Who we are
Data Matrix Code Generator (datamatrixcodegenerator.com) is run by Glenwhisper Limited, a company incorporated in Hong Kong (glenwhisper.com), "we" or "us".Business Registration No. 76935415. Registered office: Unit 1603, 16th Floor, The L. Plaza, 367-375 Queen's Road Central, Sheung Wan, Hong Kong.
We are responsible for the personal data described here: its "controller" under the UK and EU GDPR, and its "data user" under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486, the "PDPO"). That means we decide how it is used. To ask about your data, use our contact form and choose "Something else" as the topic.
What happens to the data and files you enter
When you type text or an identifier, fill in the GS1 form, paste a list, open a CSV or Excel file, or give the reader an image or your camera, all of the work happens inside your web browser on your own device. Encoding the code, laying out labels, creating PNG, SVG, PDF and ZIP files, and decoding images all happen there too.
- The data you encode, your spreadsheet files and the images or camera frames you decode are not uploaded to us or to anyone else.
- The tools never put your data in page addresses (URLs), so it does not end up in server logs or browser history from our links. (The API's GET form is the one exception, and only when you or your software use it: see The free API.)
- The camera is used only on the reader page, only after you allow it, and only while the reader is open. Frames are decoded on your device and never recorded or sent.
- The files you download are created on your device and go straight to your downloads folder.
What your browser saves
"My codes" and a few settings are kept in your browser's local storage on this device. Local storage is not a cookie: it is not sent to our server with any request, and we cannot read it. The site does not use IndexedDB. Local storage holds what you save, your unfinished bulk list, and a few settings:
- Saved codes: the data, an optional name, and the settings of each code you save (shape, size, print size, colors, caption).
- Label layouts and printer profiles: the label stock, layout, fixed label text and any logo you add, and the printer resolution and small alignment shift you set.
- Batch jobs: a fixed copy of each batch you save (the rows exactly as imported, the column choices, settings and totals), so you can print it again exactly. Up to 100 jobs are kept.
- Unfinished bulk list: the list you pasted or the file you opened in the bulk generator (its rows, file and sheet names) and your choices there, so a reload loses nothing. It stays until you press "Start a new batch" or clear My codes.
- Serial ranges: the ranges you have used, so a new run continues from the next number instead of repeating one. Clearing My codes keeps them unless you choose otherwise.
- Settings: the download format and PNG resolution you last picked, the label stock, layout and printer resolution you last used, the reader's options, how many codes you have saved (for the "My codes" count in the menu), and whether you closed a Pro waitlist suggestion.
- A waitlist note: after you join the waitlist, a flag so the site stops asking you and shows "You're on the list" next time. It does not hold your email address.
- Your analytics choice: "Allow analytics" or "No thanks", so we don't ask again (see Cookies and analytics).
Your browser's session storage, which lasts only as long as the tab, is used to pass something from one page to the next without putting it in the address: for example a saved code you open in the generator, a sample code from a guide, a value from the reader's "Make this code", or what you typed when you move it to another tool. The next page reads it once and removes it. A "close" on the analytics notice is also remembered there for the tab.
This data is used only to run these features on this device. It stays until you delete it in My codes or clear this site's data in your browser settings; on a shared computer, clear My codes when you finish. Private or incognito windows usually erase it when they close. Because it lives only on this device, we cannot back it up or restore it, and it will not appear on your other devices. My codes can download a backup file for you to keep.
The free API
The render API (/api/v1/datamatrix) draws one code for a value that you, or software you use, send to it. To draw the code, our server has to receive that value. We do
not log or store it: the value is used to draw the image and then discarded. If something fails, our error log records only the kind of error, never the request or the
value.
-
With a GET request the value is part of the web address. It can then appear in your own browser history, in the logs of software and networks between you
and us, and in the referrer of a page that embeds the image. Use POST, with the value in the request body, for anything that should stay private. The
/api/v1/datamatrix/infoendpoint accepts POST only for this reason. - A finished GET image may be kept in Cloudflare's cache for up to a year, so the same request is answered without drawing it again. The cache entry is found by a scrambled fingerprint of the request, not the value itself, and holds the image, not a record of who asked for it. Your browser may also keep its own copy for a day before it checks again. POST requests are not cached.
- To keep the free API fair, each request that draws a new image is counted against the same daily hashed IP values described below (up to 2,000 a day, with short bursts above about 60 a minute slowed). The counters hold only the hash and a number, and are deleted after about two days.
- We keep daily totals of API use by output format and result (for example "PNG, OK"), with no values, addresses or hashes, and delete them after 400 days. Legal basis: our legitimate interest in running and improving the API.
