Legal & Privacy

Effective date: 2026 September 29th

These Terms of Service ("Terms") govern your access to and use of The Label Kitchen, a web-based label and document design platform ("Service"), operated by The Label Kitchen LLC, a limited liability company registered in the State of Minnesota ("Company," "we," "us," or "our").

By creating an account or using the Service, you agree to be bound by these Terms. If you do not agree, do not use the Service.

If you have a separate written agreement with us, such as a Managed plan agreement, it prevails over these Terms where they conflict.

1. Eligibility

You must be at least 18 years old and capable of forming a binding contract to use the Service. By using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

2. Accounts

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. You are responsible for everyone you give access to, including workspace members and the API tokens they create. Only the account holder can reopen a closed account or transfer what it owns. We do not move accounts, billing groups, or their content between people on anyone else's request. You agree to notify us immediately of any unauthorized use. We reserve the right to suspend or terminate accounts that violate these Terms.

3. Subscription & Payment

The Service offers a free plan and paid subscriptions. Some features require a paid subscription. Paid subscriptions are billed on a recurring monthly basis. Payments are processed by our merchant of record, Creem ("Creem"), which handles billing, tax collection, and payment processing on our behalf. Your purchase is subject to Creem's Terms of Service.

If a paid subscription ends, your account moves to the free plan's limits. You choose which templates stay active, and that choice is final until you subscribe again. Until you choose, editing and exports are paused. Your other templates are kept, can be viewed, and remain available for export as data under Section 11.

Prices are listed on our website and may be updated with 30 days' notice. Existing subscribers will be notified before any price change takes effect on their next billing cycle.

4. Free Trials & Early Access

We may offer free trials or early-access periods at our discretion. At the end of a trial, continued access to paid features requires an active subscription. We may modify or discontinue trial offers at any time.

5. Acceptable Use

You agree not to: (a) use the Service for any unlawful purpose; (b) attempt to reverse-engineer, decompile, or derive source code from the Service; (c) interfere with or disrupt the integrity or performance of the Service; (d) access the Service through automated means (bots, scrapers) except via our published API; or (e) resell access to the Service without written authorization.

6. Intellectual Property

All rights, title, and interest in the Service, including its software, design, trademarks, and documentation, are owned by us or our licensors. Templates and documents you create using the Service are yours. "Templates" means the visual designs you create and their rendered outputs, including PDF and ZPL exports. The underlying schema, data model, rendering engine, and internal representations used to store and process templates are part of the Service and remain the property of us or our licensors.

Exports may include structured data that describes your templates, such as field paths and variable definitions. You may use that data freely, including to move your templates to another service.

7. Data & Privacy

Your use of the Service is also governed by our Privacy Policy, published at https://the.label.kitchen/legal-and-privacy, which describes how we collect, use, and protect your information.

8. Service Availability

We strive to maintain high availability but do not guarantee uninterrupted access. We may perform scheduled maintenance or experience outages. We are not liable for any loss resulting from Service downtime.

9. Limitation of Liability

To the maximum extent permitted by law, we shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the Service. Our total aggregate liability shall not exceed the amount you paid us in the twelve (12) months preceding the claim.

10. Termination

You may cancel your subscription at any time through your account settings or by contacting us, unless a separate written agreement (such as a Managed plan agreement) sets a minimum term. If you close your account before a minimum term ends, the fees for the rest of that term become due as a single payment within 30 days, unless we agree otherwise in writing. We may suspend or terminate your access for violation of these Terms, with or without notice. Upon termination, your right to access the Service ceases immediately.

For 30 days after termination, whatever the reason for it, you may request an export of your exportable data, as defined in Section 11, in the formats described there, and we will provide it. After that period, the data is deleted and we will not recover it.

Sections that by their nature should survive termination (including Intellectual Property, Limitation of Liability, and Governing Law) will survive.

11. Switching and Data Portability

You may switch to another provider, or to your own systems, at any time. To start, contact us through the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy. Your notice takes effect on the date you choose, no more than two months after you contact us.

From that date: (a) for up to 30 days, the Service keeps running on your current plan and we provide your exportable data; you can end this period sooner by telling us you are done; (b) your data then remains available for you to retrieve for at least 30 more days; and (c) after that, we erase your exportable data, unless you ask us to keep it longer.

Our assistance covers our side of the switch: how to export your data, and what the exported files contain and how they are structured. We will answer those questions from you or from a provider you authorize. We do not set up, configure, or support any other system, and questions about it are outside our support.

