Who we are
Nutritional Label Maker (nutritionallabelmaker.com) is run by Glenwhisper Limited, a company incorporated in Hong Kong (glenwhisper.com), "we" or "us". HK Business Registration No. 76935415. Registered office: Unit 1603, 16/F, The L. Plaza, 367-375 Queen's Road Central, Sheung Wan, Hong Kong.
We are responsible for the personal data described here: its "controller" under the UK and EU GDPR, and its "data user" under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486, the "PDPO"). To ask about your data, use our contact form and choose "My account or saved products" as the topic.
You decide what goes into a product record, such as a business name and address for the pack, and you are responsible for having the right to include it. For the content of a saved product we act on your instructions: we store it so you can update it, download it again and reprint it, and for nothing else. Our data processing terms set this out, with the list of sub-processors.
Your products and recipes
The calculations, the label preview and every download (PDF, SVG and PNG) are made inside your web browser on your own device. Ingredient data for recipes comes from files on this site (published USDA FoodData Central data), so searching for an ingredient does not send what you type to anyone.
- Local-first storage. Your product drafts (names, values, recipes, ingredients and label choices) are saved in your browser's storage (IndexedDB) on this device, so you can close the tab and carry on later. We cannot read it. It stays until you delete the draft or clear this site's data in your browser settings.
- Nothing is uploaded until you save to an account (when you first download a label, or while you are signed in).
- We never put product details or values in page addresses (URLs), so they do not end up in server logs or browser history from our links.
- The files you download are created on your device and go straight to your downloads folder.
- Your recipes and values are never used to train or run AI models, and never shared with anyone.
Stored in your browser
Besides the session cookie described under Cookies and analytics, the site keeps these items in your browser's own storage on this device. "Local storage" lasts until you clear this site's data; "session storage" is removed when you close the tab.
| Name | What it holds | How long |
|---|---|---|
nlm (IndexedDB) | Your product drafts: names, values, recipes, ingredients, allergens and label choices. | Until you delete a draft or clear this site's data. |
nlm:anon (local storage) |
A random browser ID (for example anon_k2j8…). It is sent only with the anonymous design log, so saves from the same browser
can be grouped. Drafts made in this browser move into your account inside the browser when you sign up or log in; the ID is not sent for that.
| Until you clear this site's data; replaced when you log out. |
nlm:log-key (local storage) | A random secret, never sent. Your browser uses it to make the draft number in the anonymous design log, so that number is not your product's ID and the log cannot be matched to your account. | Until you clear this site's data; replaced when you log out. |
nlm:owner (local storage) | A scrambled key for the account signed in on this browser (no email), so the right drafts show on a shared computer. | Removed when you log out. |
nlm:pending (session storage) | The draft you just started on the home page, handed to the label workspace in case your browser blocks IndexedDB. It never leaves your device. | Removed as soon as the workspace opens it, or when you close the tab. |
nlm:quickstart (session storage) | What you chose on the home page before opening the label workspace: the product name you typed, the market and the way you want to start. No nutrition values. It never leaves your device. | Removed as soon as the workspace opens it, or when you close the tab. |
nlm:ui (local storage) | The market tab you last looked at for each product (for example “EU, France”), so the label workspace opens on the same label next time. At most 50 products; nothing you typed. It never leaves your device. | Until you clear this site's data (older entries drop off). |
nlm:signed-in (local storage) | A yes/no note that you are signed in (no email or token), so the menu can show "Account". | Removed when you log out. |
nlm:consent (local storage)
| Your analytics choice ("Allow analytics" or "No thanks"). | Until you change it or clear this site's data. |
nlm:consent-dismissed (session storage)
| A note that you closed the cookie notice without choosing, so it does not reappear on every page. | Until you close the tab. |
Open tabs of the site also tell each other when you log in or out (a browser feature called a BroadcastChannel, named nlm:session), so every tab shows the
same signed-in state. Nothing is stored or sent anywhere by it.
Anonymous design log
To learn how people use the label maker, it sends a short summary of your choices to our database (Cloudflare D1) from time to time while you work. It is
linked to a random ID created by your browser (for example anon_k2j8…) and a draft number your browser derives with a secret it never sends, not to your
name, your email or your account: the draft number is not your product's ID, so the log cannot be matched to your saved products. It contains:
- the markets you chose (for example US, Canada and the EU), how you started (values, a recipe or a copied label) and the product category you picked from our list;
- which nutrients and fields were filled in (their names, such as "sodium" or "ingredients", never the values or what you wrote);
- how many edits and saves there were, your country (two letters, worked out by Cloudflare from your connection) and the dates of the first and last save.
It never contains your product: no product names, brands, values, recipes, ingredients, allergens or addresses. In Europe it is sent only if you allow analytics. Legal basis: our legitimate interest in improving the tool (in Europe, your consent). Design log rows are deleted 400 days after their last save.
