Privacy Policy

This Privacy Policy explains how LayPattern AS (Org.nr 938 461 171, Flatsethøgda 9, 6531 Averøy, Norway) collects and uses your personal data when you use LayPattern. We are the data controller. We process data in line with the EU/EEA General Data Protection Regulation (GDPR).

1. Data we collect

• Account data: your email address and authentication details (managed by our authentication provider). If you sign in with Google, we receive the basic profile and email needed to create your account.
• Project data: the rooms, patterns, measurements, and settings you create.
• Billing data: your plan, the one-off unlocks and passes you have bought, which rooms you have unlocked, and subscription status. Payments and card details are handled by Paddle, our payment provider and merchant of record. We never see or store full card numbers.
• Preferences & consent records: settings such as preferred currency, and a record of your acceptance of these documents.
• Activity record: which actions you take (creating, renaming, sharing, filing and deleting jobs, rooms and customer records) with your name and the time. You can read your own record on your profile and on each job.

2. Why we use it (legal bases)

• To provide the service and your saved projects: performance of our contract with you.
• To process payments and manage your plan, unlocks and passes: performance of contract.
• To keep the service secure and prevent abuse: our legitimate interests.
• To meet legal and accounting obligations: legal obligation.

3. Cookies

LayPattern uses only strictly-necessary cookies to keep you signed in. We do not currently use advertising or third-party tracking cookies. If that changes, we will ask for your consent first and update this policy.

We count page views on our public pages (the front page, pricing, help and the sign-up flow) using Vercel Web Analytics, and measure how quickly those pages load for real visitors using Vercel Speed Insights. Neither stores anything on your device and neither sets a cookie: visitors are counted using a short-lived value our host derives from the request itself, which is discarded after 24 hours. Both run only on those public pages, so the pages you use once signed in (your rooms, projects and customers) are never reported to either. We do this to understand which pages bring people to LayPattern and whether they load quickly enough to be worth waiting for, on the basis of our legitimate interests.

4. Sharing & processors

We share data only with the providers that run the service on our behalf, under agreements that require them to protect it. We do not sell your personal data.

If we add or replace one of these, we will say so here and tell Pro team admins in advance, so they can object on data-protection grounds. Card details never reach our servers. Paddle is the seller of record and handles them directly.

The sign-up, sign-in, password-reset and contact forms are checked by Cloudflare Turnstile, which tells people apart from bots. It runs silently: most visitors see nothing at all, which is exactly why we spell it out here. To do the check, Cloudflare receives your IP address and signals about your browser, and stores a short-lived token in it. Turnstile is not used for advertising and does not follow you to other sites.

Cloudflare’s Turnstile Privacy Addendum

Separately from the providers above, you can hand your own work to someone: a room can be shared with a colleague, or with a client or fitter outside your team. We store the address you send it to, so that we can deliver the invitation and show you who has access, and the person you name can view that room until you withdraw it. We only write to addresses you enter yourself, and we use them for nothing else.

Inside LayPattern, support and billing can open your account’s records when they need to answer you: to find a purchase you have asked us to refund, for example. What they see is limited to what your request needs, and every such look is written into your own Activity list, so you can see that it happened and when. Nobody here can sign in as you.

5. Your customers' data (Pro)

Pro teams can store records about their own customers: name, contact details, address and the projects carried out for them. For that information the Pro team is the data controller and we act only as their processor, on their instructions. The terms are set out in our Data Processing Agreement.

A Pro team can erase a customer's personal data at any time from the customer page, which removes the name, contact details and notes while keeping the project record. A customer left archived for more than a year is anonymised automatically.

6. Retention

We keep your data for as long as your account is active. When you delete your account, your data is scheduled for permanent deletion after a short grace period during which you can undo. Some records (e.g. invoices) may be retained where the law requires. The activity record is kept on two clocks: ordinary editing for 90 days, and anything that deletes, restores, shares or changes team access for 12 months. Deleting your account removes your name from that record; the entries themselves remain, as the account owner's record of what was done.

7. Your rights

Under the GDPR you have the right to:

• Access a copy of your data (use “Export my data” on your profile).
• Correct inaccurate data, or update it in the app.
• Delete your account and data (use “Delete my account” on your profile).
• Object to or restrict certain processing, and to data portability.
• Lodge a complaint with your supervisory authority (in Norway, Datatilsynet).

8. International transfers

Our providers may process data in the EU/EEA or other regions with appropriate safeguards in place. Contact us for details of the safeguards used.

9. Contact

For any privacy request or question, use the contact form and we'll get back to you.