Exportable data includes your templates as ZPL files with their field definitions embedded as JSON comments; your address tables and lookup tables as CSV files; and your account, workspace, and settings data as a JSON file. These are structured, commonly used, machine-readable formats. Our software, rendering engine, and internal representations (Section 6) are not exportable data.

We do not charge for switching. Fees for the period before your switch completes follow your normal plan. Switching does not end a minimum term early; Section 10 applies to the fees for the rest of that term.

12. Modifications

We may update these Terms and our other policies, such as the Privacy Policy and Refund Policy, from time to time. When we make material changes to any of them, we will notify you by email or in the app at least 14 days before you are required to accept them. From that date, you must accept every revised policy to keep using the Service, including the API. Until you do, your access is paused, and your data is kept and remains available for export under Section 11. If you do not accept a revised policy, you may cancel under Section 10, and your data remains available for export as described there.

13. Assignment

We may assign or transfer these Terms, together with your account and your data, to an affiliate, or to anyone who takes over all or part of our business, including through a reorganization, a change of legal form or jurisdiction, a merger, or a sale of assets. We will notify you at least 30 days before the transfer takes effect. The successor will be bound by these Terms and our Data Processing Agreement. If you do not agree, you may cancel before the transfer takes effect and export your data as described in Section 10.

A transfer may require you to renew a paid subscription through the successor's payment account. If so, the notice will explain how, and we will time the change so that you are not billed twice for the same period.

You may not assign or transfer these Terms without our written consent.

14. Governing Law

These Terms are governed by the laws of the State of Minnesota, without regard to conflict-of-law principles. Any disputes shall be resolved in the state or federal courts located in Minnesota.

15. Contact

Questions about these Terms? Use the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy.

Effective date: 2026 September 29th

This Privacy Policy explains what personal data The Label Kitchen LLC ("we," "us," or "our") collects when you use The Label Kitchen, including its API (the "Service"), why we collect it, and what rights you have.

1. Who We Are

The Label Kitchen LLC is a limited liability company registered in the State of Minnesota, United States. To reach us about this policy or your data, use the "Help" button in the app or the email address at the top of https://the.label.kitchen/legal-and-privacy.

2. What This Policy Covers

We handle personal data in two roles:

• As controller, for data about you as our user: your account, sign-in, support conversations, and records of what you agreed to. This policy covers that data.
• As processor, for data our customers put into the Service: templates, address tables, uploaded data files (such as EDI documents), and API requests. These often contain names and addresses of other people, such as a customer's shipping recipients. We process that data only on our customer's instructions, under our Data Processing Agreement. If your details appear in a label or document made with the Service, the company that made it decides how your data is used, and you should contact them. If you contact us instead, we will pass your request on to them.

3. Information We Collect

Account information. Your email address and your first and last name. Sign-in is passwordless: we email you a one-time code, which expires after 10 minutes, so we do not store a password.

Sign-in and security information. For each signed-in session, the IP address and browser type (user agent). Depending on our settings, a new account is either approved automatically or reviewed by a person before it is activated. We also check whether a new email address closely matches an existing account, to prevent duplicate and abusive accounts; a close match is always held for a person to review.

Policy acceptance records. When you accept a version of our Terms of Service, this Privacy Policy, or another policy, we record which version you accepted, when, and the IP address and browser type used.

Workspace information. The names of your workspaces, who is a member or owner of each, and the API tokens created in them (we store a one-way fingerprint and the first few characters of each token, never the full token, plus when it was created and last used).

Usage information. Counts of what you do in the Service, such as the number of exports and files uploaded, linked to your account and workspace. These counts do not contain the content of your labels or files.

Support conversations. Everything you send through the "Help" chat: the subject and text of your messages, our replies, and any files you attach, such as screenshots or sample data files. Attachments are stored in our file storage (Section 5) and can contain whatever you put in them, including other people's personal data, so please share only what we need to help you. If you use the chat without signing in, we also collect your email address, the name you give, and the IP address the conversation started from, and we verify the email address with a one-time code.

Billing information. Payments are handled by our merchant of record, Creem (see Section 5). We receive and store your plan, subscription status, billing dates, and Creem's customer and subscription identifiers. We never receive or store your card details.

Operational logs. Our servers log requests and errors, including IP addresses, to keep the Service running and secure. If processing a file fails, the error message may include a fragment of that file.

