1.Introduction and Scope

This Privacy Policy describes how SlabOS LLC (“SlabOS,” “we,” “us”) collects, uses, and shares information when you visit slabos.org, use the Service, or interact with us. It covers personal information SlabOS controls. Personal information SlabOS processes on a Customer's behalf is governed primarily by the Customer's privacy policy and our Data Processing Agreement (DPA) with that Customer.

2.Information We Collect

2.1 · Account information

Name, business email, company, phone number, role, and any profile information you provide.

2.2 · Customer Data submitted to the Service

Quotes, jobs, accounts, drawings, price lists, slab inventory, contact records, and uploaded files. This is generally controlled by the Customer (the shop) under our DPA.

2.3 · Usage data

Login times, feature usage, IP address, browser type, device characteristics, and session identifiers. Used to operate and improve the Service.

2.4 · Cookies and similar technologies

Essential cookies (authentication, security), functional cookies (preferences), and limited first-party analytics. We do not run third-party advertising trackers on slabos.org.

2.5 · Information from integrations

When you connect Google Maps, QuickBooks, Stripe, or other integrations, we receive only the data necessary to operate the integration. Each integration follows the respective service's terms.

2.6 · QuickBooks Online integration

If you connect QuickBooks® Online (operated by Intuit Inc.), then — with your authorization through Intuit’s OAuth flow — we access your QuickBooks company data solely to provide the accounting features you enable: customers/accounts, invoices, estimates, items, and payments, together with your realm (company) identifier. We use this data only to create and synchronize invoices and quotes between SlabOS and your QuickBooks Online company, reflect payment status, and surface Intuit-hosted payment links. We store OAuth access and refresh tokens securely and use them solely to call the QuickBooks API on your behalf. We do not sell QuickBooks data, use it for advertising, or use it for any purpose unrelated to the integration you requested. You may disconnect at any time from SlabOS Settings or from Intuit’s “My Apps,” and on disconnect we revoke and delete the stored tokens; records already written to your QuickBooks company remain under your control in QuickBooks. Full integration terms are in our EULA. “QuickBooks” and “Intuit” are trademarks of Intuit Inc.; SlabOS is an independent application and is not affiliated with Intuit.

2.7 · Mobile phone number & SMS consent

If you request SMS verification — for example, a one-time passcode (OTP) to sign a contract on the SlabOS customer portal, or to secure your account — we collect your mobile phone number, a record of your opt-in consent, the verification codes we generate, and delivery metadata (timestamp and delivery status). We use this information solely to send the messages you request and to maintain a compliant record of consent. How this data is (and is not) shared is described in Section 5.6.

3.How We Use Information

• Provide, operate, secure, and improve the Service.
• Authenticate users and prevent fraud, abuse, and unauthorized access.
• Send transactional and service-related communications (account, billing, security, downtime).
• Provide customer support.
• Analyze aggregated, anonymized usage to improve product reliability and features.
• Comply with legal obligations and respond to lawful requests.

We do not use Customer Data (including pricing or commercial data) to train models or features visible to other customers.

4.Legal Bases for Processing

Where applicable law (such as PIPEDA) requires a legal basis, we process personal information based on: contractual necessity (to provide the Service), legitimate interests (security, fraud prevention, product improvement), consent (where required), and legal obligation.

5.Information Sharing

5.1 · Subprocessors

We share information with subprocessors strictly to deliver the Service. Approved subprocessors are listed in our DPA (Annex B): Railway (hosting), Supabase (database), Telnyx (SMS), Resend (email), Anthropic (AI), OpenAI (embeddings where used), Google Maps (mapping), Cloudflare R2 (file & image storage), Sentry (error monitoring).

5.2 · Service providers

Professional services providers (accountants, lawyers, auditors) bound by written confidentiality obligations.

5.3 · Legal compliance

We may disclose information to comply with a lawful subpoena, court order, or government request, and to enforce our agreements. We push back on overbroad requests and notify Customers of legal process affecting their data where permitted.

5.4 · Business transfers

If SlabOS is involved in a merger, acquisition, or sale of assets, personal information may be transferred subject to the same protections described in this Policy.

5.5 · No sale of personal information

We do not sell personal information to any third party. We do not share personal information for cross-context behavioral advertising.

5.6 · Mobile opt-in & SMS data — never shared for marketing

SlabOS sends transactional SMS only — one-time verification codes (OTP) for contract signing and account security — and only after you explicitly request them. Message frequency depends on your activity; standard message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

No mobile information — including your mobile phone number, SMS opt-in, and consent — is shared with or sold to any third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are excluded from all other sharing described in this Policy and will not be shared with any third party. We disclose your mobile number only to our messaging subprocessor (Telnyx) strictly to deliver the messages you request, and to comply with law.

6.Data Retention

• Customer Data: retained while account is active, then 60 days post-termination for export, then permanent deletion within an additional 60 days (subject to legal-hold requirements).
• Account information: retained up to 7 years for tax, accounting, and legal record-keeping.
• Application logs: 90 days rolling.
• Backups: deleted in line with backup cycle, typically within 60 days of Customer Data deletion.

7.Data Security

We use TLS 1.2 or higher in transit, AES-256 (or equivalent) encryption at rest, bcrypt 12-round password hashing, multi-tenant isolation, role-based access controls, audit logging, encrypted backups, and a documented incident response plan. No security is perfect — if you discover a vulnerability, please report responsibly to security@slabos.org.

8.International Data Transfers

Data is primarily hosted in the United States and Canada. For any transfer outside North America (such as to a subprocessor's global infrastructure), we rely on Standard Contractual Clauses or equivalent safeguards.

9.Your Rights

9.1 · General rights

You may request to access, correct, delete, restrict, or port personal information we control about you, and to object to certain processing. To exercise rights, email privacy@slabos.org. We respond within statutory timelines.

9.2 · Canadian (PIPEDA) rights

Canadian users have the right to access and correct personal information, and to challenge our compliance by contacting our Privacy Officer at privacy@slabos.org. Unresolved complaints may be directed to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

9.3 · California (CCPA) rights

California residents have the right to know what personal information is collected, to delete personal information, to opt out of any “sale” or “sharing” (we do neither), and to non-discrimination for exercising these rights. Submit requests to privacy@slabos.org.

9.4 · Customer-controlled data

For personal information processed on a Customer's behalf, requests should be directed first to the Customer (the shop). We will assist Customers in fulfilling Data Subject requests per our DPA.

10.Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us and we will delete it.

11.Cookies and Tracking

We use only essential and functional first-party cookies. We do not use third-party advertising trackers, social-media pixels for ad targeting, or behavioral profilers. You may disable cookies in your browser, though some features may not function.

12.Changes to This Policy

We may update this Policy. Material changes will be notified via email (where you have an account) and in-app banner at least 30 days before they take effect. The effective date is shown at the bottom of this document.

13.Pricing & Commercial-Data Confidentiality

Customer Data of the highest sensitivity — including price lists, customer-specific pricing rules, margin data, and supplier discounts — is never shared with other Customers, prospects, partners, or any third party. We do not use Customer pricing data to train models or product features visible to anyone other than that Customer. Tenant isolation is enforced at every layer of the Service.

14.Contact

Privacy inquiries: privacy@slabos.org

Security disclosure: security@slabos.org

General: max@slabos.org · +1 (236) 818-1740

Postal address: SlabOS LLC, c/o Registered Agent (Illinois Secretary of State). The current registered agent's address is available on request.

15.Effective Date

This Privacy Policy is effective as of July 2026. The most current version is always available at slabos.org/legal/privacy-policy.html.