Privacy Policy
What LabelPeel collects, why we need it, who else handles it, and what you can ask us to do with it.
Who we are
LabelPeel is an online tool for making and printing labels from a spreadsheet, including Avery®-compatible sheets. We run it from Malta. On this page, "we" and "us" mean LabelPeel, Malta.
For your account details, we decide how the data is used. Under data protection law, that makes us the "controller".
For the lists you paste or upload, such as your guests' or customers' addresses, you decide what goes in and why. We only store and process that content to make your labels. For that content, we act as a "processor".
EU law applies, including the General Data Protection Regulation (GDPR).
What we collect and why
Your account. Your name, your email address, your password, when your account was made, and when you last signed in. Your role is either user or admin. Your password is stored only as a secure hash by our login provider, Supabase. We never see it.
We use this to log you in and to email you about your account, such as to confirm your email or reset your password. The legal basis is that we need it to give you the service you asked for.
Your label projects. The lists you paste or upload (names, addresses and any other columns), your label design, the pictures and logos you add, the AI chat messages in each project, a small preview of your list (the first 30 rows), and a word index. We use the word index for the search on your dashboard.
We use this so you can save, find and print your labels. The legal basis is that we need it to give you the service you asked for.
AI requests. When you type a change, such as "make Room A orange", our server sends the AI service:
- your request
- your column names
- up to 12 example rows from your list
- a short summary of each column, such as its most common values
- the current design and rules
- the recent chat in that project
We never send the whole list. The AI only sends back design changes. Labels themselves are made in your browser.
The AI model is Muse Spark 1.3 Contributor, made by Meta. We reach it through the OpenCode Go service (opencode.ai). OpenCode's documentation says this model is not "zero-retention". That means Meta may keep and use these requests to improve or train its models.
So please don't type anything sensitive into the AI box. Remember that example rows from your list are sent.
For each AI request, we also record your account, the time, and how many "tokens" the request used. We use this to apply the daily limit (100 requests a day by default) and to spot abuse.
The "Try it" box. The box on our home page works without an account. Your request, and the demo list as you edit it (up to 40 rows and 12 columns), go to the same AI service.
To limit use, we allow 8 requests an hour and 25 a day for each visitor. For this, we store a scrambled code made from your IP address, with the time. We use a salted SHA-256 hash, so we don't store the IP address itself. We delete these records after 2 days.
If you click "Keep these labels", the demo is saved only in your own browser, in local storage under the key "lp-try-doc". It stays there until you sign up. Then it becomes your first project.
PDFs. When you click "Download a PDF", your label design and list are sent to a Cloudflare service, Browser Run (formerly Browser Rendering). It turns the page into a PDF.
The PDF is stored briefly in our private Supabase storage. We delete it as soon as you download it. Files that are never downloaded are deleted automatically once they are more than 10 minutes old, the next time the PDF service runs.
Printing straight from the print window sends nothing. It all happens in your browser.
Emails. We send account emails, such as confirming your email, resetting your password and changing your email, through Resend (resend.com). They come from [email protected].
When someone makes an account, the owner of LabelPeel gets an email with the new user's name and email address. This helps us know who is using the beta.
Emails sent to [email protected] are forwarded to our own inbox by Cloudflare Email Routing. We use email to run and support the service. The legal basis is that we need it to give you the service you asked for, and our legitimate interest in running and supporting LabelPeel.
Technical logs. Like every website, we use hosting and database providers. Cloudflare hosts the site and server code, and Supabase runs our database. They process IP addresses and request details to deliver pages, keep the service secure and fight abuse. They also keep their own short-lived logs. The legal basis is our legitimate interest in security.
What we do not do
- We don't show ads.
- We don't use ad trackers or analytics tools.
- We don't set tracking cookies.
- We don't sell your data or share it for marketing.
- Our fonts, icons and scripts are served from our own site. We don't use Google Fonts.
Cookies and browser storage
We don't set cookies for tracking.
To keep you logged in, your login session is saved in your browser's local storage, under the key "lp-auth". The Try it demo uses the key "lp-try-doc". Both are needed for things you asked for, so we don't show a cookie banner.
Logging out removes your session. Clearing your browser's site data removes both keys.
Cloudflare may set a strictly necessary security cookie if it suspects bot traffic. This is part of its standard protection.
Who else handles your data
| Service | What it is used for | Where |
|---|---|---|
| Supabase (supabase.com) | Login, database and file storage | USA (AWS us-west-2, Oregon) |
| Cloudflare (cloudflare.com) | Hosting the website and server code, making PDFs, email forwarding and security | Worldwide network |
| OpenCode Go (opencode.ai) and Meta (the model maker) | The AI design helper | USA |
| Resend (resend.com) | Sending account emails | USA |
Some of these services are outside the EU, mainly in the USA. For these transfers, we rely on the safeguards the providers offer. These include the EU Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider takes part in it.
How long we keep things
- Your account and projects: until you delete them. Deleting a project in the dashboard removes it at once.
- Deleting your account: email [email protected] from your account email address. We delete your account, every project and your AI usage records within 30 days. Deleting the account removes them all together.
- AI usage records: as long as your account exists.
- Try it limit records: 2 days.
- PDFs: only minutes, as described above.
- Emails in our inbox: as long as we need them to help you.
Your rights
Under GDPR, you can ask us to:
- show you your data
- correct your data
- delete your data
- restrict how we use it
- object to how we use it
- give you your data in a portable form. Your projects are stored as data that we can export for you.
- withdraw your consent, where we rely on it
To ask, email [email protected]. We reply within one month.
If you aren't happy with our answer, you can complain to Malta's Information and Data Protection Commissioner (IDPC) at idpc.org.mt. You can also contact the data protection authority in your own country.
Security
- Supabase hashes your password.
- Every database row is locked to its owner. Row-level security means one account can't read another account's labels.
- All traffic uses HTTPS.
- Our server keys stay on the server.
Children
LabelPeel is not for children under 16. If you think a child under 16 has given us their data, email [email protected] and we will delete it.
Changes to this policy
If we change this policy, we'll update the date at the top of this page. For important changes, we'll also email everyone with an account before the change applies.
Contact
LabelPeel, Malta. Email [email protected], or visit our contact page. For a privacy request, write "Privacy" in the subject line.