Policies & Terms

1. Scope of this Policy

This Privacy Policy applies to personal data we process about visitors and registered users of LabelWebs (the "Services"). It does not apply to third-party websites or services linked from the Services, which have their own privacy policies.

2. Data Controller & Contact

3. Categories of Personal Data We Process

We do not intentionally collect special-category data (health, religion, ethnicity, biometric, sexual orientation). Do not enter such data into the Services.

4. Purposes of Processing

• 1

  Provide and operate the Services — account creation, authentication, hosting your sites, processing AI requests, sending transactional emails.

• 2

  Process payments and prevent fraud — through our merchant of record Paddle, including tax calculation and chargeback handling.

• 3

  Improve and develop the Services — debugging and quality assurance using aggregated, non-identifying server-log data.

• 4

  Communicate with you — service updates, security alerts, product announcements (you can opt out of marketing emails any time).

• 5

  Comply with legal obligations — tax records, domain WHOIS, response to lawful requests.

• 6

  Protect our rights and users — detecting abuse, enforcing the AUP, preventing security incidents.

For users in the EU/EEA/UK, we rely on the following legal bases under Article 6 GDPR:

6. Sub-processors & Sharing

We share personal data with carefully vetted sub-processors that help us deliver the Services. We require each sub-processor to provide an adequate level of protection through binding contracts that include GDPR-compliant data-processing terms.

An updated list of sub-processors is available on request to [email protected].

Personal data may be transferred outside your country of residence, including to the Republic of Korea, the United States, and other jurisdictions where our infrastructure or sub-processors operate. For transfers from the EEA, UK, or Switzerland to a country not deemed adequate, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and supplementary measures such as encryption in transit and at rest. Copies of the SCCs in place can be requested from [email protected].

8. Data Retention

• 1

  Account data is retained for as long as your Account is active and for up to 12 months after deletion (to handle reactivation, fraud prevention, and dispute resolution), unless deletion is requested earlier.

• 2

  Billing and tax records are retained for the period required by Applicable Law (typically 5–10 years).

• 3

  Server logs and security logs are retained for up to 6 months.

• 4

  Backups are retained for up to 30 days and rotate out of storage automatically.

• 5

  When retention expires, data is deleted or irreversibly anonymized.

Subject to Applicable Law, you have the following rights regarding your personal data. To exercise any of them, email [email protected] from the address on file or use the in-app data tools.

We respond to verifiable requests within 30 days (extendable by 60 days for complex requests) and do not charge a fee unless requests are manifestly unfounded or excessive. We will not discriminate against you for exercising your rights.

10. California Privacy Rights (CCPA/CPRA)

• 1

  Right to know what categories and specific pieces of personal information we have collected, used, disclosed, or sold.

• 2

  Right to delete personal information collected, subject to legal exceptions.

• 3

  Right to correct inaccurate personal information.

• 4

  Right to opt out of "sale" or "sharing" of personal information. We do not sell personal information for monetary consideration.

• 5

  Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes other than those permitted by CPRA.

• 6

  Right to non-discrimination — we will not deny services, charge different prices, or provide different quality for exercising your rights.

11. Cookies & Similar Technologies

We use cookies and similar technologies to operate the Services, remember your preferences, and analyze usage. Detailed information is in the Cookie Policy (link).

12. Children's Privacy

The Services are not directed to children under 16 (EU) or 13 (US) and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact [email protected] and we will delete it promptly.

13. Security Measures

• 1

  Encryption — TLS 1.2+ in transit; AES-256 at rest for sensitive fields.

• 2

  Access control — least-privilege role-based access, mandatory two-factor authentication for staff with access to production.

• 3

  Auditing — access logs are retained and reviewed; production changes go through code review and CI checks.

• 4

  Backups — encrypted at rest and tested periodically.

• 5

  Vendor management — sub-processors undergo security review before onboarding and are reviewed periodically.

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware (per Article 33 GDPR) and notify affected users without undue delay where required (Article 34 GDPR).

15. Changes to this Policy

We may update this Policy from time to time. The effective date at the top of this page indicates when the most recent version took effect. Material changes will be communicated by email or in-product banner at least 30 days before they take effect.