Privacy Policy
This policy explains what personal data GS1 Label Designer (https://barcode-label-studio.app) processes, why, and your rights, including under the EU and UK General Data Protection Regulation (GDPR).
1. Your labels and spreadsheets stay on your device
Label designs, the text and numbers on your labels, and Excel / CSV files you open are processed in your browser and stored only in your browser (local storage) or in files you save yourself. They are not sent to our server. Google Sheets you link are fetched directly from Google by your browser.
2. Personal data we process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, optional name, password (stored only as a salted hash), consent time | Provide your account, send verification and password-reset emails | Contract | Until you delete your account |
| Session cookie | Keep you signed in | Contract (strictly necessary) | 30 days or until you sign out |
| Licensed devices: a random browser ID, browser and operating-system name, first and last use | Enforce the device limit of Pro, let you manage your devices | Contract | Until removed, or 12 months after last use |
| Subscription and payment records (PayPal subscription ID, plan, amount, currency, dates, status) | Billing, accounting, refunds | Contract, legal obligation | As long as tax and accounting law requires |
| IP address | Rate-limit sign-up and sign-in attempts, security | Legitimate interest (security) | Deleted within 24 hours |
We do not receive your card number: payments are handled by PayPal. We do not use advertising or analytics cookies and do not sell personal data.
3. Service providers
- Cloudflare, Inc. — hosting, database and network security (processor).
- Resend — sending account emails (processor).
- PayPal — payment processing; PayPal acts as an independent controller for the payment data you give it (see the PayPal privacy statement).
These providers may process data outside your country, including in the United States. Where the GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
4. Your rights
You can ask to access, correct, export or delete your personal data, and to restrict or object to processing. Write to info@gs1-code.app from the email address of your account; we answer within 30 days. You may also complain to your local data-protection authority.
Deleting your account removes your profile, sessions and devices. Payment records are kept only as long as required by law.
5. Cookies and local storage
We set one strictly necessary cookie (__Host-sid) after you sign in. The designer uses your browser's local storage for your current design, settings, a random browser ID and your Pro license ticket. No consent banner is shown because no optional cookies are used.
6. Security
Traffic is encrypted (HTTPS). Passwords are hashed with PBKDF2-SHA256 and a unique salt; session tokens are stored only as hashes.
7. Children
The Service is intended for businesses and adults; it is not directed at children under 16.
8. Changes
We will post updates here and email registered users about material changes.