What we store when you join the waitlist or contact us
These are the only forms on the site. What you send is stored in a database we run on Cloudflare D1.
| Form | What we store | Why | How long |
|---|---|---|---|
| Pro and API waitlist | Your email address, the features you ticked, the monthly code volume if you chose one, the page you signed up on, the date and time, your country (two letters, worked out by Cloudflare from your connection) and a hashed IP value (see below). If you sign up again with the same email, we add any new features you ticked and the new volume to your existing entry. The sign-up date, page, country and hashed IP stay those of your first sign-up. | To email you when Pro or higher API limits open, and to understand which features to build first. Legal basis: your consent. | 24 months from the day you joined, then deleted automatically. Sooner if you ask us to remove you. |
| Contact form | Your name, email address, topic and message, the page you sent it from, the date and time, your country (two letters) and a hashed IP value. | To read and answer your message, and to follow up if you report a problem. Legal basis: our legitimate interest in answering questions about our service. | 24 months from the day you sent it, so we can see the history if you write again. Then deleted automatically. Sooner if you ask. |
Hashed IP value. We never store your IP address itself. If you connect over IPv6, we first shorten the address to its network part (the first half, called the /64 prefix), which usually covers every device on one internet connection. We then combine the address, or its shortened form, with a secret that changes every day and store only the scrambled result (a SHA-256 hash). For a second, looser limit we make one more value the same way from the wider network the address belongs to (the first three parts of an IPv4 address, or the /48 prefix of an IPv6 address); it is used only as a counter key and deleted after about two days. Because the secret changes daily, values from different days cannot be matched to each other. We use them only to limit how often a form can be sent from one connection or network (a handful of waitlist sign-ups or contact messages an hour, and a few dozen a day) and to spot spam.
Email copy to our team. When you send a contact message, our server also emails a copy of it (your name, email address, topic, message, the page you sent it from and your country) to our team inbox so we can read it and reply to you by email. The email is sent from our server through Cloudflare, not from your browser. Copies in the inbox are kept while we deal with your message and for as long as we need the conversation history, and we delete them when you ask us to.
Messages are limited to 5,000 characters. Please don't send customer data, passwords or payment details through the form. We do not sell, rent or share waitlist or contact data with anyone for their own use, and we will not add you to a newsletter.
How deletion works. There is no separate clean-up job. Each time someone joins the waitlist or sends a message, the site deletes every entry in that form's table that is more than 24 months old. The usage counter (below) also runs the same deletes from time to time, so old entries are removed even in a quiet month.
Anonymous usage counts
To learn which tools and formats people use, the site counts a short list of actions. Each count is added to a daily total for the whole site. There is no visitor ID, no cookie and no profile of you. The actions we count are:
-
tool_opened: a tool was opened -
code_downloaded: a code was downloaded (PNG, SVG, PDF or ZIP) -
code_copied: a code was copied to the clipboard -
code_saved: a code was saved in the browser -
batch_imported: a list or spreadsheet was imported -
batch_exported: a batch was exported -
serial_generated: a serial number sequence was made -
gs1_generated: a GS1 DataMatrix was exported -
reader_decoded: the reader decoded a code -
reader_failed: the reader could not find a code -
label_pdf: a labels PDF was downloaded -
calibration_downloaded: a printer test page was downloaded -
job_reprinted: a saved batch job was printed again -
backup_exported: a backup of My codes was downloaded -
backup_restored: a backup of My codes was restored -
api_docs_tried: the API example on the docs page was run -
waitlist_viewed: the waitlist form was shown -
pro_nudge_shown: a Pro waitlist suggestion was shown -
sample_downloaded: sample downloaded
Some counts carry one extra word: the file format (for example png or zip), the tool or type of import used (for example batch or
xlsx), the label stock, or the page a waitlist form was shown on. Your browser never sends anything that looks like an identifier, and our server keeps the word only
if it is on a fixed list we wrote. Anything else is counted as other, so the data you encode, captions and anything you type are never stored. What we keep is a
table of daily totals, for example how many PNGs were downloaded on a given day. The same action names and words are also sent to Google Analytics (see Cookies and analytics), never anything you typed.
Daily totals more than 400 days old (about 13 months) are deleted automatically: every so often, recording a count also runs that clean-up.
To stop one connection flooding the counters, each request is checked against the same daily hashed IP value described above. Those rate-limit records hold only the hash and a counter, and are deleted automatically after about two days. Legal basis: our legitimate interest in improving the tool and keeping it running.
Cookies and analytics
- Google Analytics sets first-party cookies on this site: in Europe only after you choose "Allow analytics", elsewhere by default unless you choose "No thanks". Details below.
- No advertising. There are no ad networks, social media pixels or session recording tools, and Google Analytics runs with its advertising features off.
- Cloudflare Web Analytics counts page views without cookies (see below), and we run the anonymous counts above ourselves.
- Our fonts are served from our own domain, so no font service sees your visit.
Google Analytics
We use Google Analytics 4, a service of Google LLC, to learn which pages and features people use, so we know what to improve. It records pages you view, the site that sent you, your browser, device type and approximate location (city or country), and the actions listed under anonymous usage counts with the same one-word details. It never receives the data you encode, captions or files you work with, because those stay in your browser.
Cookies. When analytics is allowed, Google Analytics sets two first-party cookies on our domain: _ga, which tells visits from the
same browser apart, and _ga_<ID>, which keeps track of the current visit. As of November 2026, Google sets both to expire after 2 years by
default. They are used only for our statistics, not for advertising.
