1. Controller
The controller responsible for processing your personal data on usecarelabel.com is:
Layora Enterprises FZE LLC
CWS-1V-225475, 26th Floor, Amber Gem Tower
Ajman, United Arab Emirates
Licensed by Ajman Free Zone Authority, License No. 2627211926888
Email: [email protected]
For all questions about your data and your rights, write to [email protected]. We have not appointed a data protection officer because the law does not require one for our processing.
We offer our service to customers in the European Union, so the General Data Protection Regulation (GDPR) applies to the processing described here. An EU representative under Art. 27 GDPR has not yet been designated.
2. The short version
- No user accounts, no advertising, no tracking cookies, no third-party analytics. Visits are counted with anonymous event counters that store no IP address.
- Your uploaded label image is read by an AI model to extract the label text. We keep the extracted label data, the result and a small preview image of your label (at most 240 pixels), not the full image.
- Your email address is used to send you your result and your order updates, nothing else, unless you ask us to notify you when ordering opens.
- Payments are handled by our payment partner as merchant of record. We never see your card details.
- We are based in the United Arab Emirates. Section 7 explains what that means for your data.
3. What we process, why, and on which legal basis
Free check
Label image or file. When you upload a photo, a PDF or an artwork file, it is sent to our server and forwarded to the AI model that reads the label (section 4). The full image is processed to run the check and is not stored by us after processing. Your browser also creates a reduced preview image of your label (at most 240 pixels on the long side), which we store for 30 days together with your result so that your result page shows which label was checked. If the AI cannot read your file, our server notifies us of the failed check with your email address, the file name and the selected markets so that we can review it personally; the file itself stays in your browser until you send it to us by email.
Legal basis: performance of a contract or steps before a contract, Art. 6(1)(b) GDPR.
Extracted label data and result. The text read from your label (fiber composition, care instructions, origin, manufacturer details, product identifiers), the markets you selected, the findings, the score and the file name are stored under your check ID so that your result link works and we can answer questions about it. Manufacturer details on a label can be personal data if you are a sole trader.
Legal basis: Art. 6(1)(b) GDPR.
Email address. Used to send your result link and, if you order, your order confirmation, confirmation request and delivery message.
Legal basis: Art. 6(1)(b) GDPR.
Label created from scratch. If you build a label without uploading an image, we store the product data you enter in the same way as extracted label data.
Legal basis: Art. 6(1)(b) GDPR.
Paid orders
Order and status data. Check ID, chosen product, order status, the product data you confirm or correct on your status page, your declaration whether you hold a GINETEX licence, the approved label specification, the render check of the final file and the certificate record.
Legal basis: Art. 6(1)(b) GDPR.
Payment data. Our payment partner (merchant of record), named on the checkout page, collects and processes your payment details, billing address, tax status and the data needed for the invoice as the seller of record. The partner is an independent controller for that processing; its privacy policy is linked at checkout. From the partner we receive the order confirmation with your email address, the product bought and the check ID, so that we can link the payment to your check. We do not receive or store card details.
Legal basis: Art. 6(1)(b) GDPR.
Support emails. If you write to us, we process your email address and the content of your message to answer you.
Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR.
Notification requests
While ordering is closed, you can leave your email address to be notified when it opens. We store the address, the check ID if there is one and the time of your request, and we contact you about this once it opens. You can withdraw at any time by writing to [email protected]; the Digital Product Passport notification works the same way.
Legal basis: your consent, Art. 6(1)(a) GDPR.
Technical data and security
Connection data. Our hosting provider processes your IP address and technical request data to deliver the site, to protect it against abuse and to enforce a rate limit on checks per IP address. We do not store IP addresses in our own records; the rate limit counter is short-lived.
Legal basis: legitimate interest in operating a secure service, Art. 6(1)(f) GDPR.
Technical logs. Our hosting provider keeps short-lived technical logs of requests (IP address, time, requested address, browser type) to operate and protect the service. We do not keep request logs of our own.
Legal basis: Art. 6(1)(f) GDPR.
Bot protection. The check form uses Cloudflare Turnstile, which evaluates technical signals of your browser to tell people from bots. Turnstile may store a technical cookie or local storage entry for that purpose.
Legal basis: Art. 6(1)(f) GDPR and, where storage on your device requires it, your consent is not needed because the storage is strictly necessary to provide the check you request.
Browser storage. The website stores your recent checks (email address, file name, markets, check ID) and interface preferences in your browser's local storage so that you can return to a result. This data stays on your device; we can read it only when your browser sends it with a request you make. We set no cookies of our own, no advertising cookies and no analytics cookies.
Checkout page. The checkout page loads the payment partner's checkout script from the partner's content delivery network. The partner may set cookies that are needed to run the checkout and detect fraud. The partner is an independent controller for that processing.
