Privacy Policy

This site is built to need as little of your data as possible. Nothing about you goes to anyone else unless you have said yes first, and if you say no, nothing loads at all.

Who is responsible for your data

The data controller is TOCLOCO Inc, 1007 N Orange St, 4th Floor, Suite #1382, Wilmington, DE 19801, USA. For anything in this policy, including a request to exercise your rights, write to hello@latticegrid.dev.

Our representative in the United Kingdom

For the purposes of Article 27 of the UK GDPR, our representative in the United Kingdom is TOCLOCO Ltd, company number 09950859, of 71-75 Shelton Street, London WC2H 9JQ, United Kingdom.

If you are in the UK you may address any question about this policy, or any request to exercise your rights, to them rather than to us. Either route reaches the same people, and writing to hello@latticegrid.dev is usually quicker.

What we collect

When you read the site

The site is served from Amazon CloudFront and Amazon S3. Like any web server, these record technical request logs: your IP address, the time of the request, the page requested, and your browser's user agent string. We use these only to keep the service running and secure, and to diagnose faults.

We do not build profiles from these logs, do not use them for advertising, and do not combine them with anything else.

When you choose to allow analytics

We use Google Analytics 4, property G-P1K11KD0LP. It runs only if you turn it on in the consent banner. If you have not, or if you have chosen essential only, the Google Analytics script is never requested, no connection to Google is made, and no analytics cookies are set.

Where you do allow it, Google Analytics records the pages you view, how you arrived, approximate location derived from your IP address, and details of your device and browser. It writes the cookies listed in the cookie policy: _ga and _ga_P1K11KD0LP, which last up to two years and are set only with your Analytics consent. We send Google no name, email address or licence key, and the only events we send are page views, a lead event when you request a free key, and a purchase event with the order id, value and currency. Google acts as our processor for this, and it is a US company, so allowing analytics means data about your visit is transferred to the United States under the safeguards described below.

When you choose to allow advertising

We advertise on Reddit and use the Reddit Pixel to measure which ads lead to a visit, a free key request or a purchase. It runs only if you turn on Advertising in the consent banner. Otherwise Reddit's script is never requested and no connection to Reddit is made. If you allow it, Reddit sets the _rdt_uuid cookie, which lasts 90 days, and receives the page you view, your IP address and device details, and for a purchase its value and currency. We send Reddit no name, email address or licence key. Reddit acts as our processor for this, and it is a US company, so the transfer safeguards below apply.

We also advertise with Google Ads and measure with its conversion tag whether a visit that followed a Google ad ended in a purchase. It runs only if you turn on Advertising, not Analytics, in the consent banner. If you allow it, Google sets advertising cookies (_gcl_au, up to 90 days), receives the page you view, your IP address and device details, and for a purchase the order id, value and currency. We send Google no name, email address or licence key. Google acts as our processor for this, and the transfer safeguards below apply.

You can withdraw permission at any time from "Cookie settings" in the footer. Doing so stops collection and clears the analytics and Google Ads cookies from your browser.

When you request a free licence key

The form on the free licence page stores your email address, the domain you named, the key's issue and expiry dates, and a hashed version of the IP address the request came from. We keep this so that a domain has one active free key at a time, so a renewal recognises the key it is renewing, and to apply the request limits that keep the form from being abused. We do not use it for marketing you did not ask for.

This record is kept for 24 months after the key expires, then deleted. To ask for it to be deleted sooner, write to hello@latticegrid.dev.

When you contact us

If you email us, we hold your address and whatever you put in the message, for as long as it takes to deal with your enquiry and to keep a record of the exchange. We do not use it for marketing you did not ask for.

The form on the contact page works the same way, and deliberately does no more. It sends your name, email address, company if you give one, and your message straight to that same inbox, along with the IP address the form was submitted from, which we keep so we can deal with abuse. Nothing is stored in a database, no third-party form service is involved, and there is no dashboard holding a copy: the message becomes an email and nothing else.

When you load the grid from our CDN

If a page of yours loads Lattice Grid from cdn.latticegrid.dev, our CDN logs the origin of the page that made the request, the file and version requested, the browser's user agent and the IP address. We use these logs for usage statistics and keep them for 400 days, then delete them.

Fonts and other people's servers

The typefaces on this site are served from our own domain rather than from the Google Fonts CDN, so simply loading a page sends your IP address to nobody but us. Google (Analytics and Ads) and Reddit are the only third parties this site can contact, and each is contacted only after you allow it.

Our legal bases

What	Why	Basis under Article 6
Server request logs	Running the site, security, fault diagnosis	Legitimate interests, Art. 6(1)(f)
Your consent choice	Remembering what you decided	Legitimate interests, Art. 6(1)(f), and it never leaves your browser
Google Analytics, if you allow it	Understanding which pages are useful	Consent, Art. 6(1)(a)
Reddit Pixel and Google Ads conversion tag, if you allow advertising	Measuring which ads brought you here or led to a purchase	Consent, Art. 6(1)(a)
Email and contact form messages	Answering you	Legitimate interests, Art. 6(1)(f), or performance of a contract, Art. 6(1)(b)
Free licence key request (email, domain, issue and expiry dates, hashed IP)	Issuing one key per domain, renewal, and abuse limits	Performance of a contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f)
The IP a form was submitted from	Dealing with abuse of the form	Legitimate interests, Art. 6(1)(f)

How long we keep it

Server logs are kept for up to 90 days and then deleted. Google Analytics data is retained for 14 months. Email is kept for as long as the enquiry is live, and for up to two years afterwards so that we have a record of what was agreed. A free licence key request is kept for 24 months after the key expires. Your consent choice sits in your own browser until you clear it or change your mind.

Who else sees it

Amazon Web Services hosts the site and therefore processes the request logs on our behalf. Google LLC provides Google Analytics and Google Ads, and Reddit, Inc. provides the Reddit Pixel, but only for those who have allowed them. All act as our processors under Article 28. We do not sell personal data, and we do not share it with anyone for their own purposes.

International transfers

We are a US company, so personal data reaching us is processed in the United States. Where data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum to them, together with the safeguards our hosting provider has in place. You can ask us for a copy of the relevant terms.

Your rights

If the GDPR or the UK GDPR applies to you, you have the right to ask us for a copy of your data, to correct it, to have it deleted, to restrict how we use it, to receive it in a portable form, and to object to processing we carry out on the basis of legitimate interests. Where we rely on consent, you can withdraw it at any time, and doing so does not affect what we did before you withdrew it.

Write to hello@latticegrid.dev and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to your data protection authority: in the UK that is the Information Commissioner's Office, and in the EEA it is the supervisory authority for the country you live in.

Automated decisions

We do not make decisions about you by automated means, and we do not profile you.

Children

This site sells developer tooling and is not directed at children. We do not knowingly collect data about anyone under 16.

Changes

If we change this policy in a way that affects you, we will say so on this page and update the date at the top. Turning on anything new that needs consent will always mean asking you again rather than quietly relying on an old answer.