4. How We Use Your Information, and Why We May

We use personal data only for the purposes below. Each one is listed with its legal basis under the EU and UK GDPR:

• Creating and running your account; signing you in; providing the Service and its features. Legal basis: Performance of our contract with you (Article 6(1)(b)).
• Sending emails the Service needs: sign-in codes, support replies, and notices about your account, billing, and policy changes. Legal basis: Performance of our contract with you (Article 6(1)(b)).
• Answering support questions from signed-in users. Legal basis: Performance of our contract with you (Article 6(1)(b)).
• Answering support questions from people who are not signed in. Legal basis: Our legitimate interest in answering questions people send us (Article 6(1)(f)).
• Reviewing new accounts, detecting duplicate accounts, rate limiting, and keeping logs to protect the Service from abuse and attacks. Legal basis: Our legitimate interest in keeping the Service secure (Article 6(1)(f)).
• Keeping records of which policy versions you accepted. Legal basis: Our legitimate interest in being able to show what was agreed (Article 6(1)(f)).
• Counting usage to apply plan limits and to understand which features are used. Legal basis: Performance of our contract with you (Article 6(1)(b)) and our legitimate interest in improving the Service (Article 6(1)(f)).
• Keeping billing and accounting records, and responding to lawful requests from authorities. Legal basis: Compliance with legal obligations (Article 6(1)(c)).

We do not send marketing emails, sell personal data, or use it for advertising.

5. Who We Share It With

We share personal data only with the service providers below, and only as far as they need it to do their job:

• Scaleway (Scaleway SAS, France): hosting, database, file storage, server logs, and transactional email (sign-in codes and support emails). Location: European Union.
• Creem (Armitage Labs OÜ, registry code 16977866, Tallinn, Estonia): our merchant of record, which sells and bills subscriptions. Creem acts as an independent controller for payment and billing data, under its own privacy policy. Location: European Union.
• Proton (Proton AG, Switzerland): our business email. Processes emails you exchange with us. Location: Switzerland.

We may also disclose personal data if the law requires it, for example in response to a court order, or to a successor if our business is transferred as described in our Terms of Service. The current list of sub-processors for customer data is in Annex A of our Data Processing Agreement.

6. International Transfers

The Service runs on servers in the European Union. We are based in the United States, and our personnel access data from there to operate and support the Service. For customer data we process as a processor, that access is covered by the Standard Contractual Clauses in our Data Processing Agreement. Switzerland, where our email is hosted, is recognized by the European Commission and the United Kingdom as providing adequate protection.

7. How Long We Keep It

• Your account and its content, including your support conversations and their attachments: for as long as your account is open.
• Closed accounts: deleted 30 days after closure, the period during which you can request an export under our Terms of Service.
• Inactive free accounts: if a free account has no sign-in for 24 months, we email a warning to its address and close the account 30 days later unless someone signs in. It is then deleted like any closed account, 30 days after closure. An account on a paid plan is not treated as inactive while its subscription is active.
• Support conversations from people who are not signed in: the messages, attachments, email address, name, and IP address are deleted 24 months after the last message.
• Server logs: 7 days.
• Backups: taken daily and kept for 7 days, so deleted data leaves our backups within 7 days.
• Sign-in codes: expire after 10 minutes and are deleted once used.
• Policy acceptance and billing records: kept after an account closes only for as long as needed to meet legal obligations or to establish or defend legal claims, then deleted.

8. Cookies and Browser Storage

We use only what the Service needs to work. We do not use analytics, advertising, or tracking cookies, so we do not ask for cookie consent.

• Session cookie: keeps you signed in.
• active_workspace: remembers which workspace you last used. Kept for up to 1 year.
• lk_guest: links a support conversation to your browser when you are not signed in. Kept for 2 hours.
• lk_support_pending (browser storage, not a cookie): when you use the Help chat without signing in, it keeps your message, email address, and name in your browser while you enter the verification code, so a reload does not lose them. It is removed once the message is sent, and ignored after 10 minutes.

9. Security

We protect personal data with encryption in transit (TLS/HTTPS), access checks on every request so that each customer can reach only its own workspaces and data, restricted administrative access, rate limiting, internal security review of changes to the Service, and secure deletion when accounts close. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

10. Your Rights

Depending on where you live, you have the right to access your personal data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on legitimate interests (Section 4), you can object, and we will stop unless we have compelling grounds to continue. To use any of these rights, contact us as described in Section 1. We will answer within one month.

If you are in the European Economic Area or the United Kingdom, you also have the right to complain to a data protection supervisory authority: in the EEA, the authority in the country where you live or work; in the United Kingdom, the Information Commissioner's Office. We would appreciate the chance to address your concern first.

