Who we are
UPC Label Generator (upclabelgenerator.com) is run by Glenwhisper Limited ("we", "us"). We are the controller of the personal data described here, which means we decide how it is used. To ask about your data, use our contact form and choose "Something else" as the topic.
What happens to the numbers and files you enter
When you type a UPC, add a product name, paste a list or open a spreadsheet, all of the work happens inside your web browser on your own device. Checking the number, laying out the label and creating the PDF, SVG or PNG file all happen there too.
- Your UPC numbers, product names, SKUs and spreadsheet files are not uploaded to us or to anyone else.
- We never put product data in page addresses (URLs), so it does not end up in server logs or browser history from our links.
- The files you download are created on your device and go straight to your downloads folder.
What your browser saves
The tool keeps some data in your browser's local storage on this device. Local storage is not a cookie: it is not sent to our server with each request, and we cannot read it. It holds:
- Saved products: the UPC, title, subtitle, SKU and default quantity you chose to save.
- Printer profiles: the label stock and the small alignment shift you set for your printer.
- Print history: each time you download a label PDF from bulk printing or My labels, or a single-label PDF with more than one label or a product name, a copy of that job (the UPCs, product names and second lines, quantities, label stock and printer shift) is added automatically, so you can print it again exactly. The last 100 jobs are kept. Delete them any time in My labels › Print history.
- Last label stock: the label size you last picked, so the tools open on it next time.
- Printer resolution: the thermal printer resolution you picked (203 or 300 dpi), so roll labels match your printer.
- A waitlist flag: after you join the waitlist, a note so the site stops asking you and shows "You're on the list" next time. It does not hold your email address.
- Dismissed notices: a flag so a Pro waitlist card you closed stays closed.
Your browser's session storage, which lasts only as long as the tab, holds two more things:
- Your bulk printing list: while you work on a list in bulk printing, the rows (UPCs, product names, second lines and quantities) and your layout settings are kept for that tab, so reloading the page or following a link and coming back does not lose your work. It is removed when you clear the list or close the tab.
- Numbers sent from the UPC checker: when you send numbers to bulk printing or the generator, they are passed this way and removed as soon as the receiving tool reads them, or when you close the tab.
This data is used only to run these features on this device. Saved products and printer profiles are stored only when you save them. Print history is recorded automatically when you download a PDF, as described above. On a shared computer, clear Print history when you finish. All of it stays until you delete it in the tool or clear this site's data in your browser settings. Private or incognito windows usually erase it when they close. Because it lives only on this device, it is not backed up by us, and it will not appear on your other devices.
What we store when you join the waitlist or contact us
These are the only forms on the site. What you send is stored in a database we run on Cloudflare D1.
| Form | What we store | Why | How long |
|---|---|---|---|
| Pro and API waitlist | Your email address, the features you ticked, the monthly label volume if you chose one, the page you signed up on, the date and time, your country (two letters, worked out by Cloudflare from your connection) and a hashed IP value (see below). If you sign up again with the same email, we add any new features you ticked and the new volume to your existing entry. The sign-up date, page, country and hashed IP stay those of your first sign-up. | To email you when Pro or the API pilot opens, and to understand which features to build first. Legal basis: your consent. | 24 months from the day you joined, then deleted automatically. Sooner if you ask us to remove you. |
| Contact form | Your name, email address, topic and message, the page you sent it from, the date and time, your country (two letters) and a hashed IP value. | To read and answer your message, and to follow up if you report a problem. Legal basis: our legitimate interest in answering questions about our service. | 24 months from the day you sent it, so we can see the history if you write again. Then deleted automatically. Sooner if you ask. |
Hashed IP value. We never store your IP address itself. If you connect over IPv6, we first shorten the address to its network part (the first half, called the /64 prefix), which usually covers every device on one internet connection. We then combine the address, or its shortened form, with a secret that changes every day and store only the scrambled result (a SHA-256 hash). Because the secret changes daily, values from different days cannot be matched to each other. We use it only to limit how often a form can be sent from one connection (a handful of waitlist sign-ups or contact messages an hour) and to spot spam.
Team notifications. When a contact message arrives, our server may send a short notice to our team inbox or chat so we see it quickly. The notice says only that a message arrived, with its reference number and topic. It never includes your name, email address or message, and it is sent from our server, not from your browser.
