Privacy Policy
This policy explains how SlabFlow ("SlabFlow", "we", "us") collects, uses, stores and shares personal information when a business ("customer", "shop") and its staff use the SlabFlow application, and when a visitor uses this website.
SlabFlow is operated by Chiche Hung, a sole trader, ABN 44 312 381 604, Western Australia, Australia. We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
1. Who this applies to
SlabFlow is business software: a stone or benchtop fabrication shop ("customer") signs up and its owner, office staff, measurers and production staff ("users") are given accounts by the shop. Separately, the shop's own customers may appear as records inside a job — SlabFlow calls this internal record "the client record". This policy covers both, and marks where the two differ.
2. What we collect
2.1 Account and user data
- Name, email address and role, used to create and manage a staff account
- Authentication data handled by our sign-in provider, Clerk (see §5) — SlabFlow itself does not store passwords
- Usage and log data generated by using the application (see §2.3)
2.2 Shop and job data (processed on the shop's behalf)
A shop's own operational data lives inside its SlabFlow account, entered by the shop's staff. We process this data on the shop's behalf and do not use it for any purpose beyond providing and supporting the service. It can include:
- The shop's own customer contact details, recorded against a job
- Job, quote, pricing and measurement records
- Site photos, videos and notes attached to a job
- Stone inventory and production records
A shop is responsible for having a lawful basis to give us its customers' personal information, and for its own dealings with its customers.
2.3 Technical and log data
Our servers and infrastructure generate operational logs (request metadata, error traces, timing) used for reliability, security and debugging. Log records are shipped to our logging provider, Axiom, and structured logging is written to redact known personal-data fields before it is sent.
2.4 Website visitors
This marketing website (slabflow.org) does not use cookies or analytics scripts, and does not collect personal information beyond what is inherent to any HTTP request (IP address, user agent) as handled by our hosting and edge provider, Cloudflare, and standard web server logs.
3. How we use data
- To provide, operate and support the SlabFlow application
- To authenticate users and secure accounts
- To send transactional email related to an account — for example account or password-related notices — sent through Amazon SES
- To monitor, debug and improve reliability and performance
- To meet legal obligations
We do not sell personal information, and we do not use shop or job data for advertising.
4. Transactional email
SlabFlow sends account-related transactional email — such as staff invitations and password-related notices — through Amazon Simple Email Service (SES). We do not send marketing email through this system, and email content is generated by the application, not entered freely by staff.
5. Who we share data with (sub-processors)
We use the following service providers to operate SlabFlow. Each processes data only as needed to provide their service to us.
- Clerk — user authentication and sign-in
- Amazon Web Services (AWS) — transactional email delivery via Amazon SES
- Cloudflare — DNS, content delivery, TLS, web application firewall and secure network access
- DigitalOcean — application and database hosting infrastructure
- Axiom — operational log storage, with personal-data fields redacted before ingestion
We do not share personal information with third parties for their own marketing purposes.
6. Where data is stored
Application data is hosted on infrastructure in Australia (DigitalOcean, Sydney). Some sub-processors above may process or store data outside Australia as part of their own infrastructure.
7. Data retention
We retain account and job data for as long as a shop's account is active, and for a reasonable period afterwards to meet legal, accounting and dispute-resolution requirements. A shop can request deletion of its account data by contacting us (see §9).
8. Your rights
Under the Australian Privacy Principles, you may request access to, or correction of, personal information we hold about you, and you may make a complaint about how we handle it. If you are a user of a shop's SlabFlow account, some requests may need to go through that shop, since it controls its own records.
9. Contact us
For any privacy question, access or correction request, or complaint, contact: hello@slabflow.org.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the latest version.