11. Automated Decisions

We do not make decisions about you by automated means that have legal or similarly significant effects. New accounts may be approved automatically, but an account is never rejected without a person deciding.

12. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their personal data. If we learn that we have, we will delete it.

13. EU and UK Representatives

Where we are required to appoint a representative under Article 27 of the EU GDPR or the UK GDPR, we will do so and publish their details here.

14. Changes to This Policy

We may update this Privacy Policy. When we make material changes, we will notify you by email or in the app at least 14 days before you are required to accept them, as described in Section 12 of our Terms of Service.

15. Contact

Questions about this Privacy Policy or your data? Use the "Help" button in the app or the email address at the top of https://the.label.kitchen/legal-and-privacy.

Effective date: 2026 September 29th

This Data Processing Agreement ("DPA") forms part of the agreement between The Label Kitchen LLC ("Processor," "we," "us," or "our"), a limited liability company registered in the State of Minnesota, and the entity or individual using The Label Kitchen, including its API (the "Service," as defined in our Terms of Service) ("Controller," "you," or "your"). This DPA supplements our Terms of Service and governs the processing of personal data by us on your behalf.

By creating an account and accepting our Terms of Service, you enter into this DPA. This DPA satisfies the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation ("EU GDPR"), and any successor legislation.

If you have signed a separate data processing agreement with us, or a Managed plan agreement that includes data processing terms, those terms prevail over this DPA where they conflict, and later versions of this DPA do not change them unless that agreement says so. The Standard Contractual Clauses in Annex B prevail over both, as they require.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in the UK GDPR and EU GDPR. "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, transmission, erasure, and destruction. "Data Subject" means the identified or identifiable natural person to whom Personal Data relates. "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Scope and Purpose of Processing

Subject matter: The Processor provides a web-based label and document design platform. In the course of providing the Service, the Processor may process Personal Data submitted by the Controller through templates, address tables, related workspace data, uploaded data files (such as EDI documents), and requests to the API.

Duration: Processing continues for as long as the Controller has an account. Following account closure or termination, Personal Data is retained for up to 30 days solely to allow for export or recovery, after which it is erased.

Nature and purpose: Storage and retrieval of template configurations, address data, and workspace metadata necessary to operate the Service. Rendering and generation of labels and documents using data provided by the Controller, whether through the web application or the API. Data files and API request contents are processed only to produce the requested output and are not stored afterwards. The Processor records usage counts, which contain no Personal Data. If processing fails, the resulting error message may include a fragment of the input; such messages are kept in operational logs for up to 7 days.

Types of Personal Data: Names, postal addresses, email addresses, telephone numbers, company names, and any other data the Controller includes in templates, address tables, or API requests.

Categories of Data Subjects: The Controller's customers, suppliers, recipients, employees, or other individuals whose data the Controller includes in the Service.

3. Controller's Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. The Controller's instructions are documented in this DPA, the Terms of Service, and any configuration the Controller makes within the Service. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes applicable data protection law. The Processor is not required to monitor the Controller's use of the Service or the content the Controller submits.

4. Confidentiality

The Processor ensures that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation survives the termination of this DPA and the Controller's account.

5. Security Measures

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR and EU GDPR. These measures include: encryption of data in transit using TLS/HTTPS; access controls restricting database and system access to authorized personnel; access checks on every request, so that each customer can reach only its own workspaces and data; rate limiting of requests; internal security review of changes to the Service; logical separation of customer data by workspace; and secure deletion of data upon account termination.

6. Sub-processors

The Controller provides general written authorization for the Processor to engage Sub-processors. The Processor shall maintain a current list of Sub-processors, which is set out in Annex A. The Processor shall notify the Controller by email at least 14 days before adding or replacing a Sub-processor. If the Controller objects to a new Sub-processor on reasonable data protection grounds, it may close its account by telling the Processor through the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy within 14 days of the notice, stating its reasons. Reasonable data protection grounds means a specific concern that the new Sub-processor would not protect Personal Data as this DPA or applicable data protection law requires. The account closes on the date the Controller chooses, no later than the date the new Sub-processor begins processing. Fees already paid for the current billing period are not refunded, and no further fees are charged after the account closes. A minimum term under a separate written agreement, such as a Managed plan agreement, still applies unless the Processor agrees otherwise in writing.

