Gracia Makeovers Inc.

Privacy policy

Last updated October 4, 2026

Gracia Makeovers Inc. (“Gracia”, “we”) runs Gracia CRM, the private system our team uses to manage renovation projects, and the client portal our clients use to follow their project. This policy explains what information we collect, why, and how we protect it.

Information we collect

  • Contact details you give us: name, email, phone number and the address of the project.
  • Project information: quotes, contracts, invoices, payments, selections, photos and messages about your renovation.
  • How you use the client portal and the emails we send you: which pages and documents you open, when, for how long, and on what type of device. We use this to know when to follow up and to make the portal easier to use.
  • Calls and texts with our business phone numbers, when you contact us that way.

How we use it

Only to deliver and manage your renovation: to quote, schedule, communicate, invoice, and look after warranty and maintenance afterwards. We do not sell your information, and we do not share it with anyone except the trades and suppliers working on your project, and the service providers that run our systems (for example our hosting, email and phone providers), under confidentiality.

Google user data

Gracia CRM connects to Google only with Google accounts owned by Gracia Makeovers Inc. It is not used to connect anyone else’s Google account. This section explains exactly which Google data the app accesses and what it does with it.

Data accessed through Google

Google Business Profile (scope https://www.googleapis.com/auth/business.manage), for our own Oakville and Burlington profiles only:

  • Our business accounts and locations: names, addresses and identifiers, so the app knows which profile to post to.
  • Reviews of our business: the reviewer’s public display name and photo, the star rating, the review text, the date, and our reply.
  • Questions and answers on our profiles: the question text, the asker’s public display name, and the answers.
  • Our profiles’ performance: daily counts of views, calls, website clicks and direction requests, and monthly search terms that showed our profile.
  • Posts and photos we publish to our own profiles.

Google Drive (scope https://www.googleapis.com/auth/drive.file): only files and folders the app itself creates in our company Drive. The app cannot see, read or change any other file.

We also receive the signed-in Google account’s email address (scopes openid and email) to show which account is connected.

How Google data is used

  • To publish posts and photos that our team has approved to our own business profiles.
  • To show us new reviews and questions, draft replies for our team to review, and post the replies we approve.
  • To show our team how our profiles are performing.
  • To save copies of our own quotes, contracts and invoices to our Drive.

Google data is used only to provide these features to Gracia Makeovers Inc. It is not used for advertising, is not sold or rented, is not used to build profiles of reviewers, and is not used to train general-purpose AI or machine learning models. Review and question text may be sent to an AI model (Anthropic’s Claude) solely to draft a reply for our team to approve; it is not retained by that provider for training.

How Google data is stored, shared and protected

  • Stored in our private database (Supabase). Google access and refresh tokens are encrypted at rest with AES-256.
  • Visible only to Gracia Makeovers Inc. staff signed in with two-factor authentication. All traffic uses HTTPS.
  • Not shared with any third party except the infrastructure providers that run the app (hosting by Vercel, database by Supabase) and the AI drafting described above, each bound by confidentiality and used only to provide the service.

Retention and deletion of Google data

  • Reviews, questions and performance figures are kept while the Google connection is active, so our team can see history.
  • Disconnecting Google in the app deletes the stored Google tokens immediately. On request to [email protected], we delete all stored Google data within 30 days.
  • Access can also be revoked at any time at myaccount.google.com/permissions.

Limited Use

Gracia CRM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect it

Access to Gracia CRM requires a staff account with two-factor authentication. Connection tokens are encrypted at rest, data is sent over encrypted connections, and the database is backed up daily. Client portal access uses private sign-in links.

How long we keep it

We keep project records for as long as needed for the warranty, tax and legal record-keeping (generally seven years after the project), then delete them. You can ask us to delete your information sooner where the law allows.

Your choices

  • Ask to see, correct or delete your information by emailing [email protected].
  • Unsubscribe from marketing emails with the link in any of them. Project emails about your own renovation still come.
  • We disconnect our Google connection at any time from our own settings, and you can remove our access to any Google account at myaccount.google.com/permissions.

Contact

Questions about this policy or your information: [email protected].

Gracia Makeovers Inc. · Oakville and Burlington, Ontario · [email protected]