Privacy Policy
1. Who we are
SLABS is operated by AJ Investment UG (haftungsbeschränkt), Germany ("we"). This policy describes what we process when you use getslabs.io and the SLABS iPhone app, and why. Contact: hello@getslabs.io.
2. What we collect
- Account: your email address, name and profile photo as provided by Google or Apple sign-in. With Sign in with Apple you may hide your email; the relay address works fully.
- Collection data: the PSA cert numbers you import, and anything you add — purchase prices, acquisition dates, tags, binders, wishlists.
- Card data: for each cert, the public information PSA publishes about it (card name, set, grade, population, slab images) and public market data (sales, price history).
- Subscription status: from Apple (App Store) or Stripe (web) — plan and validity. We never see your card number; Apple and Stripe handle all payment details.
- Technical logs: standard server logs (IP address, request, time) kept briefly for security and debugging.
We do not run third-party advertising or ad tracking, and we do not sell your data.
3. What we never see
When you connect your PSA vault, you log in on PSA's own site inside a browser view. Your PSA password is entered on their pages, not ours — the app only receives the collection export you trigger. Payment details stay with Apple and Stripe.
4. Why we process it (legal bases, GDPR)
- Running the service you signed up for — storing and showing your collection, syncing between iPhone and web (contract, Art. 6(1)(b)).
- Generating the artwork scenes your cards are staged on, using the card's public identity (contract, Art. 6(1)(b)).
- Security, abuse prevention and debugging (legitimate interest, Art. 6(1)(f)).
- Emails about your account and imports; anything promotional only with consent you can withdraw (Art. 6(1)(a)).
5. Where it lives
Data is stored with Google Cloud (Firestore and Cloud Storage, EU region where available) and processed by our service providers under data-processing agreements: Google (hosting, sign-in), Apple (sign-in, subscriptions), Stripe (web payments), Resend (email). Where processing happens outside the EU/EEA, it is covered by the EU standard contractual clauses.
6. Sharing
Cards shown on Discover carry no cert number and are not linked to you publicly. Binders, wishlists or collections you explicitly share are visible to whoever has the link, with the details you chose to reveal. We disclose data to authorities only when legally required.
7. Retention and deletion
Your data is kept while your account exists. Delete your account and your collection data, wishlists and profile are removed from the service; backups roll off within 30 days. Server logs are kept no longer than 14 days.
8. Your rights
Under the GDPR you can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest — write to hello@getslabs.io. You can also complain to a data-protection authority; in Germany, the authority of your state.
9. Children
The service is not directed at children under 16, and we do not knowingly collect their data.
10. Changes
If this policy changes materially, we will say so in the app or by email before the change takes effect.