Legal

Privacy Policy

Version 1.0 — in effect from 14 August 2026.

1. Who we are

SlabPreview is operated by Sideh Inc., a corporation incorporated under the laws of the Province of Ontario, Canada, with its place of business in Kitchener, Ontario (“SlabPreview”, “we”, “us”).

This policy explains what personal information we handle, why, where it goes and how long we keep it. It covers slabpreview.com, the provider console, the estimator application and the embeddable widget. It applies alongside our Terms & Conditions.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and with other privacy laws where they apply to us (section 15).

2. Two different roles

Almost every question about this product turns on which of these you are, so it is worth being explicit.

Section 3 is for the first group, section 4 for the second, section 5 for the third. Everything from section 6 onward applies to all three.

3. If you used a countertop business's estimator

The estimator is embedded on, or linked from, a fabricator's or stone yard's website. When you use it we may handle:

• The photograph you upload — typically of your kitchen — along with the intermediate images and the AI-generated previews produced from it.
• Measurements and job details — countertop runs, backsplash, cut-outs, edge profiles, the stone you picked, and the quote built from them.
• Contact details — your name, email address, phone number and postal or zip code, when you choose to send an enquiry or save a quote.
• Sign-in information — if you save quotes, we email you a one-time code to confirm the address is yours, or you may sign in with Google, in which case Google gives us your email address, name and profile picture. We never receive your Google password.
• Technical records — IP address, browser type and timestamps, in server logs kept for security and troubleshooting.

Please do not upload a photograph containing anything you would not want a stranger to see. Photograph the countertops, not the people, the paperwork or the screens. The image is shown to the business you are enquiring with, and it is read by an AI model (section 10).

Your enquiry goes to that business. If it forwards your enquiry to a partner fabricator or distributor through the Service, that is its decision and its responsibility. To ask what a business holds about you, to correct it, or to have it deleted, contact the business first — it is the one accountable. If you cannot reach it, write to us at privacy@slabpreview.com and we will help you get to the right place, and act on the business's instructions.

4. If you are a provider

For businesses that subscribe, and for their staff users, we hold:

• Account information — name, work email address, tenant role, a salted hash of your password (never the password itself), and API keys.
• Business information — company name, contact and notification addresses, service area, your logo, brand colours and the websites you embed on.
• Configuration — your catalogue, rates, pricing rules, slab imagery and partner relationships. Commercially sensitive, and treated as confidential under the Terms.
• Billing information — your Stripe customer and subscription identifiers, plan, invoices and payment status. We never see or store your card number; Stripe holds it.
• Usage records — how many AI previews were generated and when, which is what your allowance and invoice are calculated from.
• Access and audit records — sign-ins, and a record of every change made in your console by SlabPreview support staff, attributed to the individual staff member.
• Correspondence — messages you send through the contact form or by email, and a delivery record of the transactional emails we send you.

5. Website visitors

Reading slabpreview.com requires no account and sets no tracking of any kind. Our servers keep ordinary access logs (IP address, page requested, timestamp, user agent) for security and diagnostics. If you submit the contact form we receive what you typed — your name, email, company, business type and message — and use it to reply to you. We do not add you to a mailing list.

6. Why we use it

We do not sell personal information. We do not disclose it for anyone else's marketing, we do not send marketing email to a provider's end users, and we do not use one provider's data for another's benefit.

7. Consent

We collect, use and disclose personal information with consent, except where PIPEDA permits or requires otherwise.

For an estimator end user, consent is obtained by the business whose estimator you are using, at the point you choose to upload a photograph or send an enquiry, and is governed by that business's own privacy notice. Providers are required by our Terms to publish one and to obtain the consent the law requires of them.

For a provider, consent is given when you create an account and accept the Terms; some of the processing described above is necessary to perform our contract with you, and to meet legal and tax obligations.

You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice — but withdrawing consent for information we need to run the Service means we can no longer provide it.

8. Cookies and tracking

We use no tracking cookies, no analytics and no advertising technology — no Google Analytics, no pixels, no third-party tags, on any page or in the estimator. There is no cookie banner because there is nothing to consent to.

What the application does use is your browser's own storage, on your device, to keep you signed in:

• localStorage holds your session token so you stay signed in between visits.
• sessionStorage holds a support session that is deliberately scoped to a single browser tab.

Neither is sent to any third party, and clearing your browser storage signs you out. The embedded estimator runs in an iframe without cookies at all — access to a private image is granted by a signed link with an expiry rather than by a session cookie.

9. Who we share with

We share personal information only as described here: with the provider whose estimator an end user used; with a partner a provider itself chooses to forward a lead to; with the service providers below; and where the law requires it or to establish, exercise or defend legal claims. If our business is sold or merged, information may transfer with it, subject to this policy — we will give notice before it becomes subject to a different one.

