This Privacy Policy explains how the LabelPop add-in for Microsoft Excel ("the Add-in"), published by Bosau Digital LLC ("we", "us", or "our"), which operates Python & VBA at pythonandvba.com, handles your data. It applies specifically to the Add-in. Our general website Privacy Policy, which also covers our website and its analytics, continues to apply to your use of our website.

1. In Short

• The Add-in reads your list and builds your labels and PDFs on your own device, inside Microsoft Excel. Your workbook is not uploaded.
• Excel on the web builds the PDF in the task pane and uploads nothing.
• Outside Excel on the web (for example Excel for Windows and Mac), opening the PDF in your browser needs one extra step. The task pane encrypts the print job on your device (AES-GCM, 256-bit key), and our server (api.pythonandvba.com) stores only that encrypted copy for at most 10 minutes and deletes it the first time your browser opens it. The key stays in the part of the print link after the # sign, which browsers never send to a server, so we cannot read your addresses.
• Beyond that, the Add-in loads its program code and the print page from addins.pythonandvba.com and Microsoft's office.js. Its only other network requests are the encrypted print job and a license key.
• The Add-in and its print page contain no advertising, no cookies, no telemetry, and no third-party analytics or tracking.

2. Who We Are

The Add-in is published and operated by Bosau Digital LLC, the company behind Python & VBA (pythonandvba.com), founded by Sven Bosau. For any privacy-related questions, please contact us at contact@pythonandvba.com.

3. What Data the Add-in Processes

Your Spreadsheet Data

The Add-in reads the cells of the list you point it at, suggests a layout from your column headers, draws the preview and builds the labels locally, inside Excel, on your device. Your workbook is never uploaded to us. The only thing that can leave your device is the encrypted print job described below, and only outside Excel on the web (for example on Excel for Windows and Mac).

The Add-in writes to your workbook only when you ask it to: Label sheet in Excel adds a new worksheet laid out to the label grid, and Sample data adds a new sheet with a small sample list.

The Encrypted Print Job (Outside Excel on the Web)

Desktop Excel cannot open a downloaded PDF from inside the task pane, so the Add-in opens a print page in your browser. To hand the job over, it works like this:

• The task pane puts the print job together on your device: the label size, your design, the calibration offsets, the text of each label and, if you use one, your logo image.
• It encrypts that job on your device with a fresh AES-GCM 256-bit key and a random initialisation vector (IV), using the Web Crypto API of your computer.
• It sends only the encrypted job to api.pythonandvba.com. The key, the IV, a file name and your addresses in readable form are not sent.
• Our server stores the encrypted job for at most 10 minutes and deletes it the first time it is fetched.
• The Add-in opens the print page in your browser with a link whose fragment (the part after the # sign) carries the job's reference, the key and the IV. Browsers never send the fragment to a server, so the key never reaches us and the server cannot read your addresses.
• Apart from its own code and fonts from addins.pythonandvba.com, the print page makes one request, to fetch the encrypted job. It decrypts the job and builds the PDF in your browser, and it loads no analytics and no third-party content.

The first time you use this, the Add-in shows a notice in the task pane that says the same in a sentence. If the link has expired, the print page tells you to click Create PDF in Excel again. When the encrypted job cannot be sent, the Add-in offers the label sheet in Excel instead.

Our server logs for print jobs contain only a short prefix of the job's reference, its size and its status, never content.

Excel on the Web

In Excel on the web the task pane builds the PDF itself and opens it in a new browser tab. Nothing is uploaded, and no print job is created on our server.

License Validation Data

To confirm that you hold a valid license, the Add-in sends the following to our license server (api.pythonandvba.com) over an encrypted connection. It never sends any workbook content:

• Your license key;
• A random installation identifier generated on your device. It contains no name, email, or hardware information, but it is tied to your license, so it is not anonymous. It is used only to enforce the per-installation activation limit of your license;
• The Add-in version;
• A short platform label, such as "Excel for Windows" or "Excel on the web · Chrome", so the device list in your account is readable. It never contains a user name, a computer name or the full browser identification.

The check runs when the task pane opens and a license key is stored on the device, and when you add a key. When you remove a key, the Add-in sends the key and the installation identifier once more, so the device's slot is freed. If you never enter a license key, these requests are never made. A record of your last successful check is stored on your device so licensed features keep working for a short offline grace period (currently 7 days) if the license server cannot be reached, and then re-verifies once you are back online.

Like any web server, our server also receives your IP address with each request, for the license check and for the print job. It appears in our server logs, which are deleted after 14 days (90 days for warnings and errors). The installation identifiers registered to your license are kept with your license record (when each was first seen and last used) for as long as the license exists. If a check fails, we keep the license key, IP address, approximate country, installation identifier and Add-in version for up to 90 days to detect misuse of keys.

Loading the Add-in

Like every Office add-in, the Add-in loads its program code when the task pane starts: the LabelPop code from our server addins.pythonandvba.com, and Microsoft's standard add-in library (office.js) from Microsoft. These are ordinary web requests for code. They carry no workbook content, and we do not use them to track you. Because the code loads from the web, the Add-in needs an internet connection.

