Privacy policy

Who we are

“We” is PrintMyLabels. We decide how the personal data described here is used, which makes us its controller. This policy covers the website at www.printmylabels.app, the label editor at studio.printmylabels.app, the PrintMyLabels app inside the Shopify admin, and the API behind them.

Questions, requests and complaints all go to contact@printmylabels.app, which a person reads.

What we never collect

Worth stating first, because it is the unusual part and it is structural rather than a promise about restraint:

• —No data about your customers. A label carries a product title, an SKU, a barcode and a price. In Shopify the app asks for read access to products and inventory only — never orders, never customers — so buyer names, addresses and order histories are not available to us and are not stored anywhere in the system.
• —No card details. Subscriptions in Shopify are charged through Shopify’s billing, so payment information is handled by Shopify and never reaches us.
• —No advertising trackers and no data sales. We run no ad-network pixels, build no advertising profiles, and do not sell, rent or share personal data for advertising.
• —No AI training and no automated decisions. Your data is not used to train models and is not used to make automated decisions about you.

If you use PrintMyLabels in Shopify

The app requests two permissions, both read-only: read_products and read_inventory. It cannot change your store, and it cannot see orders or customers.

What we receive from Shopify

• —When you install. Your shop’s domain, name, currency and the store owner’s email address. These create your PrintMyLabels account — there is no separate sign-up and no password. We also store the access tokens Shopify issues to the app, encrypted, with the permissions they grant and when they expire.
• —When you print. The product and variant fields a label can show — titles, vendor, type, SKUs, barcodes, prices, compare-at and unit prices, cost, weights, options, stock counts, HS codes, country of origin and any metafields a label prints. They are read from Shopify when you choose products. We do not copy your catalog into a database of ours; the fields actually printed are kept with that print job (see What you create in the app).
• —When you contact support. The name and email address of the staff member who is signed in, so that the reply reaches the person who asked (see When you contact us).
• —For billing. Your subscription’s plan, status, Shopify charge identifier and dates. We check your Shopify plan only to tell development stores from live ones, and do not store it.

What we receive directly from you

The templates you design, the images you upload and the quantities you choose to print. A spreadsheet you upload to print from is read in memory and discarded, never stored; the rows you print from it are kept with the print job like any other.

What we receive about your customers

Nothing. Because the app has no access to customer or order data, a customer’s request to see or erase their data, which Shopify forwards to every app, finds nothing of theirs in PrintMyLabels. Your own privacy policy governs how you treat your customers.

Accounts in the studio

Creating an account in the studio stores your name, your email address and your account’s name. If you sign up with a password we store a salted hash of it, never the password itself. Until you verify your email address nothing permanent is written: the pending sign-up is a short-lived row holding your details and a hash of the code we emailed you, deleted when the code is used.

An email address is the one thing we need to create an account; without it we cannot sign you in or reset your password.

Signing in with Google

If you choose “Sign in with Google” we ask Google for three things and nothing else: openid, email and profile. From those we store your email address, your name and your Google account identifier — the last so that changing the address on your Google account does not strand you with a second, empty account. We do not store your profile picture.

We do not request or receive access to Gmail, Drive, Contacts, Calendar or any other Google service, and your Google password is never sent to us. Information received from Google is used only to create and identify your account. It is never used for advertising, never sold, never used to train AI models, and never transferred to anyone except the processors listed below. PrintMyLabels’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time from your Google account permissions page.

What you create in the app

• —Templates. Your label designs, including any text you type onto them.
• —Images. Logos and pictures you upload. They are re-encoded on arrival, which strips embedded metadata such as camera EXIF and location. Uploaded images are served from a link that is long and random but not secret: anyone who has the exact link can open the image. Don’t upload anything you would not print on a label.
• —Your own catalog. In the studio, the products you enter by hand.
• —Print history. For each batch: the template used, how many labels, when, whether it succeeded, and the product fields that were printed onto those labels. That record lets us count usage against your plan and investigate a print that went wrong. It is not a way to reproduce an old print: printing again reads your current product data.
• —Rendered PDFs. Stored in a private bucket and served over download links that expire after an hour. A PDF is available for 30 days after it is produced, then deleted.

When you contact us

A message sent from a contact form, or from “Contact support” inside Shopify, is delivered to us by email. It carries what you wrote, your reply-to address and the details we need to help — your account, plan, shop domain and the page you were on. Inside Shopify the reply-to address is the signed-in staff member’s, and their name goes with it.

Messages are not stored in our database. They exist as emails: in our mailbox at Zoho, in Resend’s delivery records, and as a line in our server log noting the addresses each email was sent to.

Server logs

Like any web service, our servers log requests to keep the service running and secure: the address requested, the time, the response, and the network address and browser details that came with the request. Application logs also note events such as a sign-up or a password reset with the email address involved, and which shop a Shopify notification concerns. Logs are used only to operate and debug the service.

Cookies and browser storage

This website

Sets no cookies. It uses Vercel Analytics and Vercel Speed Insights to count page views and measure loading performance in aggregate. Both are cookieless and do not build a profile of you or follow you across other sites.

The studio

Keeps your sign-in tokens and your editor preferences — units, resolution and printer — in your browser’s local storage, so that you stay signed in. Clearing your browser storage signs you out. It sets no cookies and runs no analytics.