Each service provider below is bound by contract to use the information only to provide its service to us, and to protect it to a comparable standard.

We keep this list current. Where we replace a provider, the replacement is engaged on materially equivalent terms.

10. AI processing

Two features send an uploaded photograph to Google's Gemini models: surface detection, which finds the countertops, backsplash and cabinetry in the image, and preview generation, which redraws those surfaces in a chosen stone.

• The models are not permitted to train on your content. We use the paid Gemini API under terms that exclude customer content from model training.
• Results are cached against the photograph so the same request is not sent twice — which also means one upload is not repeatedly re-sent to a third party.
• A photograph is sent only when the person using the estimator asks for detection or a preview.
• No decision with a legal or similarly significant effect is made about anyone by automated means. The output is an image and an indicative price; whether to quote, and at what price, is a human decision made by the business.

11. Where it is stored

The Service is hosted on Google Cloud Platform in North America. Our service providers are largely United States organizations, so personal information handled by the Service may be stored or processed outside Canada, including in the United States.

While information is in another country it is subject to that country's laws, and may be accessible to its courts and law-enforcement or national-security authorities under lawful process. That is true of any provider using foreign infrastructure; we state it here because PIPEDA requires that we do. Contractual protections are in place with each provider in section 9, but they cannot override a lawful order in the jurisdiction where the data sits.

12. Security

Safeguards appropriate to the sensitivity of the information, which for photographs of the inside of someone's home we treat as high:

• Encryption in transit (TLS) and at rest.
• Photographs, previews and saved quote images are held in private storage. They are never in a publicly readable location, and are reached only through a signed link that expires. Only slab imagery, swatches and provider logos — none of which are personal information — are served publicly.
• Passwords are stored only as salted hashes.
• Each provider's data is isolated at the application layer, and every request is scoped to the account that owns it.
• Support access to a provider's console is limited to authorised staff and every change is recorded against the named individual.
• Uploaded images are decoded and re-encoded server-side rather than stored as received.
• Access to production systems is limited to staff who need it.

No system is perfectly secure, and we cannot guarantee absolute security. Report a vulnerability or a suspected compromise to security@slabpreview.com; we will not pursue good-faith security research that respects user privacy and does not degrade the Service.

13. How long we keep it

Where a provider asks us to delete end-user information on an individual's behalf, we act on that instruction.

14. Your rights

Subject to the limited exceptions PIPEDA allows, you may:

• Access the personal information we hold about you, and be told how it has been used and who it has been disclosed to.
• Correct it where it is inaccurate or incomplete.
• Withdraw consent, subject to section 7.
• Ask for deletion where we are not required to keep it.
• Complain about how we have handled it (section 19).

Write to privacy@slabpreview.com. We will respond within 30 days, and will tell you if we need an extension the law permits. We may need to verify your identity first, and will not charge for a reasonable request.

If you used a countertop business's estimator, start with that business — under section 2 it is the one accountable, and it is the party able to decide. Where we receive such a request directly, we will forward it and act on the business's instructions.

Exceptions exist: we may decline where disclosure would reveal someone else's personal information, breach solicitor-client privilege, reveal confidential commercial information, or interfere with an investigation. We will tell you why, in writing.

15. Other privacy laws

PIPEDA is our baseline. Where another law applies to a particular person or piece of information — Quebec's Law 25, the UK or EU GDPR, or a US state privacy statute — we will honour the rights that law grants, including access, correction, deletion, portability and objection, and the right not to be discriminated against for exercising them. Ask at privacy@slabpreview.com and say which law you are relying on.

We do not sell personal information or share it for cross-context behavioural advertising, as those terms are used in US state privacy laws.

16. Children

The Service is intended for adults. It is sold to businesses, and the estimator is for people buying countertops. We do not knowingly collect personal information from anyone under 18. If you believe a child has submitted information, tell us and we will delete it.

17. Breaches

We maintain a process for identifying and responding to privacy breaches. Where a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, and keep the records the law requires us to keep. Where the breach affects a provider's end users, we will notify that provider without undue delay so it can meet its own obligations.

18. Changes

We may update this policy. The version number and effective date at the top change with it. For a material change we will email account holders at least 30 days before it takes effect. Changes required by law or to address a security risk may take effect immediately.

19. Contact and complaints

Sideh Inc., carrying on business as SlabPreview — Kitchener, Ontario, Canada.

Our Privacy Officer is accountable for compliance with this policy. Reach them at privacy@slabpreview.com, or use the contact form. Security reports: security@slabpreview.com. Legal notices: legal@slabpreview.com.

If we have not resolved your concern, you may complain to the Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376. If another privacy law applies to you, you may also complain to your own regulator.