Privacy policy

Who is responsible

Printlabs GmbH, Neuseser Str. 19, 90455 Nürnberg, Germany, operates this application as the controller for the data described below. Questions about this policy or about your data can be sent to the contact address published at print-labs.de.

What the application does

It connects an Etsy shop to Printlabs for print-on-demand fulfilment. It imports paid orders from Etsy, sends them to Printlabs for production, and returns the shipment tracking number to Etsy so the buyer is notified.

What is stored

For the shop owner using the app:

• Email address and, optionally, a company name
• Etsy access and refresh tokens, and the Printlabs API key, all encrypted at rest
• Product mappings and uploaded print files

For buyers of the shop, taken from the Etsy order and used only to produce and ship it:

• Name and shipping address
• Email address, where Etsy provides it, because Printlabs requires an address on every order
• Order contents, totals, and the shipment tracking number

Buyers do not have accounts here and do not interact with this application directly.

Who it is shared with

• Printlabs — the order, the shipping address and the print files, in order to produce and ship it
• Etsy — the tracking number and carrier, so the order is marked shipped and the buyer is notified
• Supabase (database and file storage) and Vercel (hosting), as processors

Nothing is sold, and nothing is used for advertising or profiling.

How it is protected

• Every stored credential — Etsy tokens, the Printlabs API key, webhook secrets — is encrypted with AES-256-GCM. Decryption happens only on the server; credentials never reach a browser.
• Each shop’s data is isolated at the database level by row level security, so one shop cannot read another’s orders.
• Print files are held in private storage and reachable only through short-lived signed links.
• Transport is HTTPS throughout.

How long it is kept

Order data is kept while the shop’s account exists, so that fulfilment and shipment history remain available. Deleting the account deletes it.

German commercial and tax law requires certain business records to be retained for a fixed period; the retention period applied to order records here is set by Printlabs GmbH and is stated in their general privacy notice.

Your rights

Under the GDPR you may request access to your data, correction, erasure, restriction of processing, and portability, and you may object to processing or complain to a supervisory authority.

A shop owner can delete their account and all associated data at any time from the Account page in the app; this removes the connections, orders, buyer addresses and uploaded print files, and cannot be undone. A buyer wishing to exercise these rights should contact the shop they ordered from, which is the controller of that order.

Cookies

Only what is needed to keep you signed in and to complete the Etsy authorisation securely. No analytics, advertising or tracking cookies are set.