Welcome to Barcode Canvas, operated by LabelPro Hardware Systems ("we," "our," or "us"). We are committed to protecting the privacy of our users — primarily e-commerce merchants, business owners, and logistics professionals — as well as the end-customer data they process. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, cloud application, desktop printing bridge, and browser extensions (collectively, the "Service").
1. Data We Collect and Process
We operate under a strict Data Minimisation principle — we only collect the bare minimum required to operate a cloud label designer and coordinate print outputs.
A. Account & Authentication Data
We use secure third-party infrastructure (Supabase) to manage accounts.
- Collected: Email address, hashed password (cryptographically unreadable by us), organisation roles, and user configurations.
- Purpose: Session authentication, cloud template protection, and enterprise team permissions.
- Retention: Held for the lifetime of your account. Deleted within 30 days of account closure on request.
B. Billing & Subscription Data
We do not store raw credit card or bank account details on our servers.
- Collected: PayPal Plan IDs, subscription status, billing cycle data, and country location tokens (queried locally via IP geolocation for tax compliance).
- Purpose: Maintaining active premium accounts via our payment processor (PayPal).
- Retention: Subscription records retained for 7 years for financial compliance obligations.
C. Local Workspace Data (Templates & Layouts)
- Collected: Vector coordinates, canvas sizes, text labels, and customised layout measurements.
- Purpose: Saved to your secure cloud team library or local device storage at your explicit command.
- Retention: Until you delete them or close your account.
2. Marketplace & Store Integration Data
LabelPro connects to your e-commerce stores so you can turn paid orders into shipping labels and keep tracking up to date. We offer two integration methods, and they handle data differently.
A. Connected Store Integrations (Shopify, Etsy, WooCommerce, eBay)
When you connect a store using its official authorisation flow (OAuth 2.0), LabelPro imports your orders so they appear in your fulfillment queue and can be turned into labels.
- Collected & stored: For each connected store we store the order data required for fulfillment — order/receipt ID, order number, recipient name, shipping address, item title/SKU, order total, and order status — securely on our infrastructure (Supabase), isolated to your organisation.
- Purpose: Solely to generate shipping labels and to write the tracking number back to the store so the buyer is notified. Buyer personal data is never sold, rented, or used for marketing or for any purpose beyond fulfilling the order the buyer placed.
- Authorisation tokens: Access and refresh tokens are stored server-side only, are never exposed to your browser, and are rotated on use. Inbound store webhooks are cryptographically verified before processing.
- Retention & deletion: Order data and tokens are retained while the store is connected. Disconnecting a store deactivates the integration and revokes its stored tokens; you may also delete your account at any time. Stored order and personal data is removed within 30 days of disconnection or account closure on request.
B. Browser Extension Sync (optional)
Our optional browser utilities let you pull order information from a marketplace dashboard you are already signed into (e.g. Amazon Seller Central).
- Local processing: When you use the browser extension, customer PII is read within your active browser session and fed into your design canvas to generate print streams; data pulled this way is not mirrored to our servers by the extension itself.
- Write-back: When updating tracking via the extension, it operates within your authenticated dashboard session.
3. Desktop Bridge Software (LabelPro Bridge)
LabelPro Bridge is a local utility that communicates with your operating system's native hardware print queues.
- Scope: The application listens exclusively to vector print instructions routed from our active web dashboard.
- Privacy Boundary: The bridge does not monitor background applications, read your local file system, or transmit any system data to our servers.
4. Cookies & Tracking
We use only the minimum cookies necessary to operate the Service.
- Essential cookies: Authentication session tokens required to keep you logged in. These cannot be disabled without breaking the Service.
- No advertising or cross-site tracking cookies are used.
- IP geolocation is queried momentarily on the client side for automatic tax zone detection. This query result is not stored on our servers.
5. Third-Party Data Processors
- Supabase Inc: Cloud database storage, serverless functions, and user credential management. Supabase Privacy Policy
- PayPal Holdings Inc: Secure checkout, merchant subscription processing, and payment security. PayPal Privacy Policy
- IPAPI / IP Geolocation: Used momentarily client-side to verify geographical zone for domestic tax compliance. No data is stored by us as a result of this query.
6. Enterprise & Merchant Data Protection (GDPR / CCPA / UK DPA 2018)
We recognise that our merchants operate under stringent regional privacy frameworks.
- Data Processor Status: When you process customer delivery data through our Service, you are the Data Controller and we are the Data Processor. For connected store integrations, customer delivery data is stored on our infrastructure solely to provide the fulfillment service, under appropriate security and access controls and the retention terms set out in Section 2A.
- Your Rights (GDPR / UK DPA): You have the right to access, rectify, erase, restrict processing of, and port your personal data. You may also object to processing or withdraw consent at any time. To exercise any right, email info@barcodecanvas.com. We will respond within 30 days.
- CCPA: California residents may request disclosure of personal information collected and request deletion. We do not sell personal information.
- Data Erasure: You retain full ownership of your cloud templates and may permanently delete them or your entire account at any time via your account dashboard.
7. Children's Privacy
The Service is intended for business use and is not directed at children under the age of 13 (or 16 in the EU/UK). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at info@barcodecanvas.com.
8. Updates to This Policy
We may update this Privacy Policy to reflect changes to our pipeline or applicable law. The updated date at the top of this page will always reflect the latest revision. Continued use of the Service after any update constitutes acceptance of the revised policy.