Privacy Policy

The data controller for Lerret is:

Lerret is run from Norway, so the EU General Data Protection Regulation (GDPR) applies to everything described here, through the Norwegian Personal Data Act.

By default your projects (the images you drop in, your drafts and your editor settings) are stored in your own browser. They are not uploaded to our servers, and we cannot see them. Clearing your browser’s site data removes them. The exception is a draft you choose to save to your account, described below.

• Account details. If you sign in, we store your email address. If you sign in with a third-party provider such as Google, we also receive the name and profile picture that provider shares. We never see or store a password: sign-in uses a one-time code sent to your email, or the provider’s own login.
• Things you save to your account. Items you explicitly save to your account: custom themes, your plan status, and, on a paid plan, drafts you choose to save to your account, including the images they contain. These are stored privately and are accessible only to you.
• URL capture records. When you capture a screenshot from a URL, we record the hostname of the page (not the full address), the time, and either your account ID or, if you are signed out, a salted, one-way hash of your IP address. We use this only to enforce usage limits and prevent abuse. We do not store the IP address itself.
• Technical logs. Our hosting provider processes standard request data (such as IP address and browser type) to deliver the site and keep it secure.

• To sign you in and keep you signed in.
• To provide the features of your plan and the things you saved.
• To rate-limit URL captures and protect the service from abuse.
• To email you sign-in codes and notices about the service, such as a significant change to this policy. We do not send marketing email unless you have asked for it.

We do not sell your personal data, we do not use it for advertising, and we do not run analytics or tracking scripts.

• Contract. Your account details, the things you save, and your plan status are processed to provide the service you signed up for.
• Legitimate interests. URL capture records and technical logs are processed to enforce usage limits, keep the service secure and prevent abuse. We keep these to the minimum that does the job: a hostname and a hashed key, not your browsing or your IP address.
• Legal obligation. If you buy a paid plan, Norwegian bookkeeping law requires us to keep records of the transaction.
• Consent. Anything optional, such as product news by email, happens only if you opt in, and you can withdraw that consent at any time.

We set the cookies needed to keep you signed in, and use your browser’s local storage to hold your projects and settings. Both are strictly necessary for the editor to work, which is why there is no cookie banner. We do not use advertising, analytics or cross-site tracking cookies.

We share data with service providers only as far as needed to run Lerret:

• Supabase: authentication and database hosting.
• Vercel: website hosting.
• Resend: delivery of sign-in and service emails.
• ScreenshotOne: renders URL captures. The URL you submit is sent to them for that purpose.
• Unsplash: background image search. Your search terms are sent to Unsplash when you search.

If you buy a paid plan, payment is handled by a third-party payment processor. We do not receive or store your card details.

Some of these providers process data outside the European Economic Area, mainly in the United States. Where that happens the transfer is covered by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission’s standard contractual clauses.

Account data, and anything you saved to your account, is kept until you delete it or delete your account. URL capture records hold no address and no full URL, and are cleared out periodically. Hosting logs are kept for a short period by our hosting provider. Records of purchases are kept for five years, as Norwegian bookkeeping law requires.

You can delete your account at any time from Settings → Account. This permanently removes your account and everything stored against it on our servers. Projects stored in your browser are yours to clear.

Under the GDPR you also have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, or its processing restricted;
• receive your data in a portable, machine-readable format;
• object to processing that is based on our legitimate interests;
• withdraw any consent you have given, without affecting what came before.

To exercise any of these, contact us. We answer within one month. You can also complain to a supervisory authority. In Norway that is Datatilsynet, or you can go to the authority in the country where you live.

Data is encrypted in transit, and what you save to your account is protected by row-level access rules so that only your own account can read it. No system is perfectly secure, and we will tell you and Datatilsynet without undue delay if a breach puts your data at risk.

Lerret is not directed at children under 13, and we do not knowingly collect personal data from them.

We may update this policy as the product changes. We will change the date at the top of the page when we do, and tell you by email if a change is significant.

Questions about this policy or your data go to: