Privacy Policy
Last updated: February 2026
1. Introduction
This Privacy Policy explains how KOMANDA STUDIO UNIPESSOAL LDA ("we", "us", "our"), operating under the brand name "CoLabel", collects, uses, and protects your personal data when you use our website and services at colabelms.com.
We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR) and Portuguese data protection laws.
Data Controller: KOMANDA STUDIO UNIPESSOAL LDA
Rua Principal 1028 Zambujeiro, 2755-307 Alcabideche, Cascais, Portugal
Tax ID: PT518580245
Email: privacy@colabelms.com
2. What Personal Data We Collect
2.1 Account Information
Name, email address, company name (optional), password (encrypted), and profile picture (optional).
2.2 Billing Information
Payment card details (processed securely by Stripe — we do not store full card numbers), billing address, and VAT number (if applicable).
2.3 Content You Upload
PDF files, label designs, comments, annotations, images, and attachments. You retain ownership of all content you upload.
2.4 Technical Data
IP address, browser type and version, device information, operating system, pages visited, date and time of access, and referring website.
2.5 Cookies and Analytics
We use cookies and similar technologies. See our Cookie Policy for details.
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide and maintain our services | Performance of contract (Art. 6(1)(b)) |
| Process payments and billing | Performance of contract (Art. 6(1)(b)) |
| Send service-related emails | Performance of contract (Art. 6(1)(b)) |
| Send marketing communications | Consent (Art. 6(1)(a)) |
| Improve services and develop features | Legitimate interest (Art. 6(1)(f)) |
| Prevent fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. How We Share Your Data
We do not sell your personal data. We share data only with service providers (Supabase, AWS, Vercel, Resend, Google, Microsoft, Stripe), all bound by GDPR-compliant data processing agreements.
For international transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | While account is active |
| Data after account deletion | 30 days, then permanently deleted |
| Billing and invoice records | 10 years (Portuguese tax law) |
| Server logs | 90 days |
| Analytics data | 26 months |
6. Your Rights Under GDPR
You have the right to: access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), and withdraw consent (Art. 7).
Contact us at privacy@colabelms.com. We will respond within 30 days.
You may also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1200-651 Lisboa, Portugal — cnpd.pt
7. Data Security
We implement encryption in transit (TLS 1.3) and at rest (AES-256), regular security assessments, access controls, employee confidentiality obligations, and regular backups.
8. Children's Privacy
CoLabel is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16.
9. Changes to This Policy
We may update this policy and will notify you of significant changes by posting a notice on our website or sending an email.
10. Contact Us
KOMANDA STUDIO UNIPESSOAL LDA
Rua Principal 1028 Zambujeiro, 2755-307 Alcabideche, Cascais, Portugal
Email: privacy@colabelms.com
This Privacy Policy is governed by Portuguese law and the General Data Protection Regulation (GDPR).