Accounts and saved products
You need a free account to download a finished label. When you create one, we store:
| What | Details | How long |
|---|---|---|
| Your account | Your email address and your password, scrambled with PBKDF2-SHA256 and a random salt (we never store or see the password itself), the date you joined and last logged in, your country and a hashed IP value at sign-up (see below). | Until you delete your account. |
| Sign-in sessions | A hashed copy of the token in your session cookie, with its start and expiry time. | Until you log out or the session expires. |
| Saved products | The product records you save (name, values, recipe, ingredients, allergens, label choices and any source notes you add, up to 256 KB each, 50 per account), so you can update them and download them again from any device. | Until you delete the product (removed for good 30 days later) or your account. |
| Label versions | A fixed copy of each label you downloaded (the product as it was, the market and the label format), so you can download exactly the same label again later, even after the rules or the ingredient data change. | Until you delete the product (removed with it) or your account. |
Legal basis: performing our agreement with you (providing the account you asked for). We use your email address to run your account and to answer you, not for marketing.
Password resets. If you ask to reset your password, a single-use reset link is created. For now it is sent to our team inbox and a person on our team forwards it to your email address, usually within one working day. The link expires after 72 hours.
Deleting your account. Deleting your account in Account settings removes your saved products, their label versions and your sessions right away. We keep only an empty record of the account ID and the date it was created, with your email address, country and sign-in dates removed, so the account ID cannot be reused. Your rows in the download log are unlinked from you and from the product.
Download log
Each time a label is downloaded, we record how: the format (PDF, SVG, PNG, a file pack or text), the market, the label format, the date and your country. Never what is on the label. It is linked to your account so we can see how the tool is used. Download log rows are deleted after 24 months; on account deletion they are unlinked from you.
Contact form
When you send a message, we store your name, email address, topic and message, the page you sent it from, the date and time, your country (two letters) and a hashed IP value in our database, and our server emails a copy to our team inbox so we can reply. Legal basis: our legitimate interest in answering questions about our service. Messages are deleted 24 months after they were sent, or sooner if you ask. Messages are limited to 5,000 characters; please don't send passwords or payment details through the form.
Hashed IP value. We never store your IP address itself. If you connect over IPv6, we first shorten the address to its network part (the /64 prefix). We then combine it with a secret that changes every day and store only the scrambled result (a SHA-256 hash). Because the secret changes daily, values from different days cannot be matched to each other. For IPv6, rate limits also keep a second hash of the wider network (the /48 prefix), made the same way. To limit sign-in and password-reset attempts on one account, rate-limit records also hold a hash of the email address tried, made with a fixed secret rather than a daily one. We use these only to limit how often forms and sign-ins can be tried and to spot abuse. Rate-limit records are deleted after about two days.
Spam check on the contact form. The contact form uses Cloudflare Turnstile to tell people from bots. When you start filling in the form, your browser loads a small script from Cloudflare (challenges.cloudflare.com), which looks at technical signals such as your IP address and browser details. Most people never see it; sometimes it asks you to tick a box. Cloudflare uses this data only to run the check and to improve its bot detection, not for advertising, and Turnstile does not use cookies to track you. We receive only a pass or fail result. It is not used anywhere else on the site.
Anonymous usage counts
The site also counts a short list of actions, such as "a market was picked", "an ingredient was added" or "a label was downloaded", sometimes with one extra word from a
fixed list (a market, a start mode, a language or a file format). Each count is added to a daily total for the whole site, with no visitor ID and no cookie. Anything that is not on the fixed
list is stored as other, so names and anything you type are never stored. The same action names are also sent to Google Analytics (see Cookies and analytics).
Daily totals are deleted after 400 days.
Cookies and analytics
- Signing in sets one session cookie (below). It is needed for your account and is not used for tracking.
- Google Analytics sets first-party cookies on this site: in Europe only after you choose "Allow analytics", elsewhere by default unless you choose "No thanks". Details below.
- No advertising. There are no ad networks, social media pixels or session recording tools, and Google Analytics runs with its advertising features off.
- Cloudflare Web Analytics counts page views without cookies (see below), and we run the anonymous counts above ourselves.
- Our fonts are served from our own domain, so no font service sees your visit.
Google Analytics
We use Google Analytics 4, a service of Google LLC, to learn which pages and features people use, so we know what to improve. It records pages you view, the site that sent you, your browser, device type and approximate location (city or country), and the actions listed under anonymous usage counts with the same one-word details. It never receives your product names, values, recipes, ingredients or anything else you type.
Cookies. When analytics is allowed, Google Analytics sets two first-party cookies on our domain: _ga, which tells visits from the
same browser apart, and _ga_<ID>, which keeps track of the current visit. As of November 2026, Google sets both to expire after 2 years by
default. They are used only for our statistics, not for advertising.
