Last updated: 27 August 2026
This Privacy Policy explains how Lay by the Lake collects, uses, stores and shares personal data when you visit the website, create an account, use the type design tool, save projects, contact the operator or purchase a licence.
[1] Data controller
The data controller is Niklas Tsalkos, trading as LayByTheLake Tools. Privacy questions and requests may be sent to hello@laybythelake.com.
[2] Data collected
Depending on how you use the service, Lay by the Lake may process:
- Account data: email address, user ID, authentication status and account metadata.
- Project data: project names, saved type-design settings, glyph data, colours and related project content.
- Purchase and licence data: customer, transaction, product, licence and font-export entitlement information. Full payment-card details are processed by the payment provider and are not stored by Lay by the Lake.
- Usage and technical data: IP address, browser and device information, request logs, timestamps, error information and security events generated when the website and its infrastructure are used.
- Communications: messages, feedback and other information you send when contacting Lay by the Lake.
- Local browser data: settings or projects stored locally in your browser. Local data remains on your device unless a feature transmits it to the service.
[3] Purposes and legal bases
Personal data is processed to provide accounts, saved projects, purchases, licensing and font exports; authenticate users; operate and secure the service; prevent fraud and misuse; respond to messages; maintain business and tax records; diagnose errors; and improve the service. The applicable legal basis depends on the processing and may be performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests in operating and securing the service, or consent where consent is requested.
[4] Service providers
Personal data may be processed by providers used to operate the service, including providers of authentication, database and storage services, payment processing, website hosting, server-side functions, email delivery, security and technical infrastructure. Providers process data under their own terms and privacy documentation and, where they act as processors, under appropriate data-processing arrangements. Data is shared only where reasonably necessary to provide, secure and administer the service, comply with law, or protect legal rights.
[5] International transfers
Some providers may process data outside Denmark or the European Economic Area. Where required, transfers are made using a legally recognised transfer mechanism, such as an adequacy decision or standard contractual clauses, together with appropriate safeguards.
[6] Retention
Personal data is kept only for as long as reasonably necessary for the purpose for which it was collected, including providing an active account, preserving projects at the user's request, meeting accounting or legal requirements, resolving disputes and protecting the service. Retention periods may differ by data type. Account and saved-project data may be deleted or anonymised after account deletion, subject to backups, legal obligations and information required to document purchases or licences. Technical and security logs are retained for a limited period appropriate to their purpose.
[7] Cookies and browser storage
The service may use cookies or similar browser storage that are necessary for authentication, security, account sessions, project state and user preferences. Optional analytics or marketing storage will only be used where a valid legal basis exists and any consent required by law has been obtained. Deleting browser data may sign you out or remove locally stored settings and projects.
[8] Your rights
Subject to applicable data-protection law, you may have rights to receive information about processing; access your personal data; correct inaccurate data; request deletion or restriction; receive portable data; object to certain processing; and withdraw consent where processing is based on consent. You may exercise these rights by emailing hello@laybythelake.com. Identity verification may be required before a request is completed.
[9] Complaints
You may lodge a complaint with the competent data-protection authority. In Denmark, this is Datatilsynet. You are welcome to contact Lay by the Lake first so the concern can be addressed directly.
[10] Security
Reasonable technical and organisational measures are used to protect personal data. No internet service can guarantee absolute security, and users should protect access to their email account, devices and active sessions.
[11] Children
The service is not directed to children who cannot lawfully consent to the processing of their personal data under applicable law. If personal data has been provided without the required authorisation, please contact Lay by the Lake.
[12] Changes to this policy
This Privacy Policy may be updated to reflect changes to the service, providers, processing activities or legal requirements. The date at the top identifies the latest version. Material changes will be communicated where required by law.
[13] Contact
Privacy enquiries and data-protection requests may be sent to:
hello@laybythelake.com