Privacy Policy
Last updated: 26 June 2026
Brincadeiras100fim Unipessoal, Lda, Portuguese tax number (NIF) 514 561 408, with registered office at Rua da Portela, 413, 3700-894 Romariz, Portugal, is the controller of the personal data collected through the EAN Studio service, available at ean-studio.com.
This Policy describes what data we collect, for what purposes, who we share it with, and your rights under the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679).
1. Data we collect
We collect only the data strictly necessary to provide the service:
- Account data — email address and name, provided when you register.
- Subscription data — your plan (Free, Starter or Pro), subscription status and renewal dates, managed by our Merchant of Record / payment processor.
- Catalog data — the products, EAN codes and references you enter are stored locally in your browser (localStorage) and are not sent to our servers.
- Label layouts — on paid plans, the label layouts you create are securely synced to our servers (Supabase) so you can access them from multiple devices. A layout may include the fixed text and the logos/images you place in the design; it does not include your product database, which stays local.
- Analytics data — usage statistics collected, with your consent, through PostHog (see section 3) to understand and improve the service.
- Technical data — IP address and access logs, recorded automatically by the hosting infrastructure for security and operational reasons.
2. Purposes and legal bases
- Providing the service and managing your account — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Managing payments and subscriptions — legal basis: performance of a contract.
- Security and fraud prevention — legal basis: legitimate interests (Art. 6(1)(f) GDPR).
- Syncing layouts across devices (paid plans) — legal basis: performance of a contract.
- Usage statistics (analytics) — legal basis: consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
- Compliance with legal obligations (e.g. retention of invoices) — legal basis: legal obligation (Art. 6(1)(c) GDPR).
We use usage statistics (analytics) only to understand and improve the service, and only after your consent. We do not use your data for advertising, we do not build marketing profiles, and we do not sell or share it with third parties for such purposes.
3. Processors and recipients
We rely on third parties to provide parts of the service. All operate under GDPR-compliant data processing agreements:
- Clerk, Inc. (USA) — authentication and account management. Privacy policy.
- Supabase, Inc. (USA) — database infrastructure and serverless functions used to operate the service. Privacy policy.
- Lemon Squeezy LLC (USA) — payment processing and subscription management. Lemon Squeezy acts as Merchant of Record and, in that capacity, is an independent controller of the billing and tax data. Privacy policy.
- PostHog — usage statistics (web and product analytics) to understand how the service is used and what to improve. Data is hosted in the European Union (PostHog EU instance) and is only collected after your consent. Privacy policy.
- Netlify, Inc. (USA) — hosting of the application and technical log recording for security reasons. Privacy policy.
Some of these entities are based outside the European Economic Area. Transfers to the USA are carried out under Standard Contractual Clauses approved by the European Commission and/or certification under the EU-U.S. Data Privacy Framework, as applicable to each provider. You may request a copy of the applicable safeguards using the contact at the bottom of this page.
4. Data retention
- Account data — kept while your account is active. After deletion, removed within 30 days.
- Billing data — kept for 10 years to comply with Portuguese tax obligations.
- Technical logs — kept for a maximum of 90 days.
5. Your rights
Under the GDPR, you have the right to:
- Access — obtain confirmation that your data is processed and receive a copy.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request the deletion of your data (the "right to be forgotten").
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Restriction — request the suspension of processing in certain circumstances.
To exercise any of these rights, email geral@ean-studio.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados (CNPD).
6. Automated decisions and profiling
We do not make decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect you.
7. Minors
EAN Studio is intended exclusively for people aged 18 or over and is not directed at minors. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor without the necessary consent, we will delete it.
8. Security
We adopt appropriate technical and organizational measures to protect your data, including encrypted communications (HTTPS/TLS) and access controls to the processing systems.
9. Changes to this Policy
In case of material changes, we will notify users with an active account by email at least 15 days in advance. The "last updated" date at the top of this page always reflects the version in force.