Policy

Privacy Policy

Last updated: 14 September 2026

This Privacy Policy explains how GLAZIE LTD ("we", "us") collects and uses personal information when you use this website, buy from us, apply to supply us, or interact with us in a business or supplier capacity. We are the controller of your personal data for the purposes of UK GDPR and the Data Protection Act 2018.

1. What we collect

Account information: name, email, phone, optional company name, password (stored as a hash).
Order information: items, dimensions, specification, delivery/collection address, postcode, customer notes, PO reference (optional).
Documents you upload: photographs, drawings, PDFs, spreadsheets, screenshots and similar files you send us for a quote or an order, and the order details our software reads out of them. See section 4.
Payment information: handled directly by Stripe. We store only the payment intent reference, not the full card number. See Stripe's privacy notice at stripe.com/privacy.
Communication: emails we send you (subject + send status + body hash), messages you send our chat or voice assistant, and operational logs for delivery troubleshooting.
Cookies and similar technologies: see our Cookie Notice.

2. Why we use it

To process your order, have it made, deliver the goods, and provide customer support.
To send order, invoice, and review-window emails (legal basis: performance of contract).
To meet our legal obligations (tax records, consumer-rights records).
To improve the website and protect against fraud and abuse (legal basis: legitimate interests).
To offer optional features such as saved quotes and order reorder (legal basis: performance of contract or consent).
To measure how the website and our advertising perform, only where you have consented to analytics/advertising cookies (legal basis: consent — see section 3 and the Cookie Notice).

We use the service providers below to run the business. They process your information on our instructions and may use it only as our arrangements with them and the law permit.

Stripe — payment processing.
Resend — sending transactional email, including any invoice or document attached to it.
OpenAI — reading documents you upload, and powering our chat and voice assistant. See section 4.
Supabase — the managed database where your account, orders and uploads are stored.
Vercel — hosting and running the website.
Google Maps / Places API — when you use address autocomplete at checkout, the address text you type is sent to Google to return suggestions. We also send an origin and destination to Google to work out a delivery distance.
postcodes.io — a UK postcode lookup service we use to turn a postcode into an approximate location for delivery pricing.
Google (analytics and advertising) — only if you consent to optional cookies, we use Google Tag Manager, Google Analytics, and Google Ads conversion measurement. If you consent to advertising cookies, we may store Google Ads click identifiers (such as gclid, gbraid, or wbraid) and campaign parameters so an order can be attributed to the advert that led to it. These services receive usage data (pages viewed, configurator and checkout events, order value) associated with cookies or similar storage on your device — never your payment details. Where you have consented to advertising cookies, we may also send your email address and telephone number to Google in a hashed (scrambled) form so a purchase can be matched to an advert. You can withdraw consent at any time via "Cookie Settings" in the footer. See Google's privacy policy at policies.google.com/privacy.
Approved manufacturers and fulfilment partners — see section 5.
HMRC and other authorities — where the law requires.

We do not sell your personal data.

4. Documents you upload, and how AI reads them

You can send us a photograph, drawing, PDF, spreadsheet, screenshot or similar file instead of typing a specification. We use software from OpenAI to read the file and pull out the order details — sizes, quantities, glass make-up, references — so you do not have to enter them by hand.

What this means in practice

Your file is sent to OpenAI to be read. We configure these requests so that OpenAI does not store the exchange on their systems, and under the API terms we use, content sent this way is not used to train their models. A document may be read more than once where a first reading is unclear and we check it against a second model.
Uploads often contain other people's information. A site photograph, a survey sheet or a schedule may include a name, an address or a contact number belonging to someone other than you. Please send only what we need for the quote or order, and remove anything sensitive or irrelevant before uploading. If you are giving us another person's details, you must have a proper basis for doing so.
What we use it for: preparing a quotation, extracting a specification, staging and placing an order, fulfilling and supporting it, and detecting fraud or misuse.
Always check what we read. Automated reading can misread a drawing. The extracted items are shown to you before anything is ordered, and what you approve is what we make. This is also covered in our Terms.
Chat and voice: messages you type to our assistant, and audio if you use the voice assistant, are also sent to OpenAI to generate a reply.

How long uploads are kept

An upload that never became a quote or an order is deleted automatically after 12 months. If it did become one, it is kept with that record under section 8, because it is part of what you ordered. When you upload without an account we give you a private link that erases that upload immediately, and you can delete your account and unused uploads yourself from the Privacy section of your account area.

5. Making and delivering your order: manufacturers and fulfilment partners

We sell to you and we are responsible to you for your order. We do not make every item ourselves: we place the work with approved manufacturers, processors and delivery partners. To make and deliver your order, we pass them the minimum information they need.

What they may receive

the order or fulfilment reference;
the product and manufacturing specification;
the delivery or collection address and postcode;
the name of the recipient or the person authorised to collect;
a telephone number or email address, only where it is needed to arrange delivery or collection or to resolve a problem;
delivery or collection instructions and availability;
details and evidence needed to investigate a complaint, remake or warranty claim; and
proof of delivery or collection.

Access is limited to what is reasonably needed for the job in hand. We do not release a delivery address to a manufacturer until they have accepted the order.

