1.Introduction and Scope

This Privacy Policy describes how SlabOS LLC (“SlabOS,” “we,” “us”) collects, uses, and shares information when you visit slabos.org, use the Service, or interact with us. It covers personal information SlabOS controls. Personal information SlabOS processes on a Customer's behalf is governed primarily by the Customer's privacy policy and our Data Processing Agreement (DPA) with that Customer.

2.Information We Collect

2.1 · Account information

Name, business email, company, phone number, role, and any profile information you provide.

2.2 · Customer Data submitted to the Service

Quotes, jobs, accounts, drawings, price lists, slab inventory, contact records, and uploaded files. This is generally controlled by the Customer (the shop) under our DPA.

2.3 · Usage data

Login times, feature usage, IP address, browser type, device characteristics, and session identifiers. Used to operate and improve the Service.

2.4 · Cookies and similar technologies

Essential cookies (authentication, security), functional cookies (preferences), and measurement cookies: our public marketing pages use Google Analytics 4 and Google Ads conversion measurement to understand traffic and measure our own advertising. The logged-in Service itself carries no advertising trackers, and we do not run social-media pixels or behavioral profilers anywhere.

2.5 · Information from integrations

When you connect Google Maps, QuickBooks, Stripe, or other integrations, we receive only the data necessary to operate the integration. Each integration follows the respective service's terms.

2.6 · QuickBooks Online integration

If you connect QuickBooks® Online (operated by Intuit Inc.), then — with your authorization through Intuit’s OAuth flow — we access your QuickBooks company data solely to provide the accounting features you enable: customers/accounts, invoices, estimates, items, and payments, together with your realm (company) identifier. We use this data only to create and synchronize invoices and quotes between SlabOS and your QuickBooks Online company, reflect payment status, and surface Intuit-hosted payment links. We store OAuth access and refresh tokens securely and use them solely to call the QuickBooks API on your behalf. We do not sell QuickBooks data, use it for advertising, or use it for any purpose unrelated to the integration you requested. You may disconnect at any time from SlabOS Settings or from Intuit’s “My Apps,” and on disconnect we revoke and delete the stored tokens; records already written to your QuickBooks company remain under your control in QuickBooks. Full integration terms are in our EULA. “QuickBooks” and “Intuit” are trademarks of Intuit Inc.; SlabOS is an independent application and is not affiliated with Intuit.

2.7 · Mobile phone number & SMS consent

If you request SMS verification — for example, a one-time passcode (OTP) to sign a contract on the SlabOS customer portal, or to secure your account — we collect your mobile phone number, a record of your opt-in consent, the verification codes we generate, and delivery metadata (timestamp and delivery status). We use this information solely to send the messages you request and to maintain a compliant record of consent. How this data is (and is not) shared is described in Section 5.6.

3.How We Use Information

• Provide, operate, secure, and improve the Service.
• Authenticate users and prevent fraud, abuse, and unauthorized access.
• Send transactional and service-related communications (account, billing, security, downtime).
• Provide customer support.
• Analyze aggregated, anonymized usage to improve product reliability and features.
• Comply with legal obligations and respond to lawful requests.

We do not use Customer Data (including pricing or commercial data) to train models or features visible to other customers.

4.Legal Bases for Processing

Where applicable law (such as PIPEDA) requires a legal basis, we process personal information based on: contractual necessity (to provide the Service), legitimate interests (security, fraud prevention, product improvement), consent (where required), and legal obligation.

2.Information We Collect (continued)

2.8 · Crew mobile app — device location

The SlabOS Crew app (iOS and Android) collects your device’s location only when the shop you work for has enabled crew location features, and only on working days — from your first job check-in of the day until your last job is completed. This can include collection while your screen is off; a visible notification is always shown while tracking is active, and tracking stops automatically when your day ends. We use this location to show the customer you are driving to a live arrival time, and to show your shop your position on its dispatch map.

If your shop requires a shop check-in before job details unlock, we verify your check-in using the location you submit and/or the network address (IP) your request arrives from, compared against the shop’s registered premises. Each check-in attempt — successful or not — is recorded with its time, result, approximate distance, and IP address, and is visible to your shop’s administrators.

If your shop enables route history, the day’s location trail is retained and shown to shop administrators as a day summary (path, stops, drive distance). Route history is deleted automatically after 90 days (Section 6).

2.9 · Crew mobile app — camera and photos

Photos you take in the app, or attach from your photo library, are uploaded to the job record you attach them to and stored with that job as Customer Data. We do not access your camera or photo library except for the capture or selection you initiate.

2.10 · Push notifications

If you enable notifications in the Crew app, we deliver them through Expo (Expo, Inc.), a notification delivery provider, which processes your device push token and the notification content (for example job names and message previews) in transit, under contractual terms consistent with Section 5. Signing out of the app removes that device’s push token from your account.

2.11 · Workplace features controlled by your employer

Some SlabOS features are workplace tools that your employer (the shop that holds the SlabOS account, our Customer) decides to enable and configure: crew location sharing and route history (2.8), shop check-in requirements (2.8), and team activity tracking — the approximate time signed-in team members spend actively using SlabOS, including time attributed to specific quotes. For these features the shop is responsible for providing any workplace notice required by local law; SlabOS processes this information on the shop’s behalf under our Data Processing Agreement. Where the product surfaces these figures, you can see your own — for example, your own session time is shown to you on your dashboard, and the location-sharing status is shown in the Crew app.

5.Information Sharing

5.1 · Subprocessors

We share information with subprocessors strictly to deliver the Service. Approved subprocessors are listed in our DPA (Annex B): Railway (hosting), Supabase (database), Telnyx (SMS), Resend (email), Anthropic (AI), OpenAI (embeddings where used), Google Maps (mapping), Cloudflare R2 (file & image storage), Sentry (error monitoring). Our AI subprocessors operate under commercial API terms that do not permit training their models on your data; prompts are scoped to the requesting tenant.

5.2 · Service providers

Professional services providers (accountants, lawyers, auditors) bound by written confidentiality obligations.

5.3 · Legal compliance

We may disclose information to comply with a lawful subpoena, court order, or government request, and to enforce our agreements. We push back on overbroad requests and notify Customers of legal process affecting their data where permitted.

5.4 · Business transfers

If SlabOS is involved in a merger, acquisition, or sale of assets, personal information may be transferred subject to the same protections described in this Policy.

5.5 · No sale of personal information

We do not sell personal information to any third party. We use Google Analytics and Google Ads conversion measurement on public marketing pages to measure our own advertising; we do not otherwise share personal information for cross-context behavioral advertising. Where applicable law treats measurement cookies as “sharing,” you may opt out by blocking cookies or emailing privacy@slabos.org.

5.6 · Mobile opt-in & SMS data — never shared for marketing

SlabOS sends transactional SMS only — one-time verification codes (OTP) for contract signing and account security — and only after you explicitly request them. Message frequency depends on your activity; standard message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

No mobile information — including your mobile phone number, SMS opt-in, and consent — is shared with or sold to any third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are excluded from all other sharing described in this Policy and will not be shared with any third party. We disclose your mobile number only to our messaging subprocessor (Telnyx) strictly to deliver the messages you request, and to comply with law.

6.Data Retention

• Customer Data: retained while account is active, then 60 days post-termination for export, then permanent deletion within an additional 60 days (subject to legal-hold requirements).
• Crew route history (2.8): deleted automatically 90 days after collection.
• Shop check-in records and team activity figures (2.8, 2.11): retained as part of the shop's Customer Data on the Customer Data lifecycle above.
• Account information: retained up to 7 years for tax, accounting, and legal record-keeping.
• Application logs: 90 days rolling.
• Backups: deleted in line with backup cycle, typically within 60 days of Customer Data deletion.

7.Data Security

We use TLS 1.2 or higher in transit, AES-256 (or equivalent) encryption at rest, bcrypt 12-round password hashing, multi-tenant isolation, role-based access controls, audit logging, encrypted backups, and a documented incident response plan. No security is perfect — if you discover a vulnerability, please report responsibly to security@slabos.org.

8.International Data Transfers

Data is primarily hosted in the United States and Canada. For any transfer outside North America (such as to a subprocessor's global infrastructure), we rely on Standard Contractual Clauses or equivalent safeguards.

9.Your Rights

9.1 · General rights

You may request to access, correct, delete, restrict, or port personal information we control about you, and to object to certain processing. To exercise rights, email privacy@slabos.org. We respond within statutory timelines.

9.2 · Canadian (PIPEDA) rights

Canadian users have the right to access and correct personal information, and to challenge our compliance by contacting our Privacy Officer at privacy@slabos.org. Unresolved complaints may be directed to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

9.3 · California (CCPA) rights

California residents have the right to know what personal information is collected, to delete personal information, to opt out of any “sale” or “sharing” (we do neither), and to non-discrimination for exercising these rights. Submit requests to privacy@slabos.org.

9.4 · Customer-controlled data

For personal information processed on a Customer's behalf, requests should be directed first to the Customer (the shop). We will assist Customers in fulfilling Data Subject requests per our DPA.

10.Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us and we will delete it.

11.Cookies and Tracking

We use essential and functional first-party cookies, plus Google Analytics 4 and Google Ads conversion measurement on our public marketing pages (not in the logged-in Service, and not on these legal pages). We do not use social-media pixels for ad targeting or behavioral profilers. You may disable cookies in your browser or use a tracker blocker — the Service functions without the measurement cookies, though some features may not function without the essential ones.

12.Changes to This Policy

We may update this Policy. Material changes will be notified via email (where you have an account) and in-app banner at least 30 days before they take effect. The effective date is shown at the bottom of this document.

13.Pricing & Commercial-Data Confidentiality

Customer Data of the highest sensitivity — including price lists, customer-specific pricing rules, margin data, and supplier discounts — is never shared with other Customers, prospects, or partners, and never exposed to any third party except the DPA-bound subprocessors that operate the Service (Annex B). For AI-assisted features you choose to use, only the minimum prompt context is sent to the AI provider, under terms that prohibit training on it. We do not use Customer pricing data to train models or product features visible to anyone other than that Customer. Tenant isolation is enforced at every layer of the Service.

14.Contact

Privacy inquiries: privacy@slabos.org

Security disclosure: security@slabos.org

General: max@slabos.org · +1 (236) 818-1740

Postal address: SlabOS LLC, c/o Registered Agent (Illinois Secretary of State). The current registered agent's address is available on request.

15.Effective Date

This Privacy Policy is effective as of August 2026. The most current version is always available at slabos.org/legal/privacy-policy.html.