Your choice. If you visit from the European Economic Area, the UK or Switzerland, Google Analytics starts with its cookies off. Until you choose
"Allow analytics" (or if you choose "No thanks"), Google's consent mode does not read or write analytics cookies; it may still send Google a basic cookieless
signal for each page, with the time, your browser type, the referring page and whether consent was given, which Google uses for aggregate statistics. Everywhere
else, analytics cookies are on by default. Wherever you are, you can change your choice at any time with "Cookie settings" at the bottom of every page: "No thanks"
turns the cookies off from then on. Your choice is saved in your browser's local storage (nlm:consent), not in a cookie. Deleting cookies already set
is done in your browser settings.
What is switched off. We have turned off Google signals and ad personalization, so Google Analytics does not link your visits to a Google account, and its data is not used to show you ads. We do not pass ad click information between pages.
IP addresses. As of November 2026, Google states that Google Analytics 4 does not log or store IP addresses. For visitors in the EU, the UK and Switzerland, Google uses the IP address only to work out an approximate location on servers in those regions, and then discards it.
Legal basis: in the European Economic Area, the UK and Switzerland, your consent. Elsewhere, our legitimate interest in improving the tool, with the option to opt out at any time. See how Google uses information from sites that use its services.
Cloudflare
Session cookie. When you sign in, we set one cookie, nlm_session. It holds a random token that keeps you signed in; we store only a scrambled
(hashed) copy of the token. It is HttpOnly (page scripts cannot read it), sent only over HTTPS to this site, and removed when you log out or the session expires. It is
strictly necessary for your account and is not used for analytics or advertising. While you are signed in, your browser's local storage also keeps a
simple yes/no note (nlm:signed-in, no email or token) so the menu can show "Account" instead of "Log in"; it is removed when you log out.
Cloudflare, which delivers the site, may set a strictly necessary security cookie (such as __cf_bm or cf_clearance) if it needs to check that traffic is not
from a bot. These cookies are used only for security, not for tracking or advertising.
We use Cloudflare Web Analytics to count page views and measure page speed. Its small script sends the page address, referrer, browser type and timing data to Cloudflare. As of November 2026, Cloudflare states that it does not use cookies or local storage, does not fingerprint visitors and does not track people across sites. It never sees what you type into a product.
Who processes data for us
Cloudflare, Inc. hosts the site, delivers its pages, protects it from attacks, and runs the database (D1) that holds accounts, saved products and their label versions, the design log, contact messages and usage totals. It also runs the Turnstile spam check on the contact form (see Contact form). To deliver any website, Cloudflare has to handle your IP address and basic request details. Cloudflare acts as our processor under its data processing addendum. See Cloudflare's privacy policy.
Google LLC provides Google Analytics (see Cookies and analytics) as our processor under the Google Ads Data Processing Terms. We have switched off Google Analytics' "Google products & services" data sharing setting. If we ever turn it on, we will say so here first.
Our team inbox is a Google Gmail account, so contact messages, password-reset relays and our replies are also stored by Google LLC. Cloudflare delivers the email from our server to the inbox. We do not use any other service providers for the personal data on this page, and we never sell or rent it.
Where your data is handled
We are based in Hong Kong. The database and network are run by Cloudflare on servers in many countries, so your data may also be handled outside Hong Kong, the UK and the EU, including in the United States. Email copies are stored by Google (Gmail), including in the United States.
- From the UK and the EU: as of November 2026, Cloudflare's data processing addendum includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Google Analytics data is handled by Google, including in the United States, under terms that include the Standard Contractual Clauses.
- Under the PDPO: we use your data only for the purposes on this page, wherever it is processed, and Cloudflare's data processing addendum binds it to keep the data secure and to use it only on our instructions.
Your rights
Everyone. Under Hong Kong's PDPO, which applies to us wherever you live, you can ask whether we hold personal data about you, get a copy of it, and ask us to correct it. You can delete your saved products and your whole account yourself in Account settings, or ask us to do it.
In the UK and the European Economic Area. Under the UK GDPR and the EU GDPR you also have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- object to, or ask us to restrict, how we use it;
- receive it in a portable format;
- withdraw your consent at any time, without affecting what we did before.
How to ask. Send a message through our contact form from the email address the request is about. We may ask you to confirm the request from that address before we act. We reply within one month, which is also inside the 40 days the PDPO allows for access and correction requests. There is no charge.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) at pcpd.org.hk, to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or to the data protection authority where you live.
Children
Accounts are for adults. We do not knowingly collect data from children under 13 through accounts or the contact form. If you think a child has sent us their details, contact us and we will delete them.
Changes to this policy
When the site changes how it handles data, we update this page and the effective date at the top before the change goes live. If a change affects account holders in a meaningful way, we will email them. The Starter plan, when it starts, will be covered here before it launches.
See also our terms of use. Questions? Contact us.