Privacy Policy

1.Who we are

Technic PPF Studio (“Technic”, “we”, “us”) is a vehicle paint protection film, ceramic coating, wrap and window tint studio at Bay A, 645 37 Ave NE, Calgary, AB, Canada. This policy covers technicppfstudio.ca and the booking, quote and shop tools that run on it.

Our website and shop software are built and maintained for us by Forged Studios, which acts as our service provider (see Service providers and sharing). Technic is responsible for the personal information described here. Questions go to technicppfstudio@gmail.com.

2.Information we collect

Information you give us

When you request a quote, book online, use a booking link, or contact us, we collect:

• Contact details — first and last name, email address and phone number. (Quick requests can be made with a phone number only; email is optional there.)
• Vehicle details — year, make, model, size or type, and optionally trim and colour.
• Booking and quote details — the services you are interested in, the coverage or result you want, the vehicle’s current condition, preferred timing, requested drop-off and pickup times, and any notes you add.
• Photos you choose to upload through your booking link (see Photos and attachments).
• Your responses — for example accepting or declining a quote, or choosing a pickup time.
• Messages you send us by email, phone, text, Instagram or in person, and the details our team records from them.

Information our team records while working on your vehicle

• Booking records: status, dates and times (drop-off, check-in, expected completion, pickup), services, quotes and their line items, prices, tax, and a record of payments taken at the shop (amount, method and reference). We do not take card payments online.
• Vehicle check-in, progress and finished-work photos.
• An activity history for each booking — who changed what and when, and a copy of each email we sent about it — and an internal audit log of staff actions.

Information collected automatically

• Our hosting and cloud providers process technical information such as IP address, browser type and request logs to deliver, protect and troubleshoot the site.
• To limit spam and abuse, our booking system keeps a one-way hash of the network address a request came from (not the address itself), with timestamps, and counts recent requests per email address and phone number.
• We keep internal statistics about bookings (for example which services and vehicle sizes are booked, and prices) that do not include your name, email or phone number.

We do not use advertising trackers, analytics services or tracking pixels on this website.

Staff accounts

For Technic team members who sign in to our shop software, we keep their name, email address, role and sign-in account, and we record their actions in booking histories and the audit log.

3.How we use information

• To respond to quote requests and prepare quotes.
• To schedule, confirm, change and manage bookings, and to plan shop capacity.
• To carry out the work on your vehicle — including documenting its condition at check-in — and to tell you when it is ready.
• To communicate with you about your quote, booking or vehicle.
• To record payments and keep business and accounting records.
• To keep our systems secure, prevent abuse and fraud, and fix problems.
• To comply with legal obligations and resolve disputes.

We do not sell personal information, and we do not use customer information or email content for advertising.

4.Emails and communications

Automated service emails

Our booking system sends operational emails about your quote or booking. Depending on the booking and the settings we have turned on, these include request received and booking confirmations, quotes and quote acceptance, drop-off reminders, vehicle received notices, ready-for-pickup notices, pickup reminders, reschedule and cancellation notices, and — only where we have enabled them — aftercare and review requests. We may also send you a one-off message about your booking.

These emails are sent from Technic’s business Gmail address through Google’s mail service. A copy of each one is kept in your booking’s history. We do not send marketing emails through the booking system, and we do not send text messages from it.

Conversations with us

If you email Technic, your email is in our business mailbox. When the Gmail connection described below is turned on, our team can see and answer that conversation inside our shop software alongside the automated emails for your booking, and can link it to your customer record or booking.

5.Google account integrations

Our shop software can optionally connect to Google so our team can work from one place. These connections are for Technic’s own business accounts — customers never connect a Google account.

• Only an authorized Technic administrator can connect or disconnect a Google account, from the shop software’s settings, and only after signing in to Google and approving Google’s consent screen.
• Google Calendar and Gmail are separate connections with separate permissions. Either can be used without the other, and both are optional — bookings work without them.
• When a connection is made we record the connected Google account’s email address and Google account identifier, and which administrator connected it. We do not collect the Google account’s name, profile photo or contacts.

The permissions (OAuth scopes) we request are:

6.Gmail data

If an authorized administrator connects Technic’s business Gmail account, the shop software uses it to provide a shared Shop Inbox and a communication history for each customer and booking.

