Privacy Policy

1. Information we collect

• Account information: name, email, role, and the shop you belong to.
• Inventory content: remnant and slab records, photos, dimensions, pricing, rack locations, and storefront branding you upload.
• Customer selections: contact details and choices that customers submit through a storefront or share link.
• Usage and device data: log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the Service.
• Payment data: handled by our payment processor; we do not store full card numbers.

Shops we contact: we keep business contact details of stone shops we reach out to about the Service (shop name, address, phone, the email and name of the person we spoke to, and our notes of the conversation). We collect these from shop websites, public listings and our own visits, and we use them to run our own sales outreach and to avoid contacting a shop that has asked us not to. We may also list a shop's public business details (name, address, phone, website) in our directory of shops that sell remnants. To ask us to stop contacting you, or to be removed from the directory, write to the address in section 12.

Marketplace requests: if you use our marketplace to ask a shop about a piece, we pass your name, phone number, email address and message to that shop and keep a copy so the shop can find it and so we can count the requests each shop receives. The shop is responsible for how it uses your details after that. We also record which pieces and shop pages are viewed on the marketplace, without cookies, using a salted hash of your IP address that cannot be turned back into it.

2. How we use information

We use information to provide, maintain, secure, and improve the Service; to authenticate users and enforce plan limits; to display your storefront and (where you opt in) network inventory and marketplace listings; to communicate about your account; to process payments; and to comply with legal obligations.

3. How information is shared

• Within your shop: your team members see your shop's data according to their role.
• Public storefronts: inventory you publish is visible to anyone with the link.
• Inventory network: if you opt in, a limited, reciprocal view of your inventory is shown to other participating shops. Contact details exposed to the network are limited (for example, phone and email, not rack locations or street address).
• Marketplace: if you opt in, the remnants your storefront already publishes, with your shop's name, address, phone number and a link to your storefront, are also shown on our consumer marketplace site and in the search engine listings that point to it.
• Service providers: cloud hosting, database, email, and payment processors that process data on our behalf under contract.
• Legal and safety: where required by law or to protect rights, safety, and the integrity of the Service.

We do not sell personal information.

4. Storage and security

Data is stored with our cloud and database providers. We apply administrative and technical safeguards, including tenant scoping so a shop's data is not exposed to other tenants, hashed secrets for API keys, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

5. Data retention

We keep information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. After account closure we delete or de-identify data after a reasonable period, subject to backups and legal requirements.

Outreach records about shops we contact, including a note that a shop asked not to be contacted, are kept for as long as we do outreach, because the record of who asked us to stop is what keeps us from asking again.

6. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. Shop managers can manage most account and inventory data directly in the app. For other requests, contact us using the details below. We will respond as required by applicable law.

7. Cookies and similar technologies

We use strictly necessary cookies and similar technologies to keep you signed in and to operate the Service.

One cookie is not strictly necessary. If you arrive through one of our tracked links (a short link we hand out in person or by message), we set a cookie named rf_src that lasts 7 days and records which link brought you here, so that if you request a demo we know which link produced the request. A second cookie with the same life, rf_src_seen, only tells the page to show you a one-line notice about this once. Neither is required to use the site, and you can clear both in your browser at any time.

8. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

9. International users

We may process and store information in countries other than yours. Where we transfer personal information across borders, we take steps to protect it as required by applicable law.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice. The "last updated" date at the top reflects the latest revision.

11. Governing law and disputes

This Privacy Policy, and any dispute about how we collect or handle personal information, is governed by the laws of the State of Maryland, USA, without regard to its conflict-of-laws rules.

If you have a concern about your personal information, contact us first at hugo@remnantflow.com. We will try to resolve it with you informally, and we aim to respond within 30 days.

Any dispute that cannot be resolved that way will be brought in the courts located in the State of Maryland, USA, which will have exclusive jurisdiction, unless applicable law gives you the right to bring it elsewhere. Nothing in this section limits any right you have under the law of the place where you live, including the right to complain to a data protection or consumer protection authority.

12. Contact

Questions or requests about this policy? Contact us at hugo@remnantflow.com.