Privacy policy
This policy explains what personal data Caretly processes when you visit caretly.dev, use the console or call the rendering API, why, and what your rights are. Caretly keeps as little data as it can: labels you render are never stored.
Who is responsible
Caretly is run by Jaap Elst in the Netherlands. For anything about your data, email jaap@jaapelst.nl.
For the labels you send to the API, you decide what is in them and why, so you are the controller and Caretly processes them on your behalf (see Labels you render and the data processing terms).
What we process
Website and documentation
- When you visit caretly.dev, our servers receive your IP address, the page requested, the time and your browser's user agent. These requests appear in our server logs, which are kept briefly (normally days, at most 30 days) for security and troubleshooting. Legal basis: our legitimate interest in running a secure service.
- No analytics, advertising or tracking cookies, and no third-party scripts. Fonts are served from caretly.dev itself.
- The site remembers your light/dark choice in your browser's local storage. It never leaves your device.
- The documentation at caretly.dev/docs is hosted by Mintlify, which receives the same request data when you read it.
Your account
- Name, email address, company name and a hashed password (we cannot read your password). If you sign in with Google or Microsoft, we receive your name, email address and an account identifier from them, and nothing else.
- Your organisations, memberships, roles and invitations, including the email addresses you invite.
- A session cookie (
zc_session) that keeps you signed in for up to 30 days. It is strictly necessary for the console, so it needs no consent. We use no other cookies. - Email verification and invitation emails, sent through Resend. A copy is kept for up to 7 days for delivery and then deleted.
Legal basis: performing our contract with you.
API keys and usage
- For each API key: its name, type, creation and expiry dates, and whether it was revoked. Keys themselves are not stored; they are signed tokens only you have.
- For each request rendered with a key: the time, the key, the number of labels, the output format and the optional
Idempotency-Keyyou send. These usage records are what we bill you for and what the console and usage API show.
Legal basis: performing our contract with you, and our legal obligation to keep billing records.
Labels you render
The ZPL you send, and the shipping labels in it, are processed in memory to produce your PDF or PNG and are discarded as soon as the response is sent. They are not written to disk, logged or used for anything else. The browser playground renders labels on your own device; nothing is sent to us.
Billing
Payments run through Stripe. Stripe collects your payment details, billing address and VAT number; we only store your Stripe customer and subscription identifiers and subscription status, and send Stripe the number of labels to bill. Legal basis: performing our contract and our legal obligations (bookkeeping and tax).
Who else processes data
We use these service providers, each under a data processing agreement:
- Hetzner Online (Germany) and Cloudfleet (Germany): servers and hosting, in the EU.
- Stripe (Ireland and USA): payments and invoices.
- Resend (USA): sending account emails.
- Mintlify (USA): hosting the documentation.
- Google and Microsoft: only if you choose to sign in with them.
Where a provider is outside the EU, transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We do not sell personal data or share it with anyone else, unless the law requires it.
How long we keep it
- Account and organisation data: as long as your account exists. Ask us to delete your account and we remove it within 30 days.
- Usage records and invoices: 7 years, as Dutch tax law requires for billing records.
- Sessions: up to 30 days. Email verification links: 24 hours. Invitations: 14 days. Sent emails: 7 days.
- Server logs: briefly, at most 30 days.
Your rights
You can ask to see, correct, delete or export your personal data, to restrict its processing, or object to it. Email jaap@jaapelst.nl; we answer within a month. If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Security
All traffic is encrypted with TLS. Passwords are hashed with Argon2, sessions and links are stored only as hashes, and access to production systems is limited to the people who run Caretly.
Changes
We update this policy when what we do changes. The date at the top shows the latest version; for important changes we email account holders.