What the permission allows

Google’s gmail.modify permission gives the app access to the whole connected mailbox, not only customer emails: it can read, send and label messages. It does not allow permanently deleting messages, and our software does not delete, trash or report messages as spam, and does not change Gmail filters or settings.

What we read and copy

• When first connected, the software copies recent conversations — roughly the last 30 days, up to a limited number of conversations — from any sender, plus older conversations (up to about a year) with people who are already Technic customers, again up to a limited number.
• After that, Google notifies the software when the mailbox changes, and new or changed conversations are copied so the Shop Inbox stays current.
• Spam and trash are excluded. Other mail — including newsletters, promotions and messages from people who are not customers — can be copied if it falls within the ranges above.

For each copied conversation we store:

• The subject, the names and email addresses of participants, dates, short previews, and read/archived state.
• The plain-text body of each message, up to a size limit. Message HTML is not stored or displayed, so remote images and tracking pixels in emails are never loaded.
• The names, types and sizes of attachments (the files themselves are fetched from Gmail only when opened — see Photos and attachments).
• Links to Technic customers and bookings, made automatically when a participant’s email address matches a customer record, or by our team — including remembering, when our team chooses to, that an email address belongs to a particular customer.
• Technical message identifiers (Gmail’s message and conversation IDs and the email Message-ID and References headers), used to keep replies in the right conversation and to make sure an email is never sent twice.

What our team can do

• View conversations and customer email history.
• Send new emails, reply and reply-all from the business address, with attachments.
• Mark conversations read or unread, archive them, or move them back to the inbox.
• Search conversations in the Shop by subject, preview, participant names and addresses, and linked customer name.
• Link or unlink a conversation to a customer or booking.

Copied mail is visible to Technic administrators and active Technic shop staff who have access to our shop software. It is not visible to customers or to the public.

When our team sends an email from the Shop, we also record the recipient, subject, whether Gmail accepted it, and which team member sent it (kept against the Gmail message ID). If the conversation is linked to a booking, a short note is added to that booking’s history.

7.Google Calendar data

If an authorized administrator connects Google Calendar, the shop software:

• Identifies the connected Google account (email address and account identifier).
• Creates one dedicated calendar named “Technic PPF Studio” in that account, or reuses it if it already exists.
• Creates, updates and removes events in that calendar for confirmed bookings — drop-off, expected ready time and pickup. Events show the customer’s name and phone number, the vehicle, the services, the booking reference, the times, and a link to the booking in our shop software. They do not include the customer’s email address, notes or prices, and no invitations are sent to customers.
• Stores the calendar and event identifiers and sync status needed to keep those events up to date, and remembers which calendar belongs to each Google account that has been connected (account identifier, email address and calendar ID), so reconnecting the same account reuses the same calendar instead of making another.

The permission we request only lets the app see and manage the calendars and events it created. It cannot read or change the account’s other calendars or personal events, and our software does not attempt to.

Technic bookings remain the source of truth. Editing an event directly in Google Calendar does not change the booking.

8.Apple and other calendar subscriptions

An administrator can also create a private calendar subscription link (an ICS feed) for Apple Calendar or other calendar apps. It does not use a Google account. The feed contains the same booking details as the Google Calendar events above, for active bookings and bookings completed in roughly the last 60 days.

Anyone who has the link can read the feed, so we treat it as private. We store an encrypted copy of the link (so an administrator can copy it again) and which administrator created it. An administrator can regenerate the link (the old one stops working) or turn it off at any time.

9.Apple Calendar personal availability (staff)

This is optional and is for Technic staff and administrators, not customers. It works in the opposite direction from the calendar subscription above: a team member can let Technic read when they are busy in their own Apple (iCloud) calendars, so that the booking system does not offer times they cannot cover. Each person connects only their own calendars.

What the team member provides

• Their Apple Account email address and an Apple app-specific password they create for Technic (never their Apple Account password). We check them with Apple before storing anything; if Apple refuses them, nothing is kept.
• Which of their calendars count, whether all-day events block the whole day, and what they do at the shop (installs, and/or takes drop-offs and pickups).

