EVoLabels
Privacy Policy
Effective as of 2026-10-27. This policy explains how personal data is processed in the EVoLabels Android app, the web app at evolabels.app and the services behind them (together the "Service").
1. Who is responsible
The controller of your personal data is Mateusz Janicki, an individual developer who publishes the Service under the name EVoApps as an unregistered activity (działalność nierejestrowana, art. 5 of the Polish Entrepreneurs' Law), address ul. Opacka 23/62, 80-330 Gdańsk, Poland, e-mail contact@evolabels.app. Write to this address for any question about your data or to exercise your rights.
Business customers and their staff. A business that uses EVoLabels decides which staff members (operators) get access and what they print. For the data the business enters about its staff - operator accounts, names on labels, the print journal - the business is the controller and we process that data on its behalf under the data processing agreement in our terms. If you are such a staff member, please contact your employer first; we will help them answer your request.
2. What we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Your account, sign-in, organisation and team (owner, administrators, operators, invitations) | E-mail, name, organisation and manufacturer name, role, permissions, workstations, language, invitation e-mails | Contract, Art. 6(1)(b) |
| Licences and device seats | Device identifiers and names, licence status, last-used times | Contract, Art. 6(1)(b) |
| Products, templates, label layouts and printing, including the print journal (who printed which label, when and on which device) and labels' QR codes | Catalogue data you enter, operator names, journal entries | Contract, Art. 6(1)(b); for staff data we act as processor for the business customer |
| Transactional e-mails (verification, password reset, invitations) | E-mail, name, language | Contract, Art. 6(1)(b) |
| Service notifications and the weekly summary (push and e-mail), marketing notifications | E-mail, push token (FCM), consent settings with their dates | Your consent, Art. 6(1)(a) - each is off until you switch it on in Settings and can be switched off at any time |
| Payments and subscriptions | Purchase and subscription records, account id; card details are handled only by Google Play or Stripe, never by us | Contract, Art. 6(1)(b); keeping billing records: legal obligation, Art. 6(1)(c) |
| Usage statistics and crash reports (Google Analytics for Firebase in the Android, iOS and web apps; Firebase Crashlytics in the Android app) | App events (for example: account created, organisation set up, printer connected with its model family and connection type, number of labels printed, plan bought, trial started or plan cancelled with its tier and store), device model and OS, app instance id, crash traces. Never product names, label content, your name or e-mail address | Your consent, Art. 6(1)(a) - asked on first launch, off until you allow it, changeable in Settings |
| Optional questions to the organisation's owner: how you heard about EVoLabels (end of the setup) and why you cancelled or chose a smaller plan | The answer chosen, the few words you add, the time - kept with your account; the chosen answer alone also counts in our usage statistics if you allowed them | Our legitimate interest in knowing how customers find us and why they leave, Art. 6(1)(f); answering is voluntary and you can skip it |
| AI translation of ingredients and label phrases (on request) | The text you ask to translate - please don't include personal data in it | Contract, Art. 6(1)(b) |
| Google Sheets synchronisation (optional) | Catalogue and operator lists you choose to sync into a spreadsheet you select | Contract, Art. 6(1)(b) |
| Support requests (when you write to contact@evolabels.app) | Your e-mail with its subject, text and attachment names; your name and e-mail address stay only in our mailbox. The text is recorded as a support ticket without your e-mail address, with e-mail addresses and long numbers (phones, account numbers, PESEL) in it removed | Our legitimate interest in answering you and fixing reported problems, Art. 6(1)(f), or the contract, Art. 6(1)(b), if you use EVoLabels. A person reads and answers every message; nothing is answered automatically |
| Security, preventing abuse of licences, keeping the Service working | Device integrity checks (Google Play Integrity), technical logs, IP address in server logs | Our legitimate interest in a secure service, Art. 6(1)(f) |
Providing account data is needed to use the Service; everything marked as consent is optional. We don't make decisions about you based solely on automated processing, and we don't sell your data.
3. Camera, microphone, Bluetooth and location
The camera is used only to scan text and barcodes; recognition runs on your device and no image or recognised text is sent to us. Bluetooth connects to label printers. On Android 11 and older the system requires the location permission for Bluetooth scanning; the app does not collect your location.
