Privacy Policy

1. Information we collect

• Account information: name, email, role, and the shop you belong to.
• Inventory content: remnant and slab records, photos, dimensions, pricing, rack locations, and storefront branding you upload.
• Customer selections: contact details and choices that customers submit through a storefront or share link.
• Usage and device data: log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the Service.
• Payment data: handled by our payment processor; we do not store full card numbers.

Shops we contact: we keep business contact details of stone shops we reach out to about the Service (shop name, address, phone, the email and name of the person we spoke to, and our notes of the conversation). We collect these from shop websites, public listings and our own visits, and we use them to run our own sales outreach and to avoid contacting a shop that has asked us not to. We may also list a shop's public business details (name, address, phone, website) in our directory of shops that sell remnants. To ask us to stop contacting you, or to be removed from the directory, write to the address in section 12.

Find Remnants requests: when you send a request on findremnants.com (about a listed piece, about a stone in Explore, or asking us to help find a stone that is not listed), or when you call, email or text Find Remnants, your request comes to Find Remnants first. No shop receives it automatically.

We review it, and we may contact you ourselves. If a local shop may have what you need, we send your name, phone number, email address, address and message, and what you asked about, to that one shop, and the shop contacts you. The shop keeps its copy in its own RemnantFlow account and is responsible for how it uses your details after that.

We keep your request, our review of it (whether we treated it as a genuine request and which shop we sent it to) and, when the shop tells us, whether it led to a job. We use these to follow up with you and to count the requests each shop receives. Photos you attach are seen only by Find Remnants and are never sent to a shop.

2. How we use information

We use information to provide, maintain, secure, and improve the Service; to authenticate users and enforce plan limits; to display your storefront and (where you opt in) network inventory and marketplace listings; to communicate about your account; to process payments; and to comply with legal obligations.

3. How information is shared

• Within your shop: your team members see your shop's data according to their role.
• Public storefronts: inventory you publish is visible to anyone with the link.
• Inventory network: if you opt in, a limited, reciprocal view of your inventory is shown to other participating shops. Contact details exposed to the network are limited (for example, phone and email, not rack locations or street address).
• Find Remnants: if you opt in, the remnants your storefront already publishes are also shown on Find Remnants (findremnants.com) and in the search engine listings that point to it, without your shop's name, address, phone number or town. Your shop's location is used only to sort and filter pieces by distance from a buyer's ZIP code.
• Find Remnants requests: we send a buyer's request to the one shop we choose to help them, as described in section 1.
• Service providers: cloud hosting, database, email, and payment processors that process data on our behalf under contract.
• Legal and safety: where required by law or to protect rights, safety, and the integrity of the Service.

We do not sell personal information.

4. Storage and security

Data is stored with our cloud and database providers. We apply administrative and technical safeguards, including tenant scoping so a shop's data is not exposed to other tenants, hashed secrets for API keys, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

5. Data retention

We keep information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. After account closure we delete or de-identify data after a reasonable period, subject to backups and legal requirements.

Outreach records about shops we contact, including a note that a shop asked not to be contacted, are kept for as long as we do outreach, because the record of who asked us to stop is what keeps us from asking again.

6. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. Shop managers can manage most account and inventory data directly in the app. For other requests, contact us using the details below. We will respond as required by applicable law.

7. Cookies and similar technologies

We use strictly necessary cookies and similar technologies to keep you signed in and to operate the Service.

Your privacy choices: we remember them in two cookies on this site. rf_privacy records your choices, and rf_privacy_off lists only the purposes you turned off (for example "analytics"), so that a choice to turn something off is kept even where your browser shortens how long cookies last. Neither identifies you. A choice to turn something off stays in effect, unless you change it, for as long as your browser keeps these cookies: up to 400 days after you last saved a choice. It ends sooner if you clear your cookies or your browser removes them, and then we treat you as not having chosen yet. A choice to allow something lasts 90 days; after that it is treated as not given until you allow it again.

Cookieless measurement: unless you save Analytics off in Privacy settings, or your browser sends a Global Privacy Control signal, we count:

• page views and page performance, with Vercel Web Analytics and Speed Insights, and, on shop storefronts, a few actions with no personal details attached, such as a click on the shop's phone, text or email link, a request form being opened or started, or a request being sent;
• which listings are opened, with the time;
• the searches people run on Find Remnants and on shop storefronts: the filters chosen, the words typed, the first three digits of a ZIP code, how many results came back and, when there were none, which filter change would have found some;
• on Find Remnants, which controls people use: which filter was changed (never what it was changed to), which tab, header or footer link was used, the position in a list of a piece that was opened (not which piece), whether a piece was saved, which steps of a request form were reached and which kind of box needed correcting (never what was typed), taps on our phone, text or email links, and which listing photos failed to load, how often a page failed in the browser and which kinds of link led to a missing page (a count, without the error's details), each kept to the hour and not linked to any other action or to any request you send;
• how many times each of our printed QR codes is scanned.

These counts set no cookie and store no identifier in your browser. The search, listing-view, control-use and QR-scan records we now keep contain neither your IP address nor a code made from it, and a search is not linked to you or to any request you send. Some older records of listing views, clicks and sent requests do include a scrambled code made from visitors' IP addresses; we no longer create that code. Older Find Remnants listing views also include the browser's user-agent string, which we no longer store. If search words look like an email address, phone number, web address or street address, we discard them; please do not type personal details into a search box. We use these counts to see what people look for and cannot find, and which pieces and materials interest them. Saving Analytics off stops them.

