SlabFlow is operated by SlabLabsAI LLC ("we," "us," or "our"). This policy explains what data we collect, how we use it, and your rights over it. By using SlabFlow, you agree to these practices.
Account data. Your email address and name when you create an account (or sign in with Apple), and a record of your acceptance of our Terms of Service and this Privacy Policy (the timestamp and policy version).
Inventory data. Card records, grading submissions, cost basis entries, consignment records, and notes you create inside SlabFlow. This data belongs to you.
People you do business with. When you use SlabFlow to run your selling, you may enter or receive details about other people. We store them only to run those features for you:
You are responsible for having the right to share these details with us. We do not use them to contact anyone except for messages you send through SlabFlow (for example a consignor statement or intake receipt).
Sales and money records. The sales you record or sync (price, fees, shipping, tax, buyer, date), your expenses, capital entries, buy tickets, store credit, consignor payouts, break and show sales.
Card photos. Photos you upload are stored on Cloudflare R2 and served from a long, randomly generated (non-guessable) link unique to each image. These image links are not listed publicly or indexed, but they are not password-protected — anyone you share a link with, or who otherwise obtains it, can view that image. Do not upload photos containing information you would not want a link-holder to see. Deleting a photo (or your account) removes it from storage.
Camera and photos. The iPhone app uses your camera only while you scan a card, slab or label, and only after you allow it. Photos you take or pick are stored as described under Card photos. Nothing is recorded in the background.
eBay data. When you connect eBay, we read your sold listings, orders (including the buyer's username) and fees to match them to your inventory. When you, or a manager on your team, choose to, we also create, change and end listings on your eBay account for you. To keep the connection we securely store the access and refresh tokens eBay issues to us; disconnecting eBay deletes them.
Payment data. On the website, billing is handled by Stripe. In the iPhone app, subscriptions are bought through Apple's App Store, and RevenueCat tells us which plan is active. We store your plan, its status and renewal date. We never see or store your card number, CVV or bank details.
Usage data. Standard server logs including IP address, browser type, pages visited, and timestamps. Used to diagnose errors and improve the product.
We do not sell your data. We do not use your inventory data for advertising.
We may create and use aggregated, anonymized, and de-identified data — data that does not identify you or any individual — to operate, analyze, develop, and improve our products, services, models, and market analytics. This aggregated data, and any insights or datasets derived from it, are owned by SlabLabsAI LLC. We will never sell data that identifies you.
We share data with the following processors only as needed to operate the service:
Each processor operates under their own privacy policy and data processing agreements.
We retain your account and inventory data for as long as your account exists. We do not automatically delete or purge inactive data — it is kept indefinitely until you ask us to remove it. When you request deletion (by email or by deleting your account), we will delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (typically 7 years for financial records). Deleted records may persist in encrypted backups for a limited period before rotation.
You have the right to:
To exercise any of these rights, email us at support@slabflowai.com. We will respond within 30 days.
You can delete your account in the iPhone app (Settings → Delete Account) or on the website. If your account owns a shop, the app sends us a deletion request and we close the shop with you first. An App Store subscription is managed by Apple: cancel it in iPhone Settings under your Apple ID, Subscriptions.
SlabFlow sets cookies only for authentication and session management. We do not use advertising, analytics, or third-party cross-site tracking cookies. Product usage is measured with Vercel Analytics, which is cookieless and does not track you across other sites. When you subscribe on the website, payment is completed on Stripe's hosted checkout, where Stripe may set its own cookies for fraud prevention under its privacy policy. In the iPhone app, payment is handled by Apple. You can disable cookies in your browser, but the app will not function without session cookies.
All data is encrypted in transit (TLS) and at rest. Authentication is managed by Supabase with industry-standard session handling. Payments on the website are handled by Stripe and in the app by Apple. We never see or store full card numbers. OAuth tokens for connected integrations (such as eBay) are stored server-side only and are never exposed to your browser. Uploaded card photos are stored on Cloudflare R2 and addressed by an unguessable random link; treat that link as the access control for the image, since anyone holding it can view the photo.
SlabFlow is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe we have done so, contact us and we will delete it promptly.
We may update this policy as the product evolves. We will notify you by email and update the effective date above. Continued use after notice constitutes acceptance.
Questions about this policy? Email us at support@slabflowai.com or write to SlabLabsAI LLC, United States.