Scan text and dictation. "Scan text" reads text from a photo you take or choose. In the Android app the text is recognised on your device by Google's ML Kit (its model comes with Google Play services); in the web app by tesseract.js in your browser - the reader and its language data are downloaded from our own website on the first scan, like the rest of the app. The photo and the text are not sent to us or anyone else, and the photo isn't kept. "Dictate" uses the microphone only while its window is open and listening; nothing is recorded or stored by the app. On Android the speech is turned into text by your phone's speech recognition, on the device where the phone has the offline language (Android 12 and newer); otherwise your phone's speech service (usually Google's) may process the audio. In the web app the browser's speech recognition is used, and Chrome, Edge and Safari may send the audio to Google, Microsoft or Apple to recognise it - under their privacy terms, not ours. The words come back only into the field you dictate into.
4. Web app storage
The web app stores only what it needs to work in your browser (sign-in session and your preferences). It sets no advertising cookies. Google Analytics cookies are set only after you allow usage statistics, and switching them off in Settings stops the collection.
5. Who receives the data (processors)
We use these service providers, bound by data processing agreements, only for the purposes above:
- Google (Google Ireland Ltd. / Google LLC): Firebase - authentication, database (stored in the EU), Cloud Functions (Belgium), hosting, push messaging, Analytics and Crashlytics (only with consent); Gemini API (AI translation and AI pictures for label images: the description you type and the chosen style, only when you use them; not used to train Google's models); Google Sheets and Drive APIs (only for spreadsheets you select); Google Play (Android purchases).
- Twilio SendGrid (Twilio Inc., USA): sending e-mails.
- RevenueCat (RevenueCat Inc., USA): managing subscriptions and licences.
- Stripe (Stripe Payments Europe Ltd., Ireland, with Stripe Inc., USA): web payments.
- For support requests: Cloudflare (Cloudflare, Inc., USA) receives and forwards the e-mail, it is stored in our mailbox at Google (Gmail), and its text, without your e-mail address, is recorded as a ticket in a private repository at GitHub (GitHub, Inc., USA), where Claude by Anthropic (Anthropic Ireland, Ltd. / Anthropic PBC, USA) helps us categorise it and draft a reply or a fix.
Authorities receive data only where the law requires it.
6. Transfers outside the EEA
Some providers above process data in the USA. Such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
7. How long we keep data
- Account, organisation, catalogue and settings: until the account is deleted.
- Print journal, print history and notifications: 180 days.
- Queued e-mails and invitations: 90 days.
- Billing records: as long as tax and accounting law requires (in Poland generally 5 years from the end of the year).
- Analytics and crash data: for the retention period set in Google Analytics and Crashlytics.
- Support requests: up to 12 months after the matter is closed, unless we need them longer to establish or defend legal claims.
- Database backups: deleted data can remain in backups for up to 16 days before they expire.
8. Your rights
You have the right to access your data and receive a copy, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time in Settings without affecting earlier processing.
- Copy of your data: Settings > Account > Your data > Download my data (a JSON file).
- Delete your account: Settings > Account > Delete account, the page evolabels.app/web/delete-account, or an e-mail to us. Deleting an owner account removes the organisation's data; its operators' accounts are detached from it. Deleting an account also removes its customer record at RevenueCat.
- One EVo account for EVoLabels and EVoShift: both apps are provided by us (EVoApps), and one EVo account (e-mail and password, Google or Apple sign-in) can sign you in to both. Each app keeps its own data and profile. If you use both apps with the same account, deleting the account in EVoLabels removes your EVoLabels data and profile, but your sign-in stays for EVoShift; deleting it in EVoShift likewise keeps EVoLabels. The sign-in itself is deleted with the account in the last app that still uses it. A new password or sign-in method you set applies to both apps.
We answer requests within one month. You can also lodge a complaint with the supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in your country of residence.
9. Google user data
For Google Sheets synchronisation the app requests access only to files you create or select
with it (https://www.googleapis.com/auth/drive.file). EVoLabels' use and transfer of
information received from Google APIs adheres to the
Google
API Services User Data Policy, including the Limited Use requirements. We use that data only
to provide the synchronisation, don't sell it, don't use it for advertising and don't transfer it
to others except as needed to provide the feature or required by law.
10. Security
Data is encrypted in transit and at rest by our providers; access is restricted by tested database rules, organisation isolation and per-user permissions. If a breach affects your data in a way that is likely to result in a high risk, we will inform you without undue delay.
11. Children
The Service is meant for businesses and is not directed at children. We don't knowingly collect data from children under 16; if you believe a child has given us data, contact us and we will delete it.
12. Changes
We will update this page when the processing changes and show the new effective date; material changes will also be announced in the app.