Where the Processor engages a Sub-processor, the Processor shall impose on that Sub-processor the same data protection obligations as set out in this DPA by way of a contract. The Processor remains fully liable to the Controller for the performance of the Sub-processor's obligations.

7. Data Subject Rights

The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to requests from Data Subjects exercising their rights under the UK GDPR and EU GDPR (including rights of access, rectification, erasure, restriction, portability, and objection). If the Processor receives a request from a Data Subject directly, the Processor shall promptly forward it to the Controller.

To support portability requests, the Processor provides the Personal Data held in the Controller's account as exportable data, in the formats described in the Switching and Data Portability section of the Terms of Service.

8. Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach. The notification shall include: the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects. The Processor shall assist the Controller in meeting the Controller's breach notification obligations under Articles 33 and 34 of the UK GDPR and EU GDPR.

9. Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with supervisory authorities, where required under the UK GDPR and EU GDPR, taking into account the nature of the processing and the information available to the Processor.

10. International Transfers

The Service is operated from infrastructure located in the European Union (Scaleway). Administrative access by the Processor's personnel may occur from the United States; such access is covered by the Standard Contractual Clauses referenced below. No general-purpose transfer of Personal Data to the United States occurs at rest.

For transfers of Personal Data from the European Economic Area to a third country without an adequacy decision, the parties incorporate the Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor), as set out in Annex B to this DPA. For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs (issued under Section 119A of the Data Protection Act 2018) applies.

11. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audits shall be conducted at the Controller's expense, with reasonable prior notice (at least 30 days), during normal business hours, and no more than once per calendar year unless required by a supervisory authority or following a data breach. Any auditor appointed by the Controller must sign a non-disclosure agreement and may not be a competitor of the Processor. The Processor will first respond to an audit request with written information, such as answers to the Controller's security questionnaire, the measures described in this DPA, and the certifications held by its Sub-processors. An inspection takes place only if that information is not enough to demonstrate compliance.

12. Deletion and Return of Data

Upon closure or termination of the Controller's account, or upon the Controller's written request, the Processor shall, at the Controller's choice, delete or return all Personal Data to the Controller and delete existing copies, unless applicable law requires retention. Deletion from the live Service shall be completed within 30 days of the request or termination date. Backup copies expire automatically within 7 days after that.

13. Change of Processor

The Controller authorizes the Processor to transfer this DPA, and the Personal Data processed under it, to a successor under the Assignment section of the Terms of Service, provided that: (a) the successor assumes every obligation of the Processor under this DPA; (b) the processing location and Sub-processors do not change because of the transfer, except as notified under Section 6; and (c) the Controller receives at least 30 days' notice before the transfer takes effect.

If the Controller objects to the transfer, it may close its account by telling the Processor through the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy before the transfer takes effect. Section 12 then applies to the return and deletion of Personal Data. Fees already paid for the current billing period are not refunded, and no further fees are charged after the account closes. A minimum term under a separate written agreement, such as a Managed plan agreement, still applies unless the Processor agrees otherwise in writing.

14. Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

15. Governing Law

This DPA is governed by the laws of the State of Minnesota, except that the data protection obligations are governed by the UK GDPR and EU GDPR as applicable to the Controller's jurisdiction, and the Standard Contractual Clauses in Annex B are governed as set out in that Annex. Any disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions of the Terms of Service.

16. EU and UK Representatives

Where the Processor is required to appoint a representative under Article 27 of the EU GDPR or Article 27 of the UK GDPR, it will do so, notify affected Controllers, and publish the representative's details in the Privacy Policy.

17. Contact

Questions about this DPA? Use the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy.

Annex A: Sub-processors

The following Sub-processors are authorized to process Personal Data on behalf of the Controller as of the effective date of this DPA:

Scaleway (Scaleway SAS, EU): cloud infrastructure hosting, database, container, object storage, and transactional email services (including sign-in and support emails). Processing location: European Union.

Creem (Armitage Labs OÜ, registry code 16977866, Tallinn, Estonia, EU): merchant of record for payment processing and subscription billing. Processes billing-related data only, and does so as an independent controller under its own privacy notice.

Proton (Proton AG, Switzerland): business email hosting. Processes email content exchanged with the Processor. All data encrypted at rest and in transit. Processing location: Switzerland.

This list is updated when Sub-processors are added or changed. The Controller will be notified by email at least 14 days in advance of any changes.