The app inside Shopify

Keeps nothing in your browser. Shopify vouches for each request instead; Shopify’s own admin sets its cookies under Shopify’s privacy policy.

How we use data, and why we may

We use the data above only to provide PrintMyLabels to you. If you are in the European Economic Area or the United Kingdom, these are the legal bases we rely on:

Creating your account, signing you in, designing and printing labels

Needed to perform our contract with you.

Subscriptions, plan limits and billing records

Needed to perform our contract, and to meet accounting obligations.

Answering messages you send us

Our legitimate interest in supporting the people who use the product.

Server logs, abuse prevention and keeping the service secure

Our legitimate interest in running a reliable, secure service.

Counting page views and measuring load times on this website

Our legitimate interest in improving the site. Aggregate and cookieless.

We do not send marketing email. Account emails — verification codes, password resets and notices about this policy or the service — are part of running your account.

Who else processes your data

These providers process data on our behalf, under their own data processing terms, only to run the service. The list is complete:

Shopify

Only if you use the app in Shopify. The source of your shop’s details and product data, the platform the app runs inside, and the billing provider for subscriptions.

Neon

Hosts the application database, on Amazon Web Services in the United States.

Render

Runs the API, in the United States, and holds its server logs.

Amazon Web Services

Renders label PDFs, in the United States. Receives the label design and the product fields printed on it.

Cloudflare

Hosts the app inside Shopify, and stores uploaded images and rendered PDFs.

Vercel

Hosts this website and the studio app, and provides this website’s analytics.

Google

Sign-in, only if you choose it. Google Cloud also schedules our background jobs; no personal data is sent with them.

Resend

Delivers verification codes, password-reset emails and messages sent from our contact forms.

Zoho

Hosts the contact@printmylabels.app mailbox, where messages to us arrive (India).

We disclose personal data to anyone else only if the law requires it. We will update this page before adding a processor that handles personal data.

Where your data is

The database, the API and PDF rendering are in the United States. Cloudflare and Vercel serve content from a global network, and email to contact@printmylabels.app is held by Zoho in India. If you are in the EEA, the UK or Switzerland, your data is therefore transferred outside it. Those transfers rely on the safeguards our providers offer, such as the European Commission’s Standard Contractual Clauses or certification under the EU–US Data Privacy Framework.

How long we keep things

Account, templates, images, your own catalog and print history

For as long as the account exists. Deleting a template or product in the app hides it; it is erased for good when the account is deleted.

Rendered PDFs

Download links stop working 30 days after a PDF is produced, and the file is deleted from storage on the same schedule.

Verification codes and password-reset links

Valid for 15 minutes and one hour respectively, and deleted the moment they are used. Expired ones are swept away as new codes are issued.

Sign-in sessions

A sign-in lasts 14 days, after which you sign in again.

Server logs

Rotated out by our hosting providers on their standard schedules. We do not archive or analyse them.

Messages you send us

Kept in our mailbox for as long as needed to help you, and deleted on request.

Uninstalling and deleting your data

When you uninstall the Shopify app

Shopify notifies us at once: any paid subscription is cancelled and the shop is marked disconnected, so the app can no longer reach it. Two days later Shopify asks us to erase the shop’s data, and we delete the shop’s access tokens and its Shopify billing record.

What stays after that

Your account — its email address and name, your templates, images and print history — stays, so that reinstalling picks up where you left off. Email us to have it deleted as well.

Deleting everything

There is no delete button yet. Email contact@printmylabels.appfrom the account’s address, or from your store’s owner address, and we will delete the account and everything in it — templates, images, catalog, print history and billing records — within 30 days and confirm when it is done.

Security

Everything travels over TLS, and our domains require it. Passwords are stored as salted hashes and are never recoverable, by us or anyone else. Verification codes are stored only as hashes. Shopify access tokens are encrypted at rest with keys held outside the database. Access to production systems is limited to the people who run the service. If a breach affected your data, we would tell you, and Shopify where it concerns Shopify data, without undue delay.

Your rights

Wherever you are, you can ask us for a copy of the personal data we hold about you, in a portable format; ask us to correct it; or ask us to delete your account and everything in it. If you are in the EEA or the UK you also have the right to restrict or object to processing that relies on our legitimate interests, and to complain to your local data protection authority — though we would like the chance to put things right first.

Email contact@printmylabels.app. We may need to confirm the request comes from the account’s owner, usually by replying from the account’s email address. We respond within 30 days. There is no form and no ticket queue.

California residents

In the past twelve months we have collected these categories of personal information, from you, from Shopify and from Google, for the purposes described above:

• —Identifiers: name, email address, Google account identifier, shop domain, and the network address in server logs.
• —Commercial information: your subscription plan and billing history.
• —Internet activity: server logs, and aggregate page views on this website.
• —Account credentials: a password hash, used only to sign you in.

We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past twelve months. You have the right to know what we hold, to have it corrected or deleted, and not to be treated differently for asking. Make a request by email as above; you may use an authorized agent, and we will verify the request with you.

Children

PrintMyLabels is a tool for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16.

Changes

If what we collect changes, this page changes with it and the effective date above moves. We will tell account holders by email before a change that materially affects them takes effect.