Messages are limited to 5,000 characters. Please don't send customer data, passwords or payment details through the form. We do not sell, rent or share waitlist or contact data with anyone for their own use, and we will not add you to a newsletter.
How deletion works. There is no separate clean-up job. Each time someone joins the waitlist or sends a message, the site deletes every entry in that form's table that is more than 24 months old. The usage counter (below) also runs the same deletes from time to time, so old entries are removed even in a quiet month.
Anonymous usage counts
To learn which tools and label sizes people use, the site counts a short list of actions. Each count is added to a daily total for the whole site. There is no visitor ID, no cookie and no profile of you. The actions we count are:
-
tool_opened: a tool was opened -
code_validated: a number was checked -
preview_viewed: a label preview was shown -
pdf_downloaded: a PDF was downloaded -
png_downloaded: a PNG was downloaded -
svg_downloaded: an SVG was downloaded -
bulk_imported: a list or spreadsheet was imported -
product_saved: a product was saved in the browser -
job_reprinted: a saved job was reprinted -
print_test_downloaded: a printer test page was downloaded -
waitlist_viewed: the waitlist form was shown
Some counts carry one extra word: the label stock (for example avery-5160), the tool or type of import used (for example bulk or csv), or the
page a waitlist form was shown on. Your browser never sends anything that looks like a barcode number, and our server keeps the word only if it is on a fixed list we wrote.
Anything else is counted as other, so UPCs, product names and anything you type are never stored. What we keep is a table of daily totals, for example how many PDFs
were downloaded for Avery 5160 on a given day.
Daily totals more than 400 days old (about 13 months) are deleted automatically: every so often, recording a count also runs that clean-up.
To stop one connection flooding the counters, each request is checked against the same daily hashed IP value described above. Those rate-limit records hold only the hash and a counter, and are deleted automatically after about two days. Legal basis: our legitimate interest in improving the tool and keeping it running.
Cookies and analytics
- We do not set cookies. The site works without them.
- No advertising and no third-party trackers. There are no ad networks, social media pixels or session recording tools on the site.
- One cookieless page-view counter: Cloudflare Web Analytics (see below), plus the anonymous counts above, which we run ourselves.
- Our fonts are served from our own domain, so no font service sees your visit.
Cloudflare, which delivers the site, may set a strictly necessary security cookie (such as __cf_bm or cf_clearance) if it needs to check that traffic is not
from a bot. These cookies are used only for security, not for tracking or advertising.
We use Cloudflare Web Analytics to count page views and measure page speed. Its small script sends the page address, referrer, browser type and timing data to Cloudflare. As of November 2026, Cloudflare states that it does not use cookies or local storage, does not fingerprint visitors and does not track people across sites. It never sees the numbers you type or the files you load, because those stay in your browser.
Who processes data for us
Cloudflare, Inc. hosts the site, delivers its pages, protects it from attacks and runs the database that holds waitlist sign-ups, contact messages and usage totals. To deliver any website, Cloudflare has to handle your IP address and basic request details (such as your browser type and the page you asked for). Cloudflare acts as our processor under its data processing addendum, and handles that data under its own security and logging policies. Cloudflare runs a global network, so data may be handled outside the UK and the EU. As of November 2026, Cloudflare's data processing addendum includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum to protect those transfers. See Cloudflare's privacy policy.
When we reply to a message, the conversation also passes through our email provider. If team notifications are switched on, the notice described above is delivered by the service that runs our team inbox or chat, but it contains no personal data. We do not use any other service providers for the personal data on this page.
Your rights
Under the UK GDPR, and the EU GDPR if you are in the European Economic Area, you have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted, for example to leave the waitlist;
- object to, or ask us to restrict, how we use it;
- receive it in a portable format;
- withdraw your consent at any time, without affecting what we did before.
To use any of these rights, send a message through our contact form using the email address the request is about. We may ask you to confirm the request from that address before we act. We reply within one month. There is no charge.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by phone on 0303 123 1113, or to the data protection authority where you live.
Children
UPC Label Generator is a tool for businesses and is not aimed at children. We do not knowingly collect data from anyone under 13. If you think a child has sent us their details, contact us and we will delete them.
Changes to this policy
When the site changes how it handles data, we update this page and the effective date at the top before the change goes live. If a change affects people on the waitlist in a meaningful way, we will email them. When paid plans with accounts launch, this policy will be updated to cover them first.
See also our terms of use. Questions? Contact us.