Effective as of 2026-10-13. This policy explains how personal data is processed in the EVoLabels Android app, the web app at evolabels.app and the services behind them (together the "Service").
The controller of your personal data is Mateusz Janicki, an individual developer who publishes the Service under the name EVoApps as an unregistered activity (działalność nierejestrowana, art. 5 of the Polish Entrepreneurs' Law), address ul. Opacka 23/62, 80-330 Gdańsk, Poland, e-mail contact@evolabels.app. Write to this address for any question about your data or to exercise your rights.
Business customers and their staff. A business that uses EVoLabels decides which staff members (operators) get access and what they print. For the data the business enters about its staff - operator accounts, names on labels, the print journal - the business is the controller and we process that data on its behalf under the data processing agreement in our terms. If you are such a staff member, please contact your employer first; we will help them answer your request.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Your account, sign-in, organisation and team (owner, administrators, operators, invitations) | E-mail, name, organisation and manufacturer name, role, permissions, workstations, language, invitation e-mails | Contract, Art. 6(1)(b) |
| Licences and device seats | Device identifiers and names, licence status, last-used times | Contract, Art. 6(1)(b) |
| Products, templates, label layouts and printing, including the print journal (who printed which label, when and on which device) and labels' QR codes | Catalogue data you enter, operator names, journal entries | Contract, Art. 6(1)(b); for staff data we act as processor for the business customer |
| Transactional e-mails (verification, password reset, invitations) | E-mail, name, language | Contract, Art. 6(1)(b) |
| Service notifications and the weekly summary (push and e-mail), marketing notifications | E-mail, push token (FCM), consent settings with their dates | Your consent, Art. 6(1)(a) - each is off until you switch it on in Settings and can be switched off at any time |
| Payments and subscriptions | Purchase and subscription records, account id; card details are handled only by Google Play or Stripe, never by us | Contract, Art. 6(1)(b); keeping billing records: legal obligation, Art. 6(1)(c) |
| Usage statistics and crash reports (Google Analytics for Firebase, Firebase Crashlytics, Android app) | App events, device model and OS, app instance id, crash traces | Your consent, Art. 6(1)(a) - asked on first launch, off until you allow it, changeable in Settings. The web app uses neither. |
| AI translation of ingredients and label phrases (on request) | The text you ask to translate - please don't include personal data in it | Contract, Art. 6(1)(b) |
| Google Sheets synchronisation (optional) | Catalogue and operator lists you choose to sync into a spreadsheet you select | Contract, Art. 6(1)(b) |
| Support requests (when you write to contact@evolabels.app) | Your e-mail with its subject, text and attachment names; your name and e-mail address stay only in our mailbox. The text is recorded as a support ticket without your e-mail address, with e-mail addresses and long numbers (phones, account numbers, PESEL) in it removed | Our legitimate interest in answering you and fixing reported problems, Art. 6(1)(f), or the contract, Art. 6(1)(b), if you use EVoLabels. A person reads and answers every message; nothing is answered automatically |
| Security, preventing abuse of licences, keeping the Service working | Device integrity checks (Google Play Integrity), technical logs, IP address in server logs | Our legitimate interest in a secure service, Art. 6(1)(f) |
Providing account data is needed to use the Service; everything marked as consent is optional. We don't make decisions about you based solely on automated processing, and we don't sell your data.
The camera is used only to scan text and barcodes; recognition runs on your device and no image or recognised text is sent to us. Bluetooth connects to label printers. On Android 11 and older the system requires the location permission for Bluetooth scanning; the app does not collect your location.
The web app stores only what it needs to work in your browser (sign-in session and your preferences). It sets no advertising or analytics cookies.
We use these service providers, bound by data processing agreements, only for the purposes above:
Authorities receive data only where the law requires it.
Some providers above process data in the USA. Such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
You have the right to access your data and receive a copy, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time in Settings without affecting earlier processing.
We answer requests within one month. You can also lodge a complaint with the supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in your country of residence.
For Google Sheets synchronisation the app requests access only to files you create or select
with it (https://www.googleapis.com/auth/drive.file). EVoLabels' use and transfer of
information received from Google APIs adheres to the
Google
API Services User Data Policy, including the Limited Use requirements. We use that data only
to provide the synchronisation, don't sell it, don't use it for advertising and don't transfer it
to others except as needed to provide the feature or required by law.
Data is encrypted in transit and at rest by our providers; access is restricted by tested database rules, organisation isolation and per-user permissions. If a breach affects your data in a way that is likely to result in a high risk, we will inform you without undue delay.
The Service is meant for businesses and is not directed at children. We don't knowingly collect data from children under 16; if you believe a child has given us data, contact us and we will delete it.
We will update this page when the processing changes and show the new effective date; material changes will also be announced in the app.