Data Stored Locally on Your Device

The following are saved only on your device, in the Office add-in storage and in the browser's local storage of the Add-in (under keys that start with lp.): your license key, the random installation identifier, the record of your last successful license check, and your settings: the last label size you picked, the default paper, the calibration offsets, the theme and whether you chose not to see the print notice again. Saved designs are kept on your device or, if you choose to save a design with a workbook, in that workbook. You can remove your license key in the Add-in at any time; the rest stays on your device until you remove the Add-in and clear its Office add-in storage.

Purchases

Licenses are bought on our own checkout at buy.pythonandvba.com (payments by Stripe or PayPal). Your license key is sent to you by email. We receive your name, email address, billing country, and order details from the checkout, and a VAT ID if you enter one. We never see your full card details. This is covered in more detail by our general website Privacy Policy.

Data Handled by Microsoft Excel

The Add-in runs inside Microsoft Excel on Windows, Mac and the web. Microsoft's handling of your Office documents and account data is governed by Microsoft's own privacy terms. See the Microsoft Privacy Statement.

4. Third-Party Services

• Microsoft Excel / Microsoft 365: the host application in which the Add-in runs, and the source of office.js.
• Our server (api.pythonandvba.com, operated by us): checks license keys and holds the encrypted print job for up to 10 minutes, as described in Section 3.
• Stripe and PayPal: payment processing when you buy a license.

No other third parties receive any data through the Add-in. We do not sell your personal data.

5. What the Add-in Does Not Do

• It does not include advertising, cookies, telemetry, or third-party analytics or tracking, in the task pane or on the print page.
• It does not upload your workbook, and it does not send your addresses to us or to anyone else in readable form. It does not send them to an AI service.
• It does not send automatic error reports. Error messages are shown in the Add-in only; if you contact support, you can choose to copy the diagnostic details from the Add-in and include them yourself. Those details never contain cell contents.
• It does not change cells you did not ask it to change.
• It does not access hardware identifiers, your contacts, Microsoft Graph, SharePoint, OneDrive, or files other than the workbook you have open.

6. How We Use Data

• To validate and manage your license and enforce its device limit.
• To show your devices in your account, so you can free a device yourself.
• To let licensed features keep working during a short offline grace period after a successful license check.
• To pass the encrypted print job from the task pane to your browser, outside Excel on the web (for example on Excel for Windows and Mac).
• To deliver your license key and handle purchases and support requests.

That is the complete list. We cannot read the encrypted print job, and we do not use it for anything else.

7. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process the limited license, print job and purchase data described above under the following legal bases:

• Contract performance: Verifying your license, handing your print job to your browser and delivering your purchase so we can provide the features.
• Legitimate interests: Enforcing license limits and preventing misuse of our software.
• Legal obligation: Keeping purchase records as tax and accounting law requires.

8. International Data Transfers

Bosau Digital LLC and our server are located in the United States or process data there. If you use the Add-in from outside the United States, the license validation data and, outside Excel on the web (for example on Excel for Windows and Mac), the encrypted print job described above are transferred to the United States. The print job is encrypted on your device and we cannot read it. Your workbook is never transferred. Where personal data of EEA or UK residents is transferred internationally, we and our service providers rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.

9. Data Retention

• Encrypted print jobs: At most 10 minutes, and deleted the first time they are fetched.
• License records: Retained for as long as necessary to support your license and comply with legal obligations.
• Server logs: Deleted after 14 days (90 days for warnings and errors). For print jobs they contain only a short reference prefix, the size and the status.
• Failed license checks: Deleted after 90 days.
• Locally stored keys and settings: Remain on your device until you remove them or the Add-in.
• Worksheet contents: Not retained, and not received by us in readable form.

10. Your Rights

If you are located in the EEA or UK, you have the following rights under GDPR in respect of the personal data we hold (essentially, your license record and your purchase details):

• Access: Request a copy of the data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request that we limit how we use your data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise any of these rights, please contact us at contact@pythonandvba.com. We will respond within 30 days. Because your workbook is never uploaded and print jobs are deleted within minutes, there is no workbook data of yours for us to return or delete.

You also have the right to lodge a complaint with your local data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EEA you can find your national authority through the European Data Protection Board (edpb.europa.eu). We would welcome the chance to resolve your concern first, so please consider contacting us before you do.

11. Data Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. The Add-in's program code, the print page, the print job transfer and the license check are transmitted over encrypted (HTTPS) connections, and the print job is additionally encrypted on your device before it is sent. Everything else stays on your device or in your workbook.

12. Children's Privacy

The Add-in is not directed at children under the age of 16. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the Add-in after changes are posted constitutes acceptance of the updated policy.

14. Contact

For any privacy-related questions or to exercise your rights, please contact:

Related documents: LabelPop Terms of Use · Website Privacy Policy · Refund Policy · Terms & Conditions