GDPR Compliance
Last updated: July 2, 2026
Our Commitment to Data Protection
Peel2Read is committed to protecting the privacy and personal data of all our users, in full compliance with the European Union's General Data Protection Regulation (GDPR) (EU) 2016/679.
Whether you are an individual user, a cosmetic brand, an OEM manufacturer, or a packaging design agency based in the EU, we ensure your personal data is processed lawfully, fairly, and transparently.
Data Controller
Peel2Read acts as the data controller for personal data collected through our platform. This means we determine the purposes and means of processing your personal data.
Data Controller: Peel2Read
Email: support@peel2read.com
Personal Data We Collect
Under GDPR, we collect and process the following categories of personal data:
- Identity Data: Name, company name, email address
- Account Data: Hashed passwords, account preferences, subscription tier
- Usage Data: Calculation history, uploaded label content, PDF files, translations
- Technical Data: IP address, browser type, session cookies (via Supabase Auth)
- Payment Data: Processed securely through Stripe (we do not store full credit card numbers)
Legal Basis for Processing
We process your personal data on the following lawful bases under GDPR Article 6:
Contractual Necessity (Art. 6(1)(b))
Processing necessary to provide the Peel2Read label calculation service you have requested, including creating your account, saving calculations, and delivering the features of your subscription plan.
Consent (Art. 6(1)(a))
Where you have given clear consent for us to process your data for specific purposes, such as receiving marketing communications. You may withdraw consent at any time.
Legitimate Interests (Art. 6(1)(f))
Processing necessary for our legitimate interests, such as improving our platform, preventing fraud, and ensuring the security of our services, provided these are not overridden by your rights and interests.
Legal Obligation (Art. 6(1)(c))
Processing necessary to comply with applicable laws and regulatory requirements.
Your Rights Under GDPR
As a data subject, you have the following rights. To exercise any of these rights, contact us at support@peel2read.com. We will respond within 30 days as required by GDPR.
Right of Access (Art. 15)
You may request a copy of the personal data we hold about you, along with information about how it is processed.
Right to Rectification (Art. 16)
You may request that we correct any inaccurate or incomplete personal data we hold about you.
Right to Erasure (Art. 17)
Also known as the 'right to be forgotten.' You may request deletion of your personal data where there is no compelling reason for us to continue processing it. Account data is permanently deleted within 30 days of your request.
Right to Restrict Processing (Art. 18)
You may request that we limit the processing of your personal data in certain circumstances.
Right to Data Portability (Art. 20)
You may request your personal data in a structured, commonly used, machine-readable format for transfer to another service.
Right to Object (Art. 21)
You may object to the processing of your personal data for direct marketing or where processing is based on legitimate interests.
Right to Withdraw Consent (Art. 7(3))
Where we rely on your consent for processing, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
Data Processing Agreement (DPA)
For Enterprise plan customers who are data controllers themselves (e.g., cosmetic brands processing label content through our platform), a Data Processing Agreement (DPA) is available upon request. The DPA outlines our responsibilities as a data processor under GDPR Article 28.
To request a DPA, contact support@peel2read.com.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Account data: Retained while your account is active
- Calculation history: Automatically limited to the 30 most recent records per user
- Deleted account data: Permanently erased within 30 days of account deletion
- Payment records: Retained as required by tax and accounting regulations
International Data Transfers
Peel2Read is hosted on Vercel and Supabase, with data centers located in the United States. We also use OpenAI's API for translation services. These services are certified under recognized data protection frameworks and comply with applicable data transfer mechanisms, including Standard Contractual Clauses (SCCs) where required.
By using Peel2Read, you acknowledge that your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure that appropriate safeguards are in place to protect your data in accordance with GDPR requirements.
Security Measures
Peel2Read implements appropriate technical and organizational measures to protect your personal data:
- Encryption in transit via TLS 1.3
- Encryption at rest via AES-256
- Row-Level Security (RLS) ensuring each user can only access their own data
- Authentication and authorization through Supabase Auth
- Payment processing through PCI-DSS compliant Stripe
- Regular infrastructure monitoring through Vercel and Supabase
Third-Party Sub-Processors
We use the following third-party services as data sub-processors to deliver the Peel2Read platform:
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database hosting, authentication, file storage | United States |
| Vercel | Application hosting and deployment | United States |
| OpenAI | AI-powered label translation (GPT-4o-mini) | United States |
| Stripe | Subscription payment processing | United States |
Data Breach Notification
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.
Right to Complain
If you believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority in your EU member state of residence, place of work, or place of the alleged infringement.
However, we encourage you to first contact us at support@peel2read.com so we can address your concerns directly.
GDPR Representative
As we grow, we may appoint a Data Protection Officer (DPO) or an EU representative. For now, all GDPR-related inquiries should be directed to:
Email: support@peel2read.com
Please include “GDPR Inquiry” in the subject line for faster processing.
For more details, please review our Privacy Policy and Terms of Service.