Privacy

Last updated 13 October 2026. This policy may be updated as the service grows; the current version applies.

Short version: the label tools run in your browser, we never see your card details, and you can download or erase everything we hold with one click.

Who is responsible

Small Print Labels is run as a sole trader based in Sweden, and is the data controller for the personal data described here. Reach us at support@smallprintlabels.com.

What we collect

Your recipes stay yours. Every label is calculated on your device. Nothing you type is sent to us unless you are signed in.

• None of your work if you use the tools without signing in. Recipes, ingredients and label designs stay in your own browser's local storage and are not sent to us. (The one thing we do see from any visitor is the IP address every web request carries, and only as described at the end of this list.)
• Your email address if you create an account. It is how you sign in: there are no passwords, so we email you a link instead.
• Your saved designs if you are signed in, so they survive a cleared browser and follow you between devices.
• Your email address if you join the free rule-change updates list. Nothing is sent until you click the confirmation email, and every email carries an unsubscribe link.
• Anonymous usage counts: which pages are visited, which of our pages led to a tool, which buttons are pressed, and when a tool is used or its ingredient list copied. When you arrive by one of our own tagged links, such as a Pinterest pin, we also count which campaign link brought the visit, read from the page address on that visit only; nothing is stored in your browser for it. No identifiers, no profile, nothing that points back to a person.
• Your IP address, briefly, and only to stop abuse: sign-in requests, alerts signups and those usage counts are rate-limited, which means keeping a counter against your address for up to an hour. It is never stored alongside your account, never used to identify you, and it expires by itself. Our lawful basis is our legitimate interest in keeping the service usable and our email costs from being run up by a script.

Why we are allowed to hold it

Your account email and saved designs are processed to provide the service you asked for (performing our contract with you). The alerts list runs on your consent, which you can withdraw from any alert email. The anonymous usage counts rest on our legitimate interest in knowing whether the site works, and are kept anonymous precisely so that interest stays a light one.

Payments

Paddle is the merchant of record for every purchase: Paddle.com Market Ltd, or Paddle.com Inc. for buyers in the United States, as the terms say. They take the payment, handle the tax, and issue your receipt. To tie a purchase to your account, the checkout passes Paddle your account email and your account's id, and when a payment arrives we may read the buyer's email from Paddle's customer record. We never see or store card details. Paddle holds its own record of your transaction under its own privacy policy, and is legally required to keep it even after you delete your account here.

Who else touches your data

• Cloudflare hosts the site, the database and the analytics counts.
• Paddle processes payments, as above. When you click a plan button, the page loads Paddle's checkout script from Paddle's own servers to open the payment form; that script can set Paddle's cookies and load Paddle's own analytics for the checkout. Nothing from Paddle loads until you click to buy.
• Resend delivers sign-in links and alert emails.

That is the whole list. Some of these providers operate outside the EU and EEA, in which case the transfer relies on the European Commission's standard contractual clauses. We do not sell personal data, and we do not share it for advertising.

Cookies

Two cookies of ours, both only around sign-in: one set when you ask for a sign-in link, which lives fifteen minutes and lets the link recognise the browser that asked for it, and one set when you sign in, which keeps you signed in. Both are strictly necessary, so there is no consent banner to click. Our analytics does not use cookies and does not track you between sites. The only other cookies come from Paddle's checkout form, and only once you have clicked to buy. Your saved designs and the tools' settings (the paper and label sheet you last printed on, the light or dark theme, which notes you folded), whether you are signed in, and a copy of your plan, so the export buttons answer at once, live in your browser's local storage, not in a cookie.

How long we keep it

Your account and designs stay until you delete them. Sign-in links expire after 15 minutes, and a signed-in session lasts 90 days, renewed as you use the site. Alerts subscriptions stay until you unsubscribe, and an address that unsubscribed is kept only so we never add it back by mistake. Deleting your account also removes any alerts signup for its address. Anonymous usage counts have no personal data to expire.

Your rights, without asking

Under the GDPR you may access, correct, export, restrict or erase your personal data, and object to how it is used. For the two that matter most we built the buttons rather than a request form: on your account you can download everything we hold about you as a file, and delete your account outright, which erases your email address, your saved designs, your plan record and any alerts signup for that address, immediately. The one thing that waits is a subscription still due to be billed: cancel it first, from the same page, so the card is not charged for an account that no longer exists. For anything else, ask us.

If you think we have handled your data badly, please tell us first, but you also have the right to complain to your data protection authority. In Sweden that is the Swedish Authority for Privacy Protection (IMY).