Annex B: Standard Contractual Clauses

For transfers of Personal Data from the European Economic Area to a third country without an adequacy decision, the parties incorporate the Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor). The completed SCC annexes are as follows:

Options selected. Clause 9(a): Option 2, general written authorization, with notice at least 14 days in advance (as in Section 6 of this DPA). Clause 17: the Clauses are governed by the law of the Netherlands. Clause 18: disputes are resolved by the courts of the Netherlands.

Annex I.A: Parties. Data exporter: the Controller (the entity using the Service), with the name, address, and contact person given in its account; role: controller; activities: designing and generating labels and logistics documents. Data importer: The Label Kitchen LLC, c/o registered agent, 202 N Cedar Ave, STE 1, Owatonna, MN 55060, United States, contact: as listed at the top of https://the.label.kitchen/legal-and-privacy; role: processor; activities: providing the Service. Accepting the Terms of Service constitutes each party's signature and date for this Annex.

Annex I.B: Description of transfer. Categories of data subjects: the Controller's customers, suppliers, recipients, employees, or other individuals whose data the Controller includes in the Service. Categories of personal data: names, postal addresses, email addresses, telephone numbers, company names, and any other data the Controller includes in templates, address tables, or API requests. Purpose of processing: storage, retrieval, rendering, and generation of labels and documents as described in §2 of this DPA. Frequency: continuous for as long as the Controller has an account. Retention period: as long as the Controller has an account, plus up to 30 days for export or recovery.

Annex I.C: Competent supervisory authority. The competent supervisory authority is the supervisory authority of the Member State in which the Controller (the data exporter) is established.

Annex II: Technical and Organizational Measures. As described in §5 of this DPA: encryption of data in transit (TLS/HTTPS); access controls restricting database and system access to authorized personnel; per-request access checks limiting each customer to its own workspaces and data; rate limiting; internal security review of changes to the Service; logical separation of customer data by workspace; secure deletion upon account termination.

Annex III: Sub-processors. As set out in Annex A of this DPA.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs (issued under Section 119A of the Data Protection Act 2018) applies and is incorporated by reference.

Effective date: 2026 September 29th

This Refund Policy explains how billing, cancellation, and refunds work for paid plans of The Label Kitchen (the "Service"), operated by The Label Kitchen LLC ("we," "us," or "our"). All payments are processed by our merchant of record, Creem (Armitage Labs OÜ), which is the seller of record for your subscription.

1. Billing

The Starter plan is free. The Business plan is billed monthly. The Managed plan runs on a 12-month agreement and is billed monthly. By subscribing, you authorize Creem to charge your payment method at the start of each billing period until your subscription ends.

2. Free Trials and Early Access

If we offer a free trial or early-access period, you are not charged for it. When it ends, keeping paid features requires a paid subscription, as described in Section 4 of our Terms of Service.

3. Cancelling

You can cancel a Business subscription at any time from your account settings. Cancellation takes effect at the end of the current billing period, and you keep full access until then. Until that date, you can undo the cancellation from the same page. After it, your account moves to the free plan's limits, as described in Section 3 of our Terms of Service.

4. Refunds

Payments are not refundable, including for partial billing periods, unused time, or unused features. If you cancel, you are not charged again, and you keep access until the end of the period you paid for.

If we charged you in error, for example a duplicate charge or a charge after your cancellation took effect, tell us and we will have Creem refund it to your original payment method.

Nothing in this policy limits any rights you have under the law of your jurisdiction that cannot be waived by agreement.

5. Managed Plans

A Managed plan has a minimum term set in its agreement. If you close your account before that term ends, the fees for the rest of the term become due as a single payment within 30 days, unless we agree otherwise in writing, as described in Section 10 of our Terms of Service.

6. Changing Plans

Moving from Starter to Business starts a new monthly subscription on the day you upgrade, at the full monthly price. Moving to a Managed plan is arranged through a Managed agreement; contact us to start. To move from Business to Starter, cancel your subscription; the change takes effect at the end of the current billing period. We do not prorate charges when plans change.

7. Price Changes

We give at least 30 days' notice before a price change applies to your subscription, as described in Section 3 of our Terms of Service.

8. Billing Questions and Disputes

If you think a charge is wrong, please contact us before disputing it with your bank or card issuer. Most billing problems can be fixed quickly that way.

9. Changes to This Policy

We may update this Refund Policy. When we make material changes, we will notify you by email or in the app at least 14 days before you are required to accept them, as described in Section 12 of our Terms of Service.

10. Contact

Questions about billing or refunds? Use the "Help" button in the app or the email address at the top of https://the.label.kitchen/legal-and-privacy.