Privacy Policy

This Privacy Policy explains what personal data The Label Kitchen LLC ("we," "us," or "our") collects when you use The Label Kitchen, including its API (the "Service"), why we collect it, and what rights you have.

1. Who We Are

The Label Kitchen LLC is a limited liability company registered in the State of Minnesota, United States. To reach us about this policy or your data, use the "Help" button in the app or the email address at the top of https://the.label.kitchen/legal-and-privacy.

2. What This Policy Covers

We handle personal data in two roles:

• As controller, for data about you as our user: your account, sign-in, support conversations, and records of what you agreed to. This policy covers that data.
• As processor, for data our customers put into the Service: templates, address tables, uploaded data files (such as EDI documents), and API requests. These often contain names and addresses of other people, such as a customer's shipping recipients. We process that data only on our customer's instructions, under our Data Processing Agreement. If your details appear in a label or document made with the Service, the company that made it decides how your data is used, and you should contact them. If you contact us instead, we will pass your request on to them.

3. Information We Collect

Account information. Your email address and your first and last name. Sign-in is passwordless: we email you a one-time code, which expires after 10 minutes, so we do not store a password.

Sign-in and security information. For each signed-in session, the IP address and browser type (user agent). Depending on our settings, a new account is either approved automatically or reviewed by a person before it is activated. We also check whether a new email address closely matches an existing account, to prevent duplicate and abusive accounts; a close match is always held for a person to review.

Policy acceptance records. When you accept a version of our Terms of Service, this Privacy Policy, or another policy, we record which version you accepted, when, and the IP address and browser type used.

Workspace information. The names of your workspaces, who is a member or owner of each, and the API tokens created in them (we store a one-way fingerprint and the first few characters of each token, never the full token, plus when it was created and last used).

Usage information. Counts of what you do in the Service, such as the number of exports and files uploaded, linked to your account and workspace. These counts do not contain the content of your labels or files.

Support conversations. Everything you send through the "Help" chat: the subject and text of your messages, our replies, and any files you attach, such as screenshots or sample data files. Attachments are stored in our file storage (Section 5) and can contain whatever you put in them, including other people's personal data, so please share only what we need to help you. If you use the chat without signing in, we also collect your email address, the name you give, and the IP address the conversation started from, and we verify the email address with a one-time code.

Billing information. Payments are handled by our merchant of record, Creem (see Section 5). We receive and store your plan, subscription status, billing dates, and Creem's customer and subscription identifiers. We never receive or store your card details.

Operational logs. Our servers log requests and errors, including IP addresses, to keep the Service running and secure. If processing a file fails, the error message may include a fragment of that file.

4. How We Use Your Information, and Why We May

We use personal data only for the purposes below. Each one is listed with its legal basis under the EU and UK GDPR:

• Creating and running your account; signing you in; providing the Service and its features. Legal basis: Performance of our contract with you (Article 6(1)(b)).
• Sending emails the Service needs: sign-in codes, support replies, and notices about your account, billing, and policy changes. Legal basis: Performance of our contract with you (Article 6(1)(b)).
• Answering support questions from signed-in users. Legal basis: Performance of our contract with you (Article 6(1)(b)).
• Answering support questions from people who are not signed in. Legal basis: Our legitimate interest in answering questions people send us (Article 6(1)(f)).
• Reviewing new accounts, detecting duplicate accounts, rate limiting, and keeping logs to protect the Service from abuse and attacks. Legal basis: Our legitimate interest in keeping the Service secure (Article 6(1)(f)).
• Keeping records of which policy versions you accepted. Legal basis: Our legitimate interest in being able to show what was agreed (Article 6(1)(f)).
• Counting usage to apply plan limits and to understand which features are used. Legal basis: Performance of our contract with you (Article 6(1)(b)) and our legitimate interest in improving the Service (Article 6(1)(f)).
• Keeping billing and accounting records, and responding to lawful requests from authorities. Legal basis: Compliance with legal obligations (Article 6(1)(c)).

We do not send marketing emails, sell personal data, or use it for advertising.

