AI provider receives only a random ID and fixed-list facts.

Workstation standard, when Tez operates it

• Encrypted at rest — Full-disk encryption, plus a separate encrypted volume for each client’s data.
• Dedicated and locked down — An OS account used only for client data, multi-factor sign-in, screen lock, current patches, endpoint protection.
• No cloud sync — Client data is never stored in a synced folder or consumer cloud backup, and is excluded from sync by configuration.
• Wiped at the end — Your volume is destroyed at termination and the destruction certified in writing.

11

Security and incidents

The controls, and what happens if one fails

If something goes wrong

• 01 · Contain — Stop sending, revoke the affected credential, isolate the system.
• 02 · Notify you within 72 hours at the latest — Which records and fields, what window, what we have done. Updates follow as we investigate.
• 03 · Preserve evidence — Logs, send records and the consent history are kept intact for your investigation.
• 04 · Support your notice, never pre-empt it — Whether customers are told is your decision. For a lead list your state’s breach law may require no notice at all. We never contact your customers about it.

12

Advertising and claims

What outreach may say, and what it never says

Every message we draft is your advertisement, sent in your name. That brings in your trade’s advertising rules and the FTC’s rules on honest claims. These are the ones that shape the wording.

• 01Your licence number, where the state asks for it — California counts “any electronic transmission” as advertising (B&P 7030.5; 16 CCR 861); Florida, Arizona, Nevada, Oregon and Washington require the number too. Texas wants it in all HVAC advertising, with a licensing statement on calls instead (16 TAC 75.71(h)). We put it in every text and email.
• 02No expired credits, no rebate promises — The federal 25C and 25D credits ended for systems placed in service after 2025, so an old quote is never revived on a credit. State home energy rebates open, close and change terms state by state. Drafts name no credit, rebate amount or availability.
• 03Financing: no payment figures — A monthly payment, down payment, number of payments or finance charge triggers Regulation Z disclosures, for contractors too (12 CFR 1026.24); deferred-interest and lease offers carry rules of their own (1026.16(h); 1013.7). Drafts say “financing available” at most.
• 04Efficiency, refrigerant and need: true claims only — ENERGY STAR is named only for certified models, never as an endorsement of you, and savings figures need support (FTC Act section 5). EPA’s refrigerant rules restrict new equipment, not servicing existing systems — so no “your refrigerant is banned.” Texas bars misrepresenting the need for service (16 TAC 75.71(b)).
• 05Plans, reviews and referrals — California requires express consent to plan renewals, an annual reminder and notice before a fee change (B&P 17602); we draft none of those, and plan offers use your terms. No fake or AI-written reviews (16 CFR 465), no referral rewards to homeowners in California (B&P 7157), no misleading subject lines (Washington, *Brown v. Old Navy*). Every template keeps its approval trail.

13

Consent

No evidenced consent, no text message

Under the Telephone Consumer Protection Act the party that sends a message can be liable for it directly, at $500 a message and up to $1,500 if wilful. Recent court decisions have narrowed some federal rules and loosened the FCC’s hold on others; we rely on neither, and work to the strictest reading. Consent is enforced in software at the moment of sending, not left to policy.

• 01 · A consent history, not a checkbox — Each lead’s consent is an append-only record of source, wording, channel and date. Contactability is derived from it, never overwritten.
• 02 · Checked when the message sends — Consent, suppression, Do Not Call and quiet hours are rechecked at sending, not at list-building. Yesterday’s opt-out holds today.
• 03 · Aged quotes without evidenced consent — Email, or your reps calling directly — not text. A quote request over three months old is no established business relationship for Do Not Call; a customer within 18 months of a job, or a current plan member, is.
• 04 · Do Not Call and reassigned numbers — Checked against the National Do Not Call Registry and the FCC Reassigned Numbers Database. Results dated and stored.
• 05 · Quiet hours and state law — 8am to 8pm in the lead’s local time, inside the federal 9pm limit; from 9am in Connecticut, noon on Texas Sundays. Three a day at most in Florida, Oklahoma and Maryland. No texts to Washington residents without clear prior consent.
• 06 · Opt-out everywhere, permanently — STOP, a request in any words, or one made to your rep or technician is honoured on every channel and survives any re-import. Email unsubscribes within 10 business days.

