Privacy policy

This site is built to need as little of your data as possible. Nothing about you goes to anyone else unless you have said yes first, and if you say no, nothing loads at all.

Who is responsible for your data

The data controller is TOCLOCO Inc, 1007 N Orange St, 4th Floor, Suite #1382, Wilmington, DE 19801, USA. For anything in this policy, including a request to exercise your rights, write to hello@latticegrid.dev.

Our representative in the United Kingdom

For the purposes of Article 27 of the UK GDPR, our representative in the United Kingdom is TOCLOCO Ltd, company number 09950859, of 71-75 Shelton Street, London WC2H 9JQ, United Kingdom.

If you are in the UK you may address any question about this policy, or any request to exercise your rights, to them rather than to us. Either route reaches the same people, and writing to hello@latticegrid.dev is usually quicker.

What we collect

When you read the site

The site is served from Amazon CloudFront and Amazon S3. Like any web server, these record technical request logs: your IP address, the time of the request, the page requested, and your browser's user agent string. We use these only to keep the service running and secure, and to diagnose faults.

We do not build profiles from these logs, do not use them for advertising, and do not combine them with anything else.

When you choose to allow analytics

We use Google Analytics 4, property G-P1K11KD0LP. It runs only if you turn it on in the consent banner. If you have not, or if you have chosen essential only, the Google Analytics script is never requested, no connection to Google is made, and no analytics cookies are set.

Where you do allow it, Google Analytics records the pages you view, how you arrived, approximate location derived from your IP address, and details of your device and browser. It writes the cookies listed in the cookie policy. Google acts as our processor for this, and it is a US company, so allowing analytics means data about your visit is transferred to the United States under the safeguards described below.

You can withdraw permission at any time from "Cookie settings" in the footer. Doing so stops collection and clears the analytics cookies from your browser.

When you contact us

If you email us, we hold your address and whatever you put in the message, for as long as it takes to deal with your enquiry and to keep a record of the exchange. We do not use it for marketing you did not ask for.

The form on the contact page works the same way, and deliberately does no more. It sends your name, email address, company if you give one, and your message straight to that same inbox, along with the IP address the form was submitted from, which we keep so we can deal with abuse. Nothing is stored in a database, no third-party form service is involved, and there is no dashboard holding a copy: the message becomes an email and nothing else.

Fonts and other people's servers

The typefaces on this site are served from our own domain rather than from the Google Fonts CDN, so simply loading a page sends your IP address to nobody but us. Google Analytics is the only third party this site can contact, and it is contacted only after you allow it.

Our legal bases

What	Why	Basis under Article 6
Server request logs	Running the site, security, fault diagnosis	Legitimate interests, Art. 6(1)(f)
Your consent choice	Remembering what you decided	Legitimate interests, Art. 6(1)(f), and it never leaves your browser
Google Analytics, if you allow it	Understanding which pages are useful	Consent, Art. 6(1)(a)
Email and contact form messages	Answering you	Legitimate interests, Art. 6(1)(f), or performance of a contract, Art. 6(1)(b)
The IP a form was submitted from	Dealing with abuse of the form	Legitimate interests, Art. 6(1)(f)

How long we keep it

Server logs are kept for up to 90 days and then deleted. Google Analytics data is retained for 14 months. Email is kept for as long as the enquiry is live, and for up to two years afterwards so that we have a record of what was agreed. Your consent choice sits in your own browser until you clear it or change your mind.

Who else sees it

Amazon Web Services hosts the site and therefore processes the request logs on our behalf. Google LLC provides Google Analytics, but only for those who have allowed it. Both act as our processors under Article 28. We do not sell personal data, and we do not share it with anyone for their own purposes.

International transfers

We are a US company, so personal data reaching us is processed in the United States. Where data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum to them, together with the safeguards our hosting provider has in place. You can ask us for a copy of the relevant terms.

Your rights

If the GDPR or the UK GDPR applies to you, you have the right to ask us for a copy of your data, to correct it, to have it deleted, to restrict how we use it, to receive it in a portable form, and to object to processing we carry out on the basis of legitimate interests. Where we rely on consent, you can withdraw it at any time, and doing so does not affect what we did before you withdrew it.

Write to hello@latticegrid.dev and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to your data protection authority: in the UK that is the Information Commissioner's Office, and in the EEA it is the supervisory authority for the country you live in.

Automated decisions

We do not make decisions about you by automated means, and we do not profile you.

Children

This site sells developer tooling and is not directed at children. We do not knowingly collect data about anyone under 16.

Changes

If we change this policy in a way that affects you, we will say so on this page and update the date at the top. Turning on anything new that needs consent will always mean asking you again rather than quietly relying on an old answer.