Your choice. If you visit from the European Economic Area, the UK or Switzerland, Google Analytics starts with its cookies off. Until you choose
"Allow analytics" (or if you choose "No thanks"), Google's consent mode does not read or write analytics cookies; it may still send Google a basic cookieless
signal for each page, with the time, your browser type, the referring page and whether consent was given, which Google uses for aggregate statistics. Everywhere
else, analytics cookies are on by default. Wherever you are, you can change your choice at any time with "Cookie settings" at the bottom of every page: "No thanks"
turns the cookies off from then on. Your choice is saved in your browser's local storage (dmcg:consent), not in a cookie. Deleting cookies already set
is done in your browser settings.
What is switched off. We have turned off Google signals and ad personalization, so Google Analytics does not link your visits to a Google account, and its data is not used to show you ads. We do not pass ad click information between pages.
IP addresses. As of November 2026, Google states that Google Analytics 4 does not log or store IP addresses. For visitors in the EU, the UK and Switzerland, Google uses the IP address only to work out an approximate location on servers in those regions, and then discards it.
Legal basis: in the European Economic Area, the UK and Switzerland, your consent. Elsewhere, our legitimate interest in improving the tool, with the option to opt out at any time. See how Google uses information from sites that use its services.
Cloudflare
Cloudflare, which delivers the site, may set a strictly necessary security cookie (such as __cf_bm or cf_clearance) if it needs to check that traffic is not
from a bot. These cookies are used only for security, not for tracking or advertising.
We use Cloudflare Web Analytics to count page views and measure page speed. Its small script sends the page address, referrer, browser type and timing data to Cloudflare. As of November 2026, Cloudflare states that it does not use cookies or local storage, does not fingerprint visitors and does not track people across sites. It never sees the numbers you type or the files you load, because those stay in your browser.
Who processes data for us
Cloudflare, Inc. hosts the site, delivers its pages, protects it from attacks and runs the database that holds waitlist sign-ups, contact messages and usage totals. To deliver any website, Cloudflare has to handle your IP address and basic request details (such as your browser type and the page you asked for). Cloudflare acts as our processor under its data processing addendum, and handles that data under its own security and logging policies. See Cloudflare's privacy policy.
Google LLC provides Google Analytics (see Cookies and analytics). Google acts as our processor for Google Analytics under the Google Ads Data Processing Terms, and processes the data on our instructions to produce our reports. We have switched off Google Analytics' "Google products & services" data sharing setting, the one under which Google would use the data to improve its own products as an independent controller. If we ever turn it on, we will say so here first.
Our team inbox is a Google Gmail account, so contact messages (and our replies) are also stored by Google LLC, which runs that email service. Cloudflare delivers the email from our server to the inbox. We do not use any other service providers for the personal data on this page.
Where your data is handled
We are based in Hong Kong, and we read and answer waitlist and contact data from there. The database that stores it, and the network that delivers the site, are run by Cloudflare on servers in many countries, so your data may also be handled outside Hong Kong, the UK and the EU, including in the United States. Email copies of contact messages are stored by Google (Gmail), including in the United States.
- From the UK and the EU: as of November 2026, Cloudflare's data processing addendum includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which protect personal data sent to countries without an adequacy decision. Google Analytics data is handled by Google, including in the United States; the Google Ads Data Processing Terms that cover it include the Standard Contractual Clauses.
- Under the PDPO: we use your data only for the purposes on this page, wherever it is processed, and Cloudflare's data processing addendum binds it to keep the data secure and to use it only on our instructions.
Your rights
Everyone. Under Hong Kong's PDPO, which applies to us wherever you live, you can ask whether we hold personal data about you, get a copy of it, and ask us to correct it if it is wrong. You can also ask us to delete it, for example to leave the waitlist. We do not use your details for direct marketing, and we never pass them to anyone else for marketing.
In the UK and the European Economic Area. Under the UK GDPR and the EU GDPR you also have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted, for example to leave the waitlist;
- object to, or ask us to restrict, how we use it;
- receive it in a portable format;
- withdraw your consent at any time, without affecting what we did before.
How to ask. Send a message through our contact form, choose "Something else" as the topic, and use the email address the request is about. Say what you would like: a copy, a correction or deletion. We may ask you to confirm the request from that address before we act. We reply within one month, which is also inside the 40 days the PDPO allows for access and correction requests. There is no charge.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) at pcpd.org.hk, to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by phone on 0303 123 1113, or to the data protection authority where you live.
Children
Data Matrix Code Generator is a tool for businesses and is not aimed at children. We do not knowingly collect data from anyone under 13. If you think a child has sent us their details, contact us and we will delete them.
Changes to this policy
When the site changes how it handles data, we update this page and the effective date at the top before the change goes live. If a change affects people on the waitlist in a meaningful way, we will email them. When paid plans with accounts launch, this policy will be updated to cover them first.
See also our terms of use. Questions? Contact us.