14

How we are paid

Two fee models, and how each is treated

We offer two models. Fees are set in conversation and are not in this document. What belongs here is how each model is treated under the rules that apply to HVAC work, so you and your counsel can choose with that in view.

Model A: Flat monthly fee

A fixed fee for operating the service. It does not depend on visits booked, systems sold, or how a job is paid for.

• No rule we found restricts it, in any state.
• The model we start on in California until your counsel has confirmed Model B.
• The simplest model to budget for and to check.

Model B: Results-based fee

A share of revenue from reactivated jobs, measured from your CRM’s own records.

• Generally unproblematic. We found no federal or state rule that bars an HVAC business paying a marketing vendor this way.
• California. HVAC equipment is home improvement there, and a person paid to solicit, sell or negotiate those contracts must register as a salesperson (B&P 7151, 7152, 7157). We do none of that — your team quotes and sells — but your counsel confirms Model B first.
• Florida, insurance-funded jobs. No pay for referring work paid from property insurance (Fla. Stat. 489.147). Those jobs leave the base.

15

Subprocessors and contract

Who else touches the data, and what we sign

The full list is an exhibit to your agreement. We give 30 days’ notice before adding or changing a subprocessor.

What the agreement contains

• Roles and purpose — Your business as owner of the data, Tez as service provider and processor; use limited to this engagement.
• No secondary use — No training, no sale, no reuse across clients, no enrichment without written instruction.
• Security exhibit and 72-hour notice — The controls in sections 09 to 11, as binding terms.
• Consent warranty — Your representation of how the leads were obtained, segment by segment.
• Privacy requests — Access, correction and deletion within your deadlines, wherever a state privacy law applies to you.
• Audit, return and destruction — Reasonable audit and questionnaire rights; return or certified destruction at termination.

16

Regulatory map

Each rule, and where it is addressed

17

References

Every requirement, traced to its source

Each commitment in this document rests on a primary source: a statute, a regulation, a regulator’s own guidance, or a court decision. They are listed here so your counsel can check our reading against the text. Links were current in October 2026.

18

Limits

What this document is not

• 01Not legal advice — Your counsel decides how these rules apply to your business. This document tells them what we do so they can.
• 02Not a SOC 2 report — We do not hold a SOC 2 attestation. If you send a security questionnaire, we complete it and provide the policies and evidence behind each control instead.
• 03Not your contractor, salesperson or lender — Tez I Solutions is not a licensed contractor, a home improvement salesperson or a lender. We do not quote, sell, contract for or perform work, and we do not arrange financing or advise anyone on credits or rebates. Every message is your advertisement, in your name.
• 04Not permanent — Current as of October 2026. Rules in this area are moving — the FCC’s “revoke all” consent rule is due on January 31, 2027, and federal credits, state rebate programs and refrigerant rules have all changed since 2025. We review this document at least once a year and whenever a rule it relies on changes.
• 05Not a promise of results — A score says which leads to contact first, not who will book. Until your own outcomes are recorded, the odds behind it are estimates drawn from your team’s experience.