5. Who We Share It With

We share personal data only with the service providers below, and only as far as they need it to do their job:

• Scaleway (Scaleway SAS, France): hosting, database, file storage, server logs, and transactional email (sign-in codes and support emails). Location: European Union.
• Creem (Armitage Labs OÜ, registry code 16977866, Tallinn, Estonia): our merchant of record, which sells and bills subscriptions. Creem acts as an independent controller for payment and billing data, under its own privacy policy. Location: European Union.
• Proton (Proton AG, Switzerland): our business email. Processes emails you exchange with us. Location: Switzerland.

We may also disclose personal data if the law requires it, for example in response to a court order, or to a successor if our business is transferred as described in our Terms of Service. The current list of sub-processors for customer data is in Annex A of our Data Processing Agreement.

6. International Transfers

The Service runs on servers in the European Union. We are based in the United States, and our personnel access data from there to operate and support the Service. For customer data we process as a processor, that access is covered by the Standard Contractual Clauses in our Data Processing Agreement. Switzerland, where our email is hosted, is recognized by the European Commission and the United Kingdom as providing adequate protection.

7. How Long We Keep It

• Your account and its content, including your support conversations and their attachments: for as long as your account is open.
• Closed accounts: deleted 30 days after closure, the period during which you can request an export under our Terms of Service.
• Inactive free accounts: if a free account has no sign-in for 24 months, we email a warning to its address and close the account 30 days later unless someone signs in. It is then deleted like any closed account, 30 days after closure. An account on a paid plan is not treated as inactive while its subscription is active.
• Support conversations from people who are not signed in: the messages, attachments, email address, name, and IP address are deleted 24 months after the last message.
• Server logs: 7 days.
• Backups: taken daily and kept for 7 days, so deleted data leaves our backups within 7 days.
• Sign-in codes: expire after 10 minutes and are deleted once used.
• Policy acceptance and billing records: kept after an account closes only for as long as needed to meet legal obligations or to establish or defend legal claims, then deleted.

8. Cookies and Browser Storage

We use only what the Service needs to work. We do not use analytics, advertising, or tracking cookies, so we do not ask for cookie consent.

• Session cookie: keeps you signed in.
• active_workspace: remembers which workspace you last used. Kept for up to 1 year.
• lk_guest: links a support conversation to your browser when you are not signed in. Kept for 2 hours.
• lk_support_pending (browser storage, not a cookie): when you use the Help chat without signing in, it keeps your message, email address, and name in your browser while you enter the verification code, so a reload does not lose them. It is removed once the message is sent, and ignored after 10 minutes.

9. Security

We protect personal data with encryption in transit (TLS/HTTPS), access checks on every request so that each customer can reach only its own workspaces and data, restricted administrative access, rate limiting, internal security review of changes to the Service, and secure deletion when accounts close. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

10. Your Rights

Depending on where you live, you have the right to access your personal data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on legitimate interests (Section 4), you can object, and we will stop unless we have compelling grounds to continue. To use any of these rights, contact us as described in Section 1. We will answer within one month.

If you are in the European Economic Area or the United Kingdom, you also have the right to complain to a data protection supervisory authority: in the EEA, the authority in the country where you live or work; in the United Kingdom, the Information Commissioner's Office. We would appreciate the chance to address your concern first.

11. Automated Decisions

We do not make decisions about you by automated means that have legal or similarly significant effects. New accounts may be approved automatically, but an account is never rejected without a person deciding.

12. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their personal data. If we learn that we have, we will delete it.

13. EU and UK Representatives

Where we are required to appoint a representative under Article 27 of the EU GDPR or the UK GDPR, we will do so and publish their details here.

14. Changes to This Policy

We may update this Privacy Policy. When we make material changes, we will notify you by email or in the app at least 14 days before you are required to accept them, as described in Section 12 of our Terms of Service.

15. Contact

Questions about this Privacy Policy or your data? Use the "Help" button in the app or the email address at the top of https://the.label.kitchen/legal-and-privacy.