Privacy Policy
Last updated: October 2026
1. Who we are
KOMANDA STUDIO UNIPESSOAL LDA, operating as CoLabel, Rua Principal 1028 Zambujeiro, 2755-307 Alcabideche, Cascais, Portugal, Tax ID PT518580245, privacy@colabelms.com.
This policy covers visiting our website (colabelms.com) and using CoLabel: the web app (app.colabelms.com), the CoLabel extension for Adobe Illustrator, and AI apps you connect to CoLabel.
2. Our role
- For your account, billing and website visits, we decide how the data is used — we are the controller.
- For the content a company keeps in its workspace (label files, label content, comments, the names of colleagues mentioned in them), we process it on behalf of that company, which is the controller. For business customers we sign a data processing agreement under Art. 28 GDPR; ask at support@colabelms.com.
3. Visiting the website
We receive the technical data any web server receives (IP address, browser, pages requested, time), to deliver the pages and keep them secure.
Only if you accept statistics in the cookie banner, we use Google Analytics to see how visitors use the site — which pages, from which kind of device, roughly from which country. Google Analytics does not store your IP address. Without your consent it does not load at all, and you can withdraw consent at any time with Cookie settings at the foot of every page. We use no advertising tools. See the Cookie Policy.
4. Using CoLabel — what we collect
| What | Examples |
|---|---|
| Account | name, email, password (stored only as a hash), profile picture, role |
| Workspace content | label artwork and versions, label content fields, comments and annotations, attachments, fonts, barcode and QR data, icons |
| Billing | company name, billing address, VAT number; card details are held by Stripe, never by us |
| Use of the Service | sign-ins, actions in the workspace history, technical logs |
| Messages | emails you send us; notification emails we send you |
The Illustrator extension runs in Adobe Illustrator on your computer. It sends to CoLabel what you save or connect through it — artwork, versions, the text of connected fields. When you save a master file, it can also save the fonts that file uses to the product's font library, so your teammates open the artwork with the same fonts (Adobe Fonts are never saved).
Your own cloud storage. If you connect Google Drive, OneDrive or SharePoint, we access the files and folders you choose, to import them or to copy your workspace there. We keep the connection's access token until you disconnect it.
5. Why we use it (legal basis)
| Purpose | Legal basis |
|---|---|
| Provide the Service, your account and your workspaces | Contract (Art. 6(1)(b)) |
| Payments and invoices | Contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)) |
| Service emails (mentions, new versions, billing) | Contract (Art. 6(1)(b)) |
| Security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Improving CoLabel | Legitimate interest (Art. 6(1)(f)) |
| Website statistics (Google Analytics) | Consent (Art. 6(1)(a)) — withdraw any time |
| Marketing emails | Consent (Art. 6(1)(a)) — withdraw any time |
6. AI features
When you use an AI feature — reading text from artwork, translating, fixing spelling, checking content — the file or text concerned is sent for that request to Google (Gemini) or Anthropic (Claude), in the USA. Under their API terms it is not used to train their models, and they keep it only for a limited period for abuse monitoring. Nothing is sent to them unless such a feature runs.
7. AI apps you connect (Claude, ChatGPT and others)
You can connect an AI app to CoLabel so it works with your labels in a conversation. Nothing is connected unless you do it: you sign in to CoLabel, choose one workspace and whether the app may only read or also make changes, and allow it.
- What the app receives: what it asks for on your behalf, within your role and folder access in that workspace — label content, names of products, markets and SKUs, comments, label files and images of the artwork. Your password is never shared with it.
- What we keep: the connection (which app, which workspace, what it may do, when it was last used); its access tokens, stored only as one-way hashes; and a log of each action the app took (which action, when, whether it succeeded) — not your conversation with the app.
- How long: the action log for 12 months; tokens until 30 days after they expire or are revoked; pending sign-ins and one-time codes for a day; file upload links for 30 days. All of it is deleted with your account.
- The app's side: what the AI app does with the data it receives is governed by its own terms and privacy policy (for example Anthropic's for Claude, OpenAI's for ChatGPT).
- Stopping it: Profile Settings → Connected AI apps → Revoke ends the app's access at once.
8. Who receives data
We do not sell personal data. It goes only to:
- Your team — the members of the workspaces you belong to, within their roles; and whoever holds a share link you created, for that one file.
- Our team — only to provide support or set-up you asked for, or to keep the Service secure.
- Service providers that run parts of CoLabel for us, under data processing agreements:
| Provider | For | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in | EU — Ireland |
| Amazon Web Services | Application servers | EU — Sweden |
| Vercel | Delivering the web app and website | Edge network |
| Google (Gemini) | AI features | USA |
| Anthropic (Claude) | AI features | USA |
| Resend | Email delivery | EU — Ireland |
| Stripe | Payments | EU / USA |
| Website statistics (only with your consent); reCAPTCHA at sign-up; sign-in and Drive when you use them | EU / USA | |
| Microsoft | Sign-in and OneDrive/SharePoint when you use them | EU / USA |
- Authorities — where the law requires it.
9. Where data is stored, and for how long
Workspace content and accounts are stored in the EU (Ireland); the application servers run in Sweden. Transfers outside the EEA (AI features, Stripe, sign-in providers) rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU–U.S. Data Privacy Framework.
| Data | Kept |
|---|---|
| Account | while it exists. Deleting your account removes your profile, sign-in, memberships and your own comments at once |
| Workspace content | while the workspace exists; label versions are kept until the workspace deletes them. Deleting a workspace removes its content and files at once |
| Backups | daily, each kept 7 days — deleted data disappears from them within 7 days |
| Billing and invoice records | 10 years (Portuguese tax law) |
| AI app records | as in section 7 |
| Server logs | up to 90 days |
| Website statistics (Google Analytics) | 14 months |
10. Security
Encryption in transit (TLS) and at rest (AES-256), passwords stored only as hashes, access limited by role and workspace, daily backups, an automated daily security check of our infrastructure, and confidentiality obligations for our team. The details: app.colabelms.com/docs/enterprise/security.
11. Your rights
You can ask to access, correct, delete, restrict or port your data, object to processing, and withdraw consent: privacy@colabelms.com. We answer within 30 days. For content in a company's workspace, we pass your request to that company, which decides. You can also complain to the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1200-651 Lisboa — cnpd.pt.
12. Children
CoLabel is not meant for anyone under 16, and we do not knowingly collect their data.
13. Changes
We will announce significant changes by email or in the app, and update the date above.
14. Contact
KOMANDA STUDIO UNIPESSOAL LDA · Rua Principal 1028 Zambujeiro, 2755-307 Alcabideche, Cascais, Portugal · privacy@colabelms.com