Privacy Statement

SyncSlabs is run by [Company name B.V. / eenmanszaak] (KvK [KvK number]), [Street and number, postcode, city, The Netherlands]. This statement explains what personal data we handle and why, as the General Data Protection Regulation (in Dutch, the AVG) requires. Questions and requests: [privacy@yourdomain].

There are two situations, and the difference matters for who you should ask:

• People who sign in (the owner and members of a workspace): we are the controller of their account data, described below.
• Everyone else whose details a business keeps in SyncSlabs – its customers, suppliers and staff: the business that entered them is the controller and we are its processor. If you are one of those people and want to see, correct or delete your details, ask that business. If you ask us, we pass your request on to them.

Account data – name, email address, a password (stored only as a one-way hash by our sign-in provider), the settings for two-step sign-in if you use it, the workspaces you belong to and your role in each, and that you accepted these terms. We use it to let you sign in and to run your account (legal basis: performing our agreement with you or your business). We also use your email address to send messages about the account itself, such as invitations and password resets.

Business data you enter – customers (name, company, email, telephone, addresses, notes), suppliers, staff (name, email, telephone, notes), slabs, reservations, production jobs, measurements, photos and files. We hold it for the business and use it only to provide the service.

Emails we send for a business – when a business uses the service to tell a customer about a measurement visit or a job, or to tell a staff member about a task, we send that email on its behalf, to the address it gave.

Technical data – your IP address and browser details in server logs and in the limits that stop repeated sign-in attempts, and technical details of errors (see section 5). We use these to keep the service secure and working (legal basis: our legitimate interest in security and in fixing faults).

Records the law requires – where we must keep invoices and payment records, for example for the Dutch tax authorities, we keep them for the period the law sets (currently seven years).

We do not sell personal data, and we do not use it for advertising or profiling. The service has no analytics or tracking tools.

A business can give its customer a link to a page that shows the progress of their job and lets them approve a drawing. The link contains a long code; anyone who has the link can open the page, so a customer should treat it like a password and not share it. The page shows the job, the status and the dates the business chose to show, and does not show the customer’s other jobs.

We use the following providers to run the service. They may handle personal data only on our instructions.

• Supabase – Database, sign-in and file storage. Data: Everything in an account: members, customers, staff, suppliers, slabs, jobs, photos and files. Where: European Union (Germany, Frankfurt).
• Vercel – Hosting the website and the application server. Data: Everything that passes through the application, in transit; connection logs including IP addresses. Where: European Union (Germany, Frankfurt) for the application server - the provider is a US company.
• Resend – Sending email (invitations, password resets, measurement and job notices to customers and staff). Data: Recipient name and email address and the content of the message. Where: European Union (Ireland) - the provider is a US company.
• Upstash – Rate limiting, to stop password guessing and abuse. Data: IP address or user id, kept for a few minutes. Where: European Union (Germany, Frankfurt) - the provider is a US company.
• Sentry – Error monitoring, so we can find and fix faults. Data: Technical details of an error, the user id and workspace id; never names, emails, form contents or cookies. Where: European Union (Germany).

Where a provider handles data outside the European Economic Area, we rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses, so that the data has the protection the AVG requires. Apart from these providers we give data to others only when the law requires it, or with your permission. Within a workspace, the business’s own members see its data according to their role.

When something goes wrong in the application, a report goes to Sentry, hosted in the European Union. It holds the technical details of the fault, your user id and your workspace’s id. It does not contain names, email addresses, what you typed in forms, cookies or the address you were on beyond the page path, and we have switched off the storing of IP addresses. Reports are deleted after about 90 days.

We use only what the service needs to work: a sign-in session that keeps you signed in, and a few settings kept in your browser (such as label printing choices). These need no consent under Dutch law. We use no advertising or tracking cookies, so there is no cookie banner. You can delete cookies in your browser; you will then be signed out.

• Account data: as long as the account exists.
• Business data: as long as the workspace exists, and then deleted within 30 days after the agreement ends, unless the law requires us to keep something. An item a business deletes in the application is marked as deleted and hidden; on request we remove it permanently. Backups age out on their own schedule.
• Rate-limit records: a few minutes. Server logs: for the limited time our hosting provider keeps them. Error reports: about 90 days.
• Invoices and payment records: seven years.

Data is encrypted in transit; every workspace’s data is separated in the database so that one business cannot reach another’s; members have roles; repeated sign-in attempts are limited; and two-step sign-in is available. No system is perfectly secure. If a breach puts your rights at risk we will tell you and the authorities as the law requires.

You may ask us for access to your personal data, correction, deletion, restriction of its use, a copy in a usable format (portability), and you may object to processing based on our legitimate interest. Email [privacy@yourdomain]; we may ask you to prove who you are, and we answer within one month. For data a business keeps about you, see section 1.

If you think we handle your data wrongly, please tell us first so we can put it right. You may also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

SyncSlabs is for businesses and is not meant for anyone under 16. We do not knowingly collect their data.

We may update this statement. The date at the top shows when the current text took effect, and for a change that matters we tell account holders by email or in the application. The Terms of Service set out our agreement with a business, including our role as its processor.