Privacy policy
What this website collects, why, who else sees it, and how to make us delete it. There is not much of it, so this says precisely what there is rather than covering everything a policy could theoretically need.
The short version
This marketing website stores one thing: the email address you type into the demo form, plus a little context about where you came from. We set no cookies whatsoever. We run no advertising trackers and no analytics. We do not sell data. If you read the page and leave without submitting the form, nothing about you is stored anywhere.
Who is responsible for it
Label Craft is the data controller for everything described here. We are at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom, and you can reach us at hello@labelcraft.lc about anything on this page.
What we collect, and only when you submit the form
Nothing on this list is gathered from browsing. Every item is captured at the moment you press the button on the demo form, and not before:
- Your email address. The only thing we actually want. Stored once — a second submission updates the existing row rather than creating another.
- Which part of the page you submitted from, and any campaign parameters in the link you followed. This tells us that the pricing section converts and the footer does not, which is how the page gets better.
- A one-way hash of your IP address. Not the address itself. It is salted and hashed before it reaches the database, so it cannot be turned back into an IP address. It lets us notice one machine submitting a thousand times; it does not let us identify you or recognise you on a later visit.
- Your browser’s user-agent string and the page that referred you, so we know which browsers to support and which channels are worth the effort.
That is the entire contents of the one database table behind this site. There is no second table and no profile built from these fields.
What we do not collect
- No cookies at all. Not analytics cookies, not advertising cookies, not “strictly necessary” ones. This is why you have not been shown a consent banner: there is nothing to consent to.
- No browser storage. The site writes nothing to local storage, session storage or anywhere else on your device.
- No third-party analytics, and no profiling of you across other websites.
- No fingerprinting, no session replay, no heatmaps, no scroll tracking.
- No social media pixels or embedded trackers.
- Nothing whatsoever if you read the page and leave.
Protecting the form from abuse
Two things run when you submit, and both are worth disclosing because both process information about you. A hidden field that no human can see catches automated submissions — if it is filled in, the submission is discarded. And the hashed IP address is counted against a limit of five submissions an hour, held in memory and not written to disk. Our lawful basis for both is our legitimate interest in keeping the form usable.
Server logs
Our hosting produces the ordinary web server logs any site produces — request time, path, status code and IP address — which exist so we can diagnose faults and identify attacks. They are not loaded into any analytics tool, not joined to the form data, and not used to build a picture of individual visitors. They are kept for a short operational period and then rotated away.
Why we are allowed to hold it
Under UK GDPR our lawful basis for the demo form is legitimate interest: you asked us to send you a product walkthrough, and we send it. We have weighed that against your interest in being left alone, which is why the collection is as small as it is, why the IP address is hashed, and why one email is one email rather than the start of a sequence.
You can object at any time. The unsubscribe link in the first email works in one click, and emailing us works just as well.
How long we keep it
Until you ask us to delete it, or twenty-four months after your last interaction with us, whichever comes first. At that point the row is deleted from the database, not flagged as hidden and quietly retained.
Who else sees it
Two providers, both processing on our instructions under contract, and nobody else:
- Our hosting provider, which runs the server this page and its database sit on.
- Our email delivery provider, which needs your address in order to deliver the walkthrough to it.
We do not sell, rent or share your details with advertisers, data brokers, partners or anybody else. If we are ever legally compelled to hand something over we will tell you, unless we are forbidden from doing so.
Where it is stored
In the United Kingdom or the European Economic Area. We do not transfer this data outside that area. If that ever changes, this page changes first.
Third-party content on this page
Fonts are self-hosted, so no request leaves for a font provider and no font service learns that you visited. Video is served from our own domain. Until we finish replacing our placeholder screenshots the page may load stand-in imagery from a stock media host, which necessarily sees your IP address as a consequence of serving a file to your browser — the same as any image on any website. There are no embedded videos, maps, chat widgets or social buttons, and no iframes from anyone else.
How we keep it safe
The site is served over HTTPS only. A strict content security policy means the browser refuses to run any script we did not put there, which is the practical defence against a third party injecting a tracker into a page we control. The form endpoint accepts only same-origin JSON requests. The database account behind it can read and write the one leads table and nothing else. No system is perfect, but the address you give us is not sitting anywhere careless.
Your rights
You can ask us to:
- give you a copy of everything we hold about you;
- correct it if it is wrong;
- delete it;
- stop or restrict what we are doing with it;
- hand it over in a portable format;
- stop contacting you, which we will treat as an instruction and not a conversation.
Email us and we will act within thirty days, usually the same week. We will not ask you to justify the request or try to talk you out of it. If you are not satisfied with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk, and you do not have to raise it with us first.
Automated decisions and children
We make no automated decisions about you and carry out no profiling. This site is aimed at businesses and is not directed at children; we do not knowingly collect anything from one.
The product is separate
This policy covers this marketing website only — the pages you are reading and the demo form on them. The Label Craft application is a different system with its own privacy documentation and its own data processing agreement, covering label designs, print records and account information. Those are provided when you open an account, and on request beforehand if you are evaluating us.
Changes to this policy
If we change what we collect, this page changes before the collection does. The version here is always the current one.
Contact
Email hello@labelcraft.lc with anything at all — including “delete everything you have about me”, which is a perfectly reasonable request and one we will honour without asking why.