A1

Commitments

Ten commitments, before the detail

• 01 · Your accounts, on business terms — We work only in accounts your business owns, on business plans. Never in a personal or consumer account — ours, yours or an employee's.
• 02 · A named user, never a shared password — You add us as a named user with our own sign-in and multi-factor authentication. We never ask for a shared password, and you should never send one to us by email.
• 03 · The least access that does the job — Each connection reaches only the data its workflow needs. Admin rights are used for set-up tasks, logged, and reduced afterwards.
• 04 · Nothing goes live without your approval — Every connection, workflow and set of instructions is approved by you, in writing, before it is switched on. So is every change to one that is already running.
• 05 · Automated where it is routine, a person in the loop where it is not — Routine, rule-based work can run on its own once you have approved it: sorting and tagging, summaries for your team, filing, and fixed-wording notices such as an appointment reminder from a template you signed off. Anything that needs a decision or a judgement — a reply written for a particular customer, a price, a term, a commitment, or anything your industry's page marks for review — has a person on your side in the loop before it goes anywhere. Each workflow's data sheet (A3) states which kind it is. Where your industry's page requires a person to review every customer message, that rule applies instead.
• 06 · Your data stays in your tools — We build and test inside your workspace. We do not copy your business data into Tez's own AI accounts. Where we need examples outside your tools, we use made-up records.
• 07 · Your data serves your business only — No reuse across clients, no sale, no training of anything by us. Prompts, instructions and workflows built from your material are yours and are not reused for anyone else.
• 08 · Vendor data settings confirmed in writing — During onboarding we read each tool's current data terms, set its controls with you, and give you a written record. We re-check it whenever a vendor changes its terms.
• 09 · Incident notice within 72 hours — As soon as possible and no later than 72 hours, or sooner where your industry's page says so.
• 10 · Access removed, everything handed over — At the end, our access is removed, every credential we created is revoked or rotated, and every workflow is documented and handed over. We confirm it in writing within 30 days.

Evidence on request: every control in this document has a record you can inspect, listed in section A5. If you send us a security questionnaire, we complete it during onboarding.

A2

Accounts and access

Whose accounts, and how we get in

The AI tools, the systems they connect to and the accounts that run them all belong to your business. We are given access to them; we never hold them. That is what makes the work portable: if we part ways, everything keeps running and nothing has to be moved out of our name.

Nothing in this section starts before you have decided to work with us. The first session is a conversation. We do not ask for logins, exports or files beforehand.

Who owns what

How access is set up

• 01 · You decide what we need — We list the systems and the role each one needs, and why. You agree or strike items out.
• 02 · You add us — Usually by adding us as a user, on a call where we walk through it together. A password is never sent.
• 03 · We confirm the safeguards — Multi-factor authentication on, role as agreed, sign-in recorded in the access record.
• 04 · Reviewed every quarter — We go through the access record with you and remove anything no longer needed.
• 05 · Removed at the end — Section A5 sets out how access ends.

Roles

Where a state privacy law reaches your business, we act as your service provider or processor for the access we hold, and the agreement says so.

A3

What the tools can see

Connections, scopes, and what stays out

An AI tool connected to one of your systems can see whatever that connection lets it see. An assistant that searches your files can surface anything the person using it is allowed to open — Microsoft says of its own Copilot that it "only surfaces organizational data to which individual users have at least view permissions." So the work starts with permissions, not prompts.

Before anything is connected

• Who can see what — Before an assistant is pointed at a shared drive, inbox or CRM, we review who can open what. Folders that are open to everyone but should not be are fixed first, with your approval.
• One data sheet per workflow — Every workflow gets a written sheet: what it reads, what it writes, who sees the result, and where a person reviews it. You approve the sheet before we build.
• Add-ons are vendors too — A plug-in, connector, custom GPT or agent from a third party is another company handling your data. None is installed without your approval and a record of its data terms.

What a data sheet looks like

Illustration — not real client data.

What stays out by default

Unless your written decision says otherwise, after we have shown you what the vendor's terms and your industry's rules say, these are kept out of every prompt, instruction file and connection:

• Social Security numbers, tax IDs, driver's licence and other government ID numbers
• Full bank account and card numbers
• Passwords, access codes, gate, door and alarm codes
• Health information
• Anything your industry's page (A7) marks as restricted

Where a connection would expose one of these — a folder of scanned IDs, a CRM field holding card numbers — the connection is narrowed to leave it out, or not built.

Before a workflow goes live

AI tools make mistakes. Every workflow is built on the assumption that a draft can be wrong, which is why the review step is part of the design rather than a suggestion.

A4

Model providers and training

What the vendors do with your data, and how we check

When your team or a workflow uses ChatGPT, Claude, Copilot or Gemini, the vendor processes that data under its contract with your business. Tez is not a reseller or partner of any AI vendor, and not a party to those contracts. Whether a vendor trains its models on your data, how long it keeps prompts, whether its staff can review them, and where it processes them are set by the vendor's terms and by the plan you are on. Those terms change. So we do not promise what a vendor will do. We promise what we will do.