HEIC conversion. If you upload an iPhone HEIC image and your browser cannot read it, the site loads a small conversion library from cdnjs.cloudflare.com, a content delivery network operated by Cloudflare. That request transmits your IP address to Cloudflare. The image is converted in your browser and does not leave your device for the conversion.
Anonymous usage counters. We count events such as "page opened", "check started" and "result shown" per day. The counters contain numbers only, no IP address and no identifier.
4. AI and quality check
Reading a care label from a photo is done by an AI model provided by Anthropic. The model receives the image and returns the text and symbols it reads, in a structured form. The evaluation of that text against the labeling rules is done by our own deterministic software, not by the AI. For paid orders, the result, the confirmed product data and the final label file pass a quality check before anything is delivered.
The free check result is information for you. It does not produce a decision with legal or similarly significant effects on you, and no decision about you is taken solely by automated means in the sense of Art. 22 GDPR. The images you upload are sent to the AI provider under contract terms that prohibit using them to train models.
5. Recipients and processors
We use the following service providers. Unless stated otherwise, they act as processors on our behalf under data processing agreements and may only process data on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc., San Francisco, USA | Hosting of the website and the check service, storage of check and order records (Workers KV), rate limiting, content delivery including cdnjs | Global network; USA |
| Cloudflare, Inc. (Turnstile) | Bot protection on the check form | Global network; USA |
| Anthropic, PBC, San Francisco, USA | Automatic reading of the uploaded label photo (AI model) and render checks of final label files | USA |
| ActiveCampaign, LLC (Postmark), Chicago, USA | Email: result links, order and delivery messages | USA |
| Our payment partner (merchant of record), named on the checkout page | Payment and invoicing. Independent controller. | United Kingdom |
We do not sell personal data and do not share it with advertisers. We disclose data to authorities only where the law obliges us to.
6. How long we keep data
| Data | Retention |
|---|---|
| Uploaded label images (full size) | Not stored by us. Processed for the check and discarded; the AI provider's retention is governed by its contract terms. |
| Preview image of the uploaded label (at most 240 pixels) | 30 days from the check, together with the free check record; 12 months after delivery if the check becomes an order. |
| Free check records (extracted label data, result, email address, file name, preview image) | 30 days from the check, then deleted automatically. |
| Extraction cache (label data read from an uploaded file, stored under a hash of the file so that the same file is not read twice; no email address, no image) | 30 days, then deleted automatically. |
| Paid order records (confirmed product data, label specification, status, render check, email address) | 12 months after the last status update, for example the delivery, then deleted automatically. |
| Certificate verification record (certified label content, hash, check date, rule version, markets) | Until deletion is requested. It keeps issued certificates verifiable and contains no email address and no image. |
| Notification requests | 12 months, or until you withdraw. |
| Support emails | Until deletion is requested. |
| Anonymous usage counters | 90 days. |
| Payment and invoice data | Held by the payment partner under its statutory retention duties. |
7. Where your data is processed, and transfers outside the EU
We are established in the United Arab Emirates. There is no adequacy decision of the European Commission for the UAE, so your data is processed in a country whose law does not provide the same level of protection as the GDPR. We apply the standards of the GDPR to all processing described here, we limit the data we hold to what the service needs, and we grant you the rights in section 8 regardless of where the data is processed. Where we conclude agreements with processors or partners outside the EU and the EEA, we use the European Commission's standard contractual clauses or, for the United Kingdom, the applicable UK transfer mechanism, together with supplementary measures where needed. You can request a copy of the safeguards in place by writing to [email protected].
Our providers in the United States (Cloudflare, Anthropic, Postmark) process data under standard contractual clauses and, where the provider is certified, under the EU-US Data Privacy Framework. The payment partner processes data in the United Kingdom, for which an adequacy decision exists.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17), for example a check record before it expires;
- have processing restricted (Art. 18);
- receive the data you gave us in a portable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw a consent at any time with effect for the future (Art. 7(3)).
To exercise these rights, write to [email protected] and state your check ID if you have one. We answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority in the EU, in particular in the member state where you live, work or where you think a violation took place.
9. Is providing data required?
Providing data is neither legally nor contractually required. Without an uploaded image or entered label data and an email address we cannot deliver a check result, and without the confirmation of your product data we cannot deliver a paid order.
10. Security
All connections to usecarelabel.com and to our check service are encrypted (HTTPS). Internal functions are protected by access tokens, records are stored with automatic expiry, and we keep the amount of data we hold to the minimum the service needs. No system is completely secure; if a breach affects your data, we inform you and the competent authority as the law requires.
11. Children
Our service is aimed at businesses and adults. We do not knowingly process data of children under 16. If you believe a child has given us data, write to us and we will delete it.
12. Changes to this policy
We update this policy when the service, our providers or the legal situation change. The current version with its date is always available on this page.