SlabFlow is operated by SlabLabsAI LLC ("we," "us," or "our"). This policy explains what data we collect, how we use it, and your rights over it. By using SlabFlow, you agree to these practices.
Account data. Your email address and name when you create an account, and a record of your acceptance of our Terms of Service and this Privacy Policy (the timestamp and policy version).
Inventory data. Card records, grading submissions, cost basis entries, consignment records, and notes you create inside SlabFlow. This data belongs to you.
Card photos. Photos you upload are stored on Cloudflare R2 and served from a long, randomly generated (non-guessable) link unique to each image. These image links are not listed publicly or indexed, but they are not password-protected — anyone you share a link with, or who otherwise obtains it, can view that image. Do not upload photos containing information you would not want a link-holder to see. Deleting a photo (or your account) removes it from storage.
eBay data. When you connect eBay, we read your sold listings and fees to reconcile them against your inventory. We do not write to your eBay account. To maintain the connection we securely store the OAuth access and refresh tokens eBay issues to us; disconnecting eBay in the app deletes them.
Payment data. Billing is handled entirely by Stripe. We store your subscription tier and status — we never see or store your card number, CVV, or bank details.
Usage data. Standard server logs including IP address, browser type, pages visited, and timestamps. Used to diagnose errors and improve the product.
We do not sell your data. We do not use your inventory data for advertising.
We may create and use aggregated, anonymized, and de-identified data — data that does not identify you or any individual — to operate, analyze, develop, and improve our products, services, models, and market analytics. This aggregated data, and any insights or datasets derived from it, are owned by SlabLabsAI LLC. We will never sell data that identifies you.
We share data with the following processors only as needed to operate the service:
Each processor operates under their own privacy policy and data processing agreements.
We retain your account and inventory data for as long as your account exists. We do not automatically delete or purge inactive data — it is kept indefinitely until you ask us to remove it. When you request deletion (by email or by deleting your account), we will delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (typically 7 years for financial records). Deleted records may persist in encrypted backups for a limited period before rotation.
You have the right to:
To exercise any of these rights, email us at support@slabflowai.com. We will respond within 30 days.
SlabFlow sets cookies only for authentication and session management. We do not use advertising, analytics, or third-party cross-site tracking cookies. Product usage is measured with Vercel Analytics, which is cookieless and does not track you across other sites. When you start a subscription, payment is completed on Stripe's hosted checkout, where Stripe may set its own cookies for fraud prevention under its privacy policy. You can disable cookies in your browser, but the app will not function without session cookies.
All data is encrypted in transit (TLS) and at rest. Authentication is managed by Supabase with industry-standard session handling. Payment data never touches our servers — Stripe handles it end-to-end. OAuth tokens for connected integrations (such as eBay) are stored server-side only and are never exposed to your browser. Uploaded card photos are stored on Cloudflare R2 and addressed by an unguessable random link; treat that link as the access control for the image, since anyone holding it can view the photo.
SlabFlow is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe we have done so, contact us and we will delete it promptly.
We may update this policy as the product evolves. We will notify you by email and update the effective date above. Continued use after notice constitutes acceptance.
Questions about this policy? Email us at support@slabflowai.com or write to SlabLabsAI LLC, United States.