What we do

• 01 · List every tool — Each AI tool and AI feature you pay for, the plan it is on, and who holds a seat.
• 02 · Read the current terms — For each one we record what the vendor says about training on your data, retention, human review, where data is processed, and which admin controls exist. Each entry carries the date and the address of the page we read.
• 03 · Set the controls with you — Where a tool offers a choice — training opt-outs, retention periods, chat history, which add-ons are allowed — we recommend the most protective setting that still does what you need, and you decide.
• 04 · Give you the record — The settings record is yours, in writing. Your compliance contact can file it with your vendor reviews.
• 05 · Re-check when terms change — When a vendor changes its data terms, we re-read them, update the record and tell you if anything moved. We also re-check the whole record at least every six months.

What the main vendors said when we checked

Read on each vendor's own page on 6 October 2026. This is the vendor's statement to its customers, not a commitment by Tez. If it changes, the vendor's current terms govern, and we update your record.

Consumer plans and personal accounts

Consumer plans run on different terms from business plans — Anthropic's Commercial Terms, for one, state that they do not cover its consumer offerings. We do not do business work in consumer or personal accounts, and we do not rely on a consumer plan's settings to protect business data.

Our own tools

We use AI tools of our own to write code and documentation. Your business data does not go into them. Anything we build for you is built and tested in your workspace, or against made-up records.

A5

Records, security and incidents

What we keep, how it is protected, and what happens if something fails

Records you can inspect

Records describe what we built and changed. They live in a location your business owns, and they do not contain your customers' data.

Changes to something already running

Every change to a live workflow is described, approved by you, tested, logged and reversible — the previous version is kept. If a vendor update breaks a workflow, or a workflow starts doing something it should not, we may pause it at once to stop harm, and tell you the same day. We do not change what a workflow does without your approval.

Security controls

If something goes wrong

An incident includes a workflow sending or showing data to the wrong person, a connection reaching more than its sheet allows, a suspected compromise of a Tez sign-in, and a vendor incident we learn of that affects your workspace.

• 01 · Contain — Pause the workflow, revoke the affected credential or connection, and stop the exposure.
• 02 · Notify you within 72 hours at the latest — Which systems and data, what window, what we have done. Sooner where your industry's page sets a shorter time. Updates follow as we investigate.
• 03 · Preserve evidence — Logs, the change log and the vendor's audit records are kept intact for your investigation.
• 04 · Support your notice, never pre-empt it — Whether customers or regulators are told is your decision. We never contact your customers about it. A vendor's own incident notice comes to you under your contract with that vendor.

When the engagement ends

Everything we build is yours — documented and portable. If we part ways, it keeps working and your team knows how it runs.

A6

Limits

What this document is not

• 01 · Not legal advice — Your counsel or compliance officer decides how your industry's rules apply to your business. This document tells them what we do so they can.
• 02 · Not a SOC 2 report — We do not hold a SOC 2 attestation. If you send a security questionnaire, we complete it and provide the policies and evidence behind each control instead.
• 03 · Not the vendor — We do not run the AI vendors' systems or set their terms. Their security, retention, outages and incidents are governed by your contract with them. We are not a reseller, partner or certified provider of any AI vendor.
• 04 · Your obligations stay yours — Using AI tools does not move your duties to us: licensing, supervision, record keeping, privacy notices and your staff's use of AI remain your business's responsibility. We build to them, as your industry's page sets out.
• 05 · Not a promise about AI output — AI tools can be wrong, and confidently so. That is why anything that needs a judgement has a person in the loop, and why no workflow makes a decision your business would otherwise make.
• 06 · Not permanent — Current as of October 2026. Vendor terms and the rules on AI change often. We review this document at least once a year, and whenever a vendor term or rule it relies on changes.

A7

HVAC

What your industry's rules mean for your AI tools

Most of what governs an HVAC business's AI tools is advertising law, because most of what those tools do is write: replacement follow-ups, maintenance-plan reminders, email subject lines, website copy. Two risks are specific to this trade. AI tools learn from material that is often years out of date, and the federal tax credits they like to mention ended with 2025. And they write payment terms — "$89 a month" — without the disclosures that must go with them. These are the rules that bear on the work, and what we do about each.

