Privacy Policy

Glass CRM is operated by [COMPANY LEGAL NAME] (company number [COMPANY NUMBER]), registered at [REGISTERED ADDRESS].

For data protection questions, or to exercise any of the rights below, contact us at [privacy@yourdomain.com]. We are registered with the Information Commissioner's Office under [ICO REGISTRATION NUMBER].

Glass CRM is used by contractors to manage their own customers. That means we handle two different kinds of personal data, and our responsibilities differ for each.

• We are the data controller for information about our own customers — the contractors and their staff who hold accounts with us. Part 1 below applies.
• We are a data processor for the information a contractor puts into the service about their own customers. The contractor decides what is stored and why; we act on their instructions. Part 2 below applies.

We collect and use the following information about account holders:

• Your name and email address, so you can sign in and colleagues can identify you.
• Your business details — company name, address, phone number, VAT number and trade licence — which appear on the quotations and invoices you produce.
• Records of your activity in the service, such as when documents were created or sent, so the service works and so we can investigate problems.
• Billing details where you subscribe to a paid plan. Card details are handled by our payment provider and are never stored by us.
• Technical information such as IP address, browser and device type, collected when you use the service.

Why we are allowed to use it. We rely on the contract between us to provide and bill for the service, and on our legitimate interests to keep the service secure, investigate misuse, and understand how it is used so we can improve it.

Your rights. You may ask us for a copy of your data, ask us to correct it, ask us to delete it, object to or restrict how we use it, and ask for it in a portable format. Contact [privacy@yourdomain.com]. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

If you have received a quotation or invoice produced using Glass CRM, your details were entered by the contractor you dealt with. That contractor decides what is held about you and for how long. They are responsible for your data — not us.

To ask for a copy of your data, to have it corrected, or to have it deleted, please contact the contractor directly. We will help them respond, but we cannot act on your data without their instruction.

On their instructions we store your name and contact details, any addresses they recorded for billing or for the site, and the quotations, invoices and payments relating to work they did for you. Where they send you a document by email, we send it on their behalf.

If you are unable to reach the contractor, contact us at [privacy@yourdomain.com] and we will try to help you identify them.

We use the following providers to run the service. Each one is bound by a contract limiting what they may do with the data, and we tell customers before we add a new one.

Data held in the service is stored in [HOSTING REGION — CONFIRM IN SUPABASE DASHBOARD]. Where data is transferred outside the UK, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We keep account data for as long as you hold an account, and for a period afterwards where we are required to retain records.

Data a contractor stores about their own customers is kept for as long as they choose to keep it. Note that invoices and payment records may need to be retained to meet tax and accounting obligations even after a deletion request — in that case we remove the personal details and retain only the financial record.

Each contractor's data is separated at the database level, so one customer's account cannot read another's. Data is encrypted in transit and at rest, access by our staff is restricted and logged, and we keep records of who accessed what and why.

We use cookies that are strictly necessary to keep you signed in. We do not use advertising or cross-site tracking cookies.

We will update this page when our practices change, and will change the date at the top. Where the change is significant — for example a new provider handling customer data — we will tell account holders directly.

Questions about this policy: [privacy@yourdomain.com]. See also our Terms of Service.