How we handle information on glazing projects

What D8Pro collects when you create an account, upload drawings or issue a proposal — why we need it, who sees it, and how long we keep it.

Last updated: August 13, 2026
Effective: September 1, 2026
Governing law: Ontario, Canada

01Scope of this policy

Crystal Clear Installations Inc. (“we”) operates D8Pro, the glazing estimating and project management software at www.d8pro.app, from Mississauga, Ontario. This policy explains what personal information we collect through D8Pro, through crystalclearglazing.ca, and in the ordinary course of providing the app to the glass and glazing companies that use it.

Each company using D8Pro keeps its own workspace and is responsible for the project information it puts there; we process that information on that company’s behalf in order to run the service.

We handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Where a project or visitor is subject to Québec’s Law 25 or the EU/UK GDPR, we apply those standards to that information as well.

In shortWe collect what we need to quote, build and invoice glazing work — contact details, project drawings, site information and site-visit records. We do not sell personal information, and we do not use it for advertising.

02What we collect

Information reaches us in three ways: you give it to us, it is generated when you use our site or portal, or a general contractor provides it as part of a bid package.

CategoryExamplesSource

Contact detailsName, company, role, email, phone, mailing addressYou, or the GC inviting us to bid

Project informationDrawings, specifications, addenda, site addresses, schedules, site-measure photosYou or the GC

Commercial recordsQuotes, purchase orders, invoices, payment records, lien and holdback documentationYou and our accounting system

D8Pro account dataUsername, hashed password, role, permissions, sign-in and activity historyGenerated on use

Technical dataIP address, browser and device type, pages viewed, referring URLGenerated on use

Site & safety recordsVisitor sign-in, toolbox-talk attendance, incident reports involving a personOn site

We do not intentionally collect sensitive categories of information. Health information appears only where a workplace incident requires it, and is handled under our safety program and applicable workers’ compensation law.

03How we use it

To quote and deliver work — estimates, shop drawings, submittals, fabrication releases, delivery and install scheduling.
To administer contracts — purchase orders, change orders, progress billing, holdback and lien administration, warranty service.
To operate the client portal — authentication, permissions, document access, and an audit trail of who viewed or approved what.
To communicate — answering enquiries, sending quotes and revisions, and occasional project updates. Commercial email carries an unsubscribe link and complies with Canada’s Anti-Spam Legislation.
To meet legal duties — health-and-safety records, tax and audit retention, insurance and bonding requirements, and lawful requests.
To improve the site — aggregate analytics about which pages and services are viewed.

We rely on your consent for optional analytics and marketing email. Everything else is necessary to perform a contract, or required of us by law.

04Google account data

The D8Pro web application at www.d8pro.app lets an invited user sign in with a Google account instead of a password, and — if that user chooses — send a proposal from their own Gmail address. This section explains exactly what we receive from Google, why, and how to take it back.

Google permissionWhat it lets D8Pro doWhat we store

openid · email · profileConfirms who you are so we can match your Google account to your existing D8Pro user, and shows your name and photo inside the app.Name, email address, profile image URL

gmail.sendSends a proposal email and its PDF attachment from your own Gmail address, so the general contractor replies to you and the message appears in your Sent folder. It is requested on the same consent screen as sign-in and can be declined there or revoked later; the app still works with an email address and password. It cannot read, search, download, modify or delete anything in your mailbox.The proposal we sent on your behalf; no mailbox contents

To keep you signed in and to send on your behalf without asking again each time, we store Google's access and refresh tokens for your account, held with the rest of your D8Pro record and encrypted at rest by our hosting provider. Those tokens are used only by the D8Pro features described above.

Limited useOur use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not, and will not:

Read, download, index or retain the contents of your mailbox, contacts, calendar or Drive.
Sell Google user data, share it with data brokers, or use it for advertising or to build advertising profiles.
Let a person operating D8Pro read your Google data, except where you ask us to for support, where it is needed for a security investigation, or where the law requires it.
Use Google user data to train generalised artificial-intelligence or machine-learning models.

You can revoke D8Pro's access at any time from your Google account's third-party access settings. Revoking stops any further sending immediately; you can still sign in with an email address and password. When you revoke access, or when your D8Pro account is closed, we delete the stored Google tokens within 30 days. Proposals already emailed remain in our records as part of the project file, on the retention schedule below. To have the rest of your Google-derived profile removed, email [email protected].

We share personal information only where a project or a legal obligation requires it — never for another party’s marketing.

Project participants — general contractors, architects, engineers and consultants who need it to coordinate the work.
Suppliers and fabricators — glass, aluminium and hardware vendors receive delivery details and the technical scope of an order.
Service providers — cloud hosting, email delivery, estimating and accounting software, each bound by written confidentiality and data-protection terms.
Professional advisors — auditors, insurers, sureties and legal counsel, as needed.
Authorities — where required by law, court order or a workplace-safety investigation.

06Cookies and analytics

Our site uses two kinds of cookies. Strictly necessary cookies keep you signed in to the portal and protect form submissions; they cannot be switched off. Analytics cookies measure aggregate traffic and are set only after you accept them in the cookie banner.

You can withdraw analytics consent at any time by clearing cookies for this domain or using the banner’s preferences link. We honour browser Global Privacy Control signals where they are sent. We do not run advertising or cross-site tracking pixels.

07How long we keep it

RecordRetentionReason

Unsuccessful bids2 years after awardReference for similar work

Project files and drawings15 years after substantial completionWarranty, limitation periods, Ontario Construction Act

Invoices and payment records7 yearsTax and audit

Safety and incident recordsPer Ontario OHSA schedulesStatutory duty

D8Pro accounts24 months after last sign-inThen deactivated and purged

Web analytics26 monthsAggregated afterwards

08Your rights

Subject to legal exceptions, you may ask us to give you access to the personal information we hold about you, correct it, delete it where we have no continuing obligation to keep it, or provide it in a portable format. You may also withdraw consent for optional uses, or ask us to stop sending commercial email.

Write to [email protected]. We verify identity before acting and respond within 30 days, as PIPEDA requires. If our response does not satisfy you, you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial or supervisory authority.

09How we protect it

D8Pro traffic is encrypted in transit with TLS 1.2 or better, and at rest by our hosting provider. Access follows least privilege: estimators, project managers and accounting see only what their role requires, and portal activity is logged. Multi-factor authentication is available on every portal account and mandatory for administrators.

No system is perfectly secure. If a breach creates a real risk of significant harm we will notify affected individuals and the Privacy Commissioner as the law requires, and keep a record of the incident.

10Where information is processed

Our primary hosting and backups are in Canadian data centres. A small number of service providers process data in the United States or the European Union; while information is in another country it may be accessible to that country’s courts and authorities. We use contractual protections, including the European Commission’s standard contractual clauses where they apply.

11Children

Our services are directed at businesses. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided information, contact us and we will delete it.

12Changes to this policy

When we make a material change we update the “last updated” date above and — for portal users — post a notice at sign-in for 30 days. Earlier versions are available on request.

13Contact us

Privacy Officer · Crystal Clear Installations Inc.
Operator of D8Pro
1420 Meyerside Drive, Unit 12, Mississauga, ON L5T 1C9
[email protected] · +1 (416) 555-0142