In practice

• A workflow may draft a follow-up on an unsold replacement quote from the system size, the quote date and your technician's notes. It may not mention a federal tax credit, or a monthly payment without your disclosure.
• A maintenance-plan reminder may tell a customer their visit is due. Whether the plan renews, and on what terms, stays in your billing system.
• An assistant may answer your team's questions about equipment specs and your service procedures. It is not given access to customers' payment details.
• Technician photos of a home's interior stay in your field-service software, and are not copied into a general AI workspace.

A8

Sources

Where these rules come from

1. Cal. Bus. & Prof. Code 7030.5; 16 CCR 861; CSLB Industry Bulletin 20-21 — https://cslb.ca.gov/Resources/IndustryBulletins/2020/20-21_Advertising_on_Vehicles.pdf 2. Fla. Stat. 489.119(5) — https://www.flsenate.gov/Laws/Statutes/2025/489.119 3. 16 Tex. Admin. Code 75.71 — https://www.law.cornell.edu/regulations/texas/16-Tex-Admin-Code-SS-75-71 4. Ariz. Rev. Stat. 32-1124 — https://www.azleg.gov/ars/32/01124.htm · Nev. Rev. Stat. 624.720 — https://www.leg.state.nv.us/nrs/nrs-624.html · Or. Admin. R. 812-003-0120 — https://www.law.cornell.edu/regulations/oregon/Or-Admin-Code-SS-812-003-0120 · Wash. Rev. Code 18.27.100 — https://app.leg.wa.gov/rcw/default.aspx?cite=18.27.100 5. IRS, Energy Efficient Home Improvement Credit (25C) — https://www.irs.gov/credits-deductions/energy-efficient-home-improvement-credit 6. IRS, Residential Clean Energy Credit (25D) — https://www.irs.gov/credits-deductions/residential-clean-energy-credit 7. U.S. Department of Energy, Home Energy Rebates Programs — https://www.energy.gov/scep/home-energy-rebates-programs 8. Regulation Z, 12 CFR 1026.24 and 1026.16 — https://www.consumerfinance.gov/rules-policy/regulations/1026/24 · https://www.consumerfinance.gov/rules-policy/regulations/1026/16 9. Regulation M, 12 CFR 1013.7 — https://www.consumerfinance.gov/rules-policy/regulations/1013/7

• 01FTC Act section 5, 15 U.S.C. 45 — https://www.law.cornell.edu/uscode/text/15/45
• 02FTC Rule on Consumer Reviews and Testimonials, 16 CFR Part 465 — https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-465
• 03EPA, ENERGY STAR Brand Guidelines — https://www.energystar.gov/partner-resources/brand-guidelines
• 04EPA, Technology Transitions HFC Restrictions by Sector — https://www.epa.gov/climate-hfcs-reduction/technology-transitions-hfc-restrictions-sector
• 05California Automatic Renewal Law, Cal. Bus. & Prof. Code 17600 et seq. — https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=7.&title=&part=3.&chapter=1.&article=9.
• 06FTC, Negative Option Rule, advance notice of proposed rulemaking, March 13, 2026 — https://www.federalregister.gov/documents/2026/03/13/2026-04952/rule-concerning-the-use-of-prenotification-negative-option-plans
• 07CSLB, Contractors License Law & Reference Book, 2026 (Cal. Bus. & Prof. Code 7151–7157) — https://cslb.ca.gov/Resources/GuidesAndPublications/2026/2026_CSLB_Law_Book.pdf
• 08Telephone Consumer Protection Act, 47 U.S.C. 227 — https://www.law.cornell.edu/uscode/text/47/227
• 09FTC, CAN-SPAM Act: A Compliance Guide for Business — https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
• 10Brown v. Old Navy, LLC, Washington Supreme Court, April 17, 2025 — https://www.courts.wa.gov/opinions/pdf/1025921.pdf
• 11California Consumer Privacy Act; California Privacy Protection Agency, threshold adjustment — https://cppa.ca.gov/regulations/cpi_adjustment.html