Visit journeys on Find Remnants: if you allow analytics in Privacy settings (Accept all includes it), Find Remnants also records the order of pages and actions within one visit in the browser tab you are using: the kind of page you open (for example the remnants list or a piece page, never its full address or what you searched for), which filters and links you use, which pieces you open, whether a search found anything, and which steps of a request form you reach, each with the time to the minute. It never records what you type, the contents of a form, your screen or your mouse movements. To do this it keeps a random visit code in your browser's session storage (fr_measurement_v2), not in a cookie. The code is deleted when you close the tab, a new one starts after 30 minutes without activity, and a visit ends after at most 4 hours. If you also allow referral attribution, the first step of a visit also keeps the campaign or site that sent you, from a fixed list, but never an ad click identifier. We do not store your IP address or browser user-agent string with these records, and they are not linked to any request you send or to your name, email or phone number. We delete them after 30 days; deleted records can remain in our database backups for up to 7 more days. Saving Analytics off, or a Global Privacy Control signal, stops them at once, deletes the visit code from your browser and deletes the record of the visit in progress, keeping only its random code and the minute it ended (so a late step cannot restart it), which is deleted with everything else after 30 days.

Optional analytics on remnantflow.com: if you allow analytics in Privacy settings, our own marketing pages also use Google Analytics, provided by Google LLC, to count page visits. Google Analytics sets cookies whose names start with rf_ga4 for up to 90 days. Google receives the page visited and, if you also allow referral attribution, the campaign or site that sent you, but never your name, email, phone number or anything you type into a form. Advertising features, Google signals and ad personalization stay off. On findremnants.com, if you allow analytics, Find Remnants uses Google Analytics the same way to count page visits and successful requests, including Explore quote requests, with cookies whose names start with fr_ga4 for up to 90 days. If you also allow referral attribution there, Google receives the ad click identifier and may set Google Ads measurement cookies so an inquiry from an ad can be counted; ad personalization, remarketing and Google signals stay off. Google Analytics does not run on shop storefronts or inside the app. You can withdraw this choice in Privacy settings at any time, which stops collection and removes those cookies.

Optional browser error reports: if you allow error reporting in Privacy settings, a page that fails in your browser sends a technical report to Sentry, our error-monitoring provider, and to our support inbox. The report keeps the error, the page address without its query string, and the browser, and leaves out what you type. Session replay is off. Turning error reports off stops them.

Choice notice on findremnants.com: on your first visit, and again 90 days after you chose Accept all (or if your saved choice is no longer in your browser), Find Remnants shows a short notice with three buttons. Accept all allows analytics (including the Google Analytics use above), referral attribution (including Google Ads counting an inquiry that came from an ad click) and browser error reports. Reject saves all three off, which also stops the cookieless counts. Choose opens Privacy settings so you can pick each one. The notice does not appear, and optional collection stays off, when your browser sends a Global Privacy Control signal.

Where a Find Remnants request came from: if you allow referral attribution and send a request, we save the campaign and the Google Ads click code that brought you to the site in that browser tab with your request, so we can tell which ads produced real inquiries. If you do not allow it, nothing of the kind is saved. The request forms also have an optional question, How did you find us? This information stays with Find Remnants: it is not sent to a shop or to Google.

Choice notice on remnantflow.com: on your first visit to our own marketing pages, and again 90 days after you chose Accept all (or if your saved choice is no longer in your browser), RemnantFlow shows a short notice with two buttons of equal weight and a Choose link. It appears on each of those pages until you choose, and the page stays usable behind it. Accept all allows analytics (including the Google Analytics use above), referral attribution and browser error reports. Decline saves all three off, which also stops the cookieless counts. Choose opens Privacy settings so you can pick each one, with nothing selected in advance. The notice does not appear, and optional collection stays off, when your browser sends a Global Privacy Control signal. The Demo and the signed-in app do not show this notice; their choices stay in Privacy settings.

Choice notice on shop storefronts: on your first visit to a shop's storefront hosted by RemnantFlow, and again 90 days after you chose Accept all (or if your saved choice is no longer in your browser), the storefront shows a short notice with two buttons of equal weight and a Choose link. Each storefront keeps its own choice, separate from Find Remnants and remnantflow.com. Accept all allows analytics, referral attribution and browser error reports; Google Analytics does not run on storefronts. Decline saves all three off, which also stops the cookieless counts. Choose opens Privacy settings so you can pick each one, with nothing selected in advance. The notice does not appear, and optional collection stays off, when your browser sends a Global Privacy Control signal, and it does not appear when a storefront is shown inside another website.

One cookie is not strictly necessary. If you allow referral attribution and arrive through one of our tracked links (a short link we hand out in person or by message), we set a cookie named rf_src that lasts 7 days and records which link brought you here, and we record the visit with a scrambled code made from your IP address so we can tell repeat visits apart, so that if you request a demo we know which link produced the request. A second cookie with the same life, rf_src_seen, only tells the page to show you a one-line notice about this once. Neither is required to use the site, and you can clear both in your browser at any time.

8. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

9. International users

We may process and store information in countries other than yours. Where we transfer personal information across borders, we take steps to protect it as required by applicable law.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice. The "last updated" date at the top reflects the latest revision.

11. Governing law and disputes

This Privacy Policy, and any dispute about how we collect or handle personal information, is governed by the laws of the State of Maryland, USA, without regard to its conflict-of-laws rules.

If you have a concern about your personal information, contact us first at hugo@remnantflow.com. We will try to resolve it with you informally, and we aim to respond within 30 days.

Any dispute that cannot be resolved that way will be brought in the courts located in the State of Maryland, USA, which will have exclusive jurisdiction, unless applicable law gives you the right to bring it elsewhere. Nothing in this section limits any right you have under the law of the place where you live, including the right to complain to a data protection or consumer protection authority.

12. Contact

Questions or requests about this policy? Contact us at hugo@remnantflow.com.