What we read and store

• The email address and app-specific password are encrypted by our servers (AES-256-GCM, with a key held in Google Secret Manager) and stored where no website or shop screen can read them. They are used only on our servers to connect to Apple, and are never shown again, logged or sent to a browser. Screens show a masked form such as “s***@icloud.com”.
• The list of the person’s calendars (names, colours, kinds) and their iCloud calendar addresses, which include an Apple account identifier. Calendar names are shown only to that person.
• For the calendars they choose: only the start and end times of busy events, within the booking period we need (with current settings, about the next four months), plus sync markers. Titles, descriptions, locations, attendees, links and notes are read in memory to work out the times and are not stored. Subscribed calendars, reminders and Technic’s own schedule are never read.
• The booking page receives only the effect: for each day, how many installer minutes are unavailable and which drop-off or pickup times are not offered. It contains no names and no event times.

Technic never creates, changes or deletes anything in Apple Calendar. Busy times are refreshed about every five minutes. Administrators can see who has connected, what it affects and whether it is working, but not anyone’s calendar names or events.

10.Photos and attachments

Photos you upload

You can add photos of your vehicle through your booking link (JPEG, PNG or WebP). They are resized in your browser before upload, which also removes location data embedded in the photo. Only Technic sees them; they are not posted anywhere.

Photos we take

Our team may photograph your vehicle at check-in to document its condition, during the work, and when finished. These are stored privately with your booking and are visible only to Technic staff. Photos in our public gallery are uploaded separately and are not taken from bookings automatically.

Email attachments

• When Gmail is connected, attachments stay in Gmail and are fetched only when a team member opens one.
• Images can be previewed; PDFs and plain-text or CSV files can be downloaded. Other file types are not opened in our software and must be opened in Gmail. Images and PDFs are checked to confirm they really are that type of file, and no attachment is displayed as a web page or run as code.
• Very small images typical of tracking pixels, and small embedded signature images, are hidden from the attachment list.
• An image attachment is copied into a booking’s photos only when a team member deliberately chooses to save it there.

11.Limits on how we use Google data

In practice, this means information we receive from Google Calendar and Gmail:

• Is used only to provide and improve the calendar, inbox and customer-communication features of our shop software described above.
• Is not sold, and is not used or transferred for advertising, including retargeting or interest-based advertising.
• Is not used to develop, train or improve artificial intelligence or machine-learning models, and is not given to data brokers.
• Is transferred only to the service providers that host and run our software (see below), where needed to provide these features, for security, to comply with the law, or as part of a merger or sale of the business where Google’s policy allows it.
• Is read by people only as part of using the features — that is, Technic’s own team working in its own mailbox and calendar — or, for anyone else (including Forged Studios), only with Technic’s permission for specific messages, where needed to investigate a security issue or abuse, or to comply with the law.

12.Service providers and sharing

We share personal information only as needed to run our business and the service, and never sell it. The organizations that process it for us are:

• Google — Firebase and Google Cloud host this website and store and process our booking, customer, photo and communication data (hosting, database, file storage, cloud functions, sign-in for staff, secret storage and system logs). Google also provides the Gmail account our service emails are sent from, and — when connected — Google Calendar and the Gmail API.
• Apple — when a team member connects Apple Calendar personal availability, our servers sign in to Apple iCloud Calendar with that person’s app-specific password to read their busy times. We send Apple nothing else.
• Forged Studios — builds, maintains and supports our website and shop software, and has technical access to our systems for that purpose only.
• Specialist partners — if part of your job is done by a specialist we work with, we tell you, and they receive only the vehicle, the services and the drop-off time — not your name, email address or phone number.

We may also disclose information:

• where required by law, or to protect our rights, customers or staff;
• to a buyer or successor if our business is sold or reorganized, subject to this policy.

13.Where data is stored and how it is protected

Our data is stored and processed on Google Cloud and Firebase infrastructure, which may be located outside Canada, including in the United States, where it may be subject to the laws of that country.

Safeguards we use include:

• Access to booking, customer, photo and communication data is limited to signed-in Technic staff and administrators; customers can see only their own booking through a private link.
• Google sign-in credentials (refresh tokens) are encrypted by our servers before being stored, are kept in storage that our website and shop screens cannot read, and are never sent to anyone’s browser. Short-lived access tokens are used only on our servers.
• Apple app-specific passwords for staff calendar availability are protected the same way: encrypted before storage, readable only by our servers, never sent to a browser.
• Connections to our website and to Google use HTTPS.

