Privacy policy

1. Who operates the application

Glass Innovation CRM is operated by Glass Innovation Corp., 461 Irmen Dr, Addison, IL 60101, United States. It is a business application for authorized staff, not a public email service. For questions or privacy requests, contact info@glassinnovationcorp.com.

This policy applies to the CRM and its Gmail connection. The company website privacy policy covers our general website and shopping services. For Google data handled by the CRM, the specific restrictions in this policy take precedence over broader website statements.

2. Information we access and collect

• CRM account and business records: staff account details and roles; customer and lead contact details; company and project addresses; inquiries; configurations; estimates; jobs; appointments; project files and business communications entered into or connected to the CRM.
• Google account connection: the connected mailbox address, authorization status, granted permission, and OAuth access and refresh tokens needed to maintain the connection. We do not receive your Google password.
• Gmail data: message and thread identifiers, sender and recipient details, subject lines, message bodies, message dates, labels and attachment information and contents for messages imported into the CRM. This includes received and sent mail within the synchronization window.
• Operational data: sign-in and synchronization records, timestamps, processing errors and technical information needed to operate and secure the service.

The Gmail API permission is https://www.googleapis.com/auth/gmail.readonly. The permission technically allows reading the connected mailbox; the application limits new imports to a rolling 30-day window. Existing CRM history is retained separately as explained below. Reading alone does not permit sending or changing Gmail messages. A mailbox owner may separately grant https://www.googleapis.com/auth/gmail.compose to manage drafts and send email. The CRM uses this additional access to create, update and discard drafts and to send a message when authorized staff choose Send or Schedule. It does not use this permission to delete received or sent mail.

3. How we use information

We use CRM information to coordinate customer inquiries, prepare estimates, organize project work, and maintain business records. We use Google account and Gmail data only to authenticate the mailbox connection, synchronize and display correspondence and attachments in the shared CRM inbox, associate correspondence with existing CRM records, create and manage drafts and send staff-approved messages when compose access is granted, generate reply suggestions using message text, and operate, troubleshoot and secure those features.

Mailbox owners should connect only accounts they are authorized to share with the company team. Authorized staff can read the imported correspondence as part of this shared-inbox feature. The Gmail connection is optional; other CRM features do not require connecting a mailbox.

4. Google data and Limited Use

We comply with the Google API Services User Data Policy and its Limited Use requirements for Google user data.

• We do not sell Google user data or use it for targeted advertising, retargeting, advertising audiences, advertising conversion matching, or creditworthiness decisions.
• We do not use Gmail messages or attachments to train or improve generalized AI or machine-learning models. For the company-enabled reply-assistance feature, message subject, sender name and relevant message text are processed by OpenAI through its API to produce an analysis and suggested reply. Attachment contents are not included in this reply-analysis feature. Suggestions are for authorized staff review and are not sent automatically.
• Google mailbox data is not supplied to the CRM’s separate advertising or social publishing integrations.
• Human access is limited to the shared-inbox use authorized by the mailbox owner and otherwise to specific consent, necessary security investigations, applicable legal obligations, or other access expressly permitted by Google’s Limited Use requirements.

5. Storage, access and sharing

CRM data is stored in our application database and file storage, provided by Supabase. The application is hosted through Sites infrastructure. These service providers process data as needed to deliver hosting, storage, authentication and the features described in this policy. Google processes requests made to the Gmail API. OpenAI processes the limited message text described above for reply assistance; this processing is separate from the CRM’s advertising and social publishing features. Information may be processed in the United States and other locations where these providers operate.

Access to private CRM records requires authentication and the applicable company role. OAuth credentials are stored server-side in encrypted secret storage, rather than exposed in the browser. We use encrypted network connections and access controls to protect information. No system can guarantee absolute security.

We share information only as needed to provide the requested application features, with the user’s specific authorization, to protect security, or to meet a legal obligation. Any transfer of Google user data remains subject to Google’s Limited Use restrictions. Private inbox data is not made public by this policy page.

6. Retention, revocation and deletion

The 30-day import window is not a 30-day deletion policy. Imported correspondence, attachments and earlier CRM history remain stored while needed for the business purposes described here, subject to applicable recordkeeping obligations, dispute resolution and verified deletion requests.

Drafts may be saved in the signed-in user’s browser. Pending Gmail write operations and scheduled messages also temporarily hold the message content and attachments in the CRM so the approved action can be completed. Successful or cancelled operations release that temporary content; unresolved operations retain it for review. Delivery metadata and ordinary CRM correspondence records follow the business retention described above.

To stop future Google access, open Google Account connections, select Glass Innovation CRM and remove its access. An administrator can also pause automatic synchronization in the CRM. Pausing synchronization does not revoke the Google authorization.

Revoking Google access prevents future authorized retrieval; it does not automatically delete copies already stored in the CRM. To request removal of the mailbox connection, stored OAuth credentials, imported messages or attachments, email info@glassinnovationcorp.com and identify the mailbox and the data concerned. Never send your password or access tokens. We verify that the requester is entitled to act before processing the request.

Where we must retain particular business records for a legal obligation or dispute, we restrict further use to that purpose and explain the limitation. Residual copies in protected backups are removed as those backups expire under the applicable backup lifecycle.

7. Your choices and requests

You may ask to access, correct or delete information about you by contacting info@glassinnovationcorp.com. You may decline the Gmail connection or revoke it later. Access to other CRM functions depends on your company role, not on granting Gmail permission.

These public CRM information pages do not embed advertising or analytics scripts. The private CRM uses browser storage for authentication, authorization-flow security, local message drafts and application preferences. Following links to other websites may be subject to their separate privacy practices.

8. Changes and contact

We will update this page and its effective date when practices change. Before using Google user data for a new purpose or requesting additional access, we will provide an updated disclosure and obtain the required consent. The application is intended for business users and is not directed to children.

For application support or privacy questions, email info@glassinnovationcorp.com or write to Glass Innovation Corp., 461 Irmen Dr, Addison, IL 60101, United States.