What they do not get

We do not ordinarily give a manufacturer information they do not need to fulfil your order, including your payment-card or banking details, the price you paid us or our margin, another manufacturer's pricing, our internal notes, or your unrelated account or marketing history.

What they may not do with it

For ordinary order fulfilment, an approved manufacturer handles your information for us, under written Data Processing Terms, and not for their own purposes. Those terms prohibit them from marketing to you, adding you to their own customer list or mailing list, cross-selling or soliciting future direct orders, selling or otherwise monetising your information, or putting it into public or shared AI tools we have not approved. Suppliers must delete direct contact and delivery details once the job and any related case is finished.

One narrow exception

A manufacturer may occasionally have its own legal duty — product safety, traceability, tax or another regulatory obligation — that requires it to keep or use specific information. Where that genuinely applies, it is responsible for that limited use in its own right. It does not entitle any manufacturer to market to you or reuse your information commercially.

You can read the terms we impose on suppliers at Data Processing Terms.

6. Business and supplier contacts

We may collect and use business contact information about people who own, work for or represent glass manufacturers, processors, merchants and other potential suppliers or commercial partners, including where the information was not collected directly from you.

What we may collect and where it comes from

Business contact details: name, job title or role, employer, business email address, business telephone number and public professional profile details.
Company and supplier information: company name, location, products, manufacturing capabilities, delivery coverage, accreditations and other information relevant to assessing a potential supplier relationship.
Engagement information: our outreach history, replies, meeting notes, supplier-application status and any request not to be contacted again.

We may obtain this information from company websites, Companies House, trade associations and member directories, industry directories, professional networking services, other publicly available business sources, or from a colleague or business contact who refers us to the appropriate person.

Why we use it and our lawful basis

We use this information to identify and assess suitable UK suppliers, contact relevant business decision-makers about the GLAZIE supplier network, manage supplier discussions and applications, and develop commercial relationships. Where we process personal data for relevant business-to-business outreach, we generally rely on our legitimate interests in developing and operating our supplier network and establishing appropriate commercial relationships. We use targeted, proportionate outreach and consider the likely expectations and privacy impact on the individual. Where the Privacy and Electronic Communications Regulations (PECR) require consent or another specific condition for a recipient or communication, we apply those rules as well.

Your choice and right to object

You can object to the use of your personal data for direct marketing at any time. Every supplier-outreach email will identify us and provide a simple way to opt out. You can reply Unsubscribe or email suppliers@glazie.co.uk. We will stop using your personal data for direct marketing and may retain the minimum details needed on a suppression list so that we can respect your preference in future.

How long we keep supplier-prospecting information

We periodically review supplier-prospecting records and normally delete or anonymise them where there has been no meaningful interaction for 24 months. If you apply to become a supplier, enter into a supplier relationship, or another legal or operational retention requirement applies, relevant records may be kept for longer under the appropriate retention period. Suppression records may be retained for as long as reasonably necessary to ensure that an opt-out or objection continues to be respected.

Who we share it with

We may use service providers that support our business communications, email, hosting, security and supplier-management processes. They may process the information only as permitted by our arrangements with them and applicable law. We do not sell supplier-prospect personal data.

Supplier-prospecting information is kept separate from customer information. A prospective supplier does not receive customer data.

7. Where your data is processed

We are based in the United Kingdom and so are our manufacturers. Some of the service providers in section 3 process personal data outside the UK, or are based outside it.

Where personal data leaves the UK, we rely on a lawful transfer route recognised under UK data protection law: an adequacy regulation where one covers the country, or otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the law requires us to put in place. We do not claim that all data always stays in the UK, because that would not be accurate.

If you would like to know the current arrangement for a particular provider, email sales@glazie.co.uk and we will tell you.

8. How long we keep it

Account: until you ask us to delete it.
Orders, invoices, and transaction records: at least 6 years for tax purposes.
Documents you uploaded that never became a quote or order: 12 months, then deleted automatically. Uploads that did become one are kept with that order record.
Operational logs (webhook events, email logs, cron runs, usage analytics): between 90 days and 12 months depending on the log type, after which they are automatically purged.
Quotes you did not convert into orders: until they expire (currently 30 days after creation).

Our manufacturers keep much less, and for much less time. They hold your delivery and contact details only while they are needed for the job, an open complaint, remake or warranty case, or a legal duty of their own — not for the six years we keep the accounting record. Technical manufacturing records may be kept longer where a manufacturer legitimately needs them, keyed to the order number rather than to your name and address.

You have the right to:

Ask for a copy of the personal data we hold about you (right of access).
Have inaccurate data corrected (rectification).
Have data deleted in certain circumstances (erasure).
Object to or restrict certain types of processing.
Withdraw consent at any time where we rely on consent.
Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Come to us for any of these, including anything held by a manufacturer working on our behalf — they are required to pass your request to us rather than answer it themselves. If you have an account, you can download a copy of your data and delete your account yourself from the Privacy section of your account area. You can also email us at sales@glazie.co.uk to exercise any of these rights.

10. Contact

Email sales@glazie.co.uk for any privacy question or request.