No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization. If you believe your information has been compromised, contact us.

14.Retention and deletion

We keep customer, vehicle, booking, quote, payment and photo records for as long as they are needed to provide our services and support you afterwards (for example, warranty questions), and for accounting, security, dispute-resolution and legal purposes. We have not set fixed deletion periods for these records.

• Disconnecting Gmail stops all access and synchronization, deletes our stored Google credentials, and removes the Shop’s copy of synced conversations and messages (this happens in the background shortly after disconnecting). It does not delete anything in the Gmail mailbox itself. We keep the related business records created while it was connected: records of emails sent from the Shop (recipient, subject, send status and sender), which team member sent each Shop email (by Gmail message ID), remembered links between email addresses and customers, booking history notes, audit entries, photos staff saved to bookings, the connected account’s email address and Google account identifier, and which administrator connected it and when.
• Disconnecting Google Calendar stops event updates and deletes our stored Google credentials. It does not delete any bookings, and it does not delete the “Technic PPF Studio” calendar or its events from Google — an administrator can delete those in Google Calendar. Our record of which events belonged to which booking, of which calendar belongs to which Google account, and of the connected account’s email address and identifier and which administrator connected it, is kept.
• When a connection is removed we ask Google to revoke our access. Google revokes access per Google account, so if Calendar and Gmail were connected with the same Google account, access ends at Google once both are disconnected. Access can also be removed at any time from the Google account’s third-party access settings.
• Calendar subscription links stop working as soon as they are regenerated or turned off.
• Disconnecting Apple Calendar availability (by the person, by an administrator, or automatically when their staff access is removed) stops all reading at once and deletes the stored email address and app-specific password, the calendar list and addresses, and every busy time derived from it; those times stop affecting bookings immediately. Nothing in Apple Calendar is changed. We keep audit entries recording who connected, changed or disconnected it and when, with counts of calendars — not calendar names or times. The app-specific password stays valid at Apple until the person removes it at account.apple.com; changing their Apple Account password also revokes it. If Apple stops accepting it, the last busy times keep counting for at most three days and then stop.

There is no self-service deletion tool for customers. To ask us to delete or correct your information, contact us (see Contact us). We will delete what we are able to, and tell you about anything we must keep and why.

15.Cookies, device storage and embedded content

• Our website does not set advertising or analytics cookies.
• To make rebooking easier, your browser stores your name, email, phone number, vehicles and links to your recent bookings on your device after you book or request a quote. You can clear this with “Not you?” in the booking form or by clearing your browser’s site data. Staff sign-in uses Google’s Firebase Authentication, which stores sign-in information in the browser.
• Some pages embed content from other companies — a Google Maps map, and images from our Instagram account in the gallery. Loading them lets those companies receive information such as your IP address and may let them set their own cookies, under their own privacy policies.

16.Your choices

• You can ask us questions or make a booking by phone or in person instead of online.
• You can choose not to upload photos, and to leave optional fields blank.
• You can ask us to stop sending optional emails such as aftercare or review requests. Emails that are needed to carry out a booking you have made, such as confirmations, will still be sent.
• You can ask to see, correct or delete your information (see below).

17.Your privacy rights in Canada

Under applicable Canadian privacy law, including Alberta’s Personal Information Protection Act, you may ask to access the personal information we hold about you, ask us to correct it, and withdraw consent to uses of it, subject to legal and contractual limits (withdrawing consent may mean we cannot provide a service). You may also ask how your information has been used and shared, including with service providers outside Canada.

Send requests to technicppfstudio@gmail.com. We may need to confirm your identity before acting on a request. If you are not satisfied with our response, you can contact the Office of the Information and Privacy Commissioner of Alberta.

18.Children

Our services and online booking are intended for vehicle owners and other adults. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

19.Changes to this policy

We will update this policy when our practices or software change. The effective date at the top shows when it was last changed. If we make a significant change to how we use Google data, we will update this policy before the change takes effect.

20.Contact us