Privacy Policy

This policy covers the Slab apps and services: Slab Reader (iPad), Slab Pad (desktop), the Slab website, and your Slab account. It explains what we store, why, and the rights you have over it. The data controller is E Labs Collection Ltd (company no. 17383365), registered in England and trading as E_Labs. Contact: support@slab-apps.com.

What we store

• Account — the pseudonymous identifier Apple gives us when you sign in, your email address (which may be Apple's private relay), the names of devices you've signed in from, your plan and, if you subscribe, the subscription status and renewal date Apple reports to us (never your card details).
• Your content — the documents you add, and the highlights, notes, comments and reading progress attached to them. Stored so we can sync them to your devices and, if you choose, your connected AI assistant.
• AI connections — when you connect an assistant we store a label (e.g. "Claude") and a hashed access key. We never see or store your credentials for any AI service.
• Notifications — if you turn on notifications, we store the device token Apple issues for your iPad so we can tell you when your AI replies. Turning notifications off, signing out or deleting your account removes it.
• AI activity — a short log of what your connected assistants did: which tool, which document, when, and whether it worked. The newest 200 entries, visible only to you in Settings → AI activity. We keep it so you can see what your AI did; it never contains document text.
• Ask requests — if you use Ask Now, the prompt you type and the document it refers to are queued for up to 15 minutes until your own listener collects them, then expire.
• Feedback — if you send feedback from the app we store your message, the email you choose to give, the app version and, if you leave the toggle on, a diagnostics snapshot (app and iPadOS version, device model, plan, storage used, notification status, number of AI connections, server host). No document content, no tokens. Feedback is also copied to our Notion workspace so we can track it.
• Payments — purchases are processed by Apple (App Store) or Lemon Squeezy (web). They are the merchants of record; we receive transaction and entitlement records, never your card details.
• Service logs — short-lived technical logs (including IP addresses) used for security, rate limiting and debugging.

What we don't do

• We never send your content to any AI provider. If you connect an assistant, it connects to us, using a key only you can create — and revoke at any time in the app. What your assistant does with what it reads is governed by your agreement with that provider.
• The one thing the app hands over itself, and only when you tap Ask AI: it opens your chosen assistant with a short prefilled request that contains the document's title and reference, so the assistant knows what to fetch. Nothing is sent until you tap, and you can edit or discard the request before sending it.
• We don't sell your data or use it for advertising.
• We don't train AI models on your content.

Reading without an account

If you never sign in, nothing leaves your iPad. Your documents, highlights and notes stay on the device; the only thing the app can send us is feedback you choose to write.

The website

slab-apps.com uses Vercel's privacy-respecting analytics, which set no cookies and do not identify you. We do not use Google Analytics or advertising pixels.

Where it lives

Content and account data are stored with Cloudflare (databases and object storage). The website is hosted by Vercel. Feedback you send is tracked in Notion. Our processors are Cloudflare, Vercel, Notion, Apple and Lemon Squeezy, each under their standard data-processing terms.

Legal basis and retention

We process your data to provide the service you signed up for (contract), and minimally for security and abuse prevention (legitimate interests). We keep it until you delete it: deleting a document removes it immediately; deleting your account (Settings → Delete account) permanently removes your documents, annotations, connections, AI activity and account record. Residual copies in infrastructure backups clear within 30 days. If your subscription ends we keep your library, read-only, until you delete it or your account; we do not delete it for you. Subscription records are kept for six years for tax and accounting.

Your rights

Under UK and EU data protection law you can access, correct, export, restrict or delete your data, and object to processing. Deletion and access are self-serve in the app (the export includes your subscription records); for anything else, email support@slab-apps.com. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local authority.

Children

The Slab services are not directed at children under 13.

Changes

If this policy changes materially we'll note it in the app and on this page before it takes effect.