Last updated: July 27, 2026
This Privacy Policy explains how personal data is processed when You visit laytheme.com, contact Us, subscribe to the newsletter or purchase and use Lay Theme.
When You access the Website, the hosting and content-delivery infrastructure processes technical request data such as IP address, date and time, requested URL, referrer, browser, operating system and response status. This is necessary to deliver and secure the Website, diagnose errors and prevent abuse. The legal basis is Article 6(1)(f) GDPR. Security logs are retained only for as long as reasonably necessary for these purposes, unless a longer period is required to investigate an incident or comply with law.
The Website may use hosting and content-delivery providers, currently including Bunny.net. These providers process request data on Our behalf under their applicable data-processing terms.
Strictly necessary storage is used to save Your privacy choice and provide requested Website and checkout functions. Optional analytics and advertising technologies are disabled until You give consent. Where consent is required, the legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
The cc_cookie records Your selection for approximately six months. You can change or withdraw Your choice at any time:
Withdrawing consent does not affect processing that took place before the withdrawal. Rejecting optional technologies does not prevent You from browsing or purchasing Lay Theme.
With Your analytics consent, We use Google Analytics 4, provided by Google Ireland Limited, to understand visits, navigation, traffic sources and conversions. Google may process page URLs, referrer information, approximate location, device and browser information, interactions and online identifiers. Google Analytics cookies such as _ga may remain for up to two years.
Google Consent Mode defaults analytics_storage, ad_storage, ad_user_data and ad_personalization to denied. Analytics storage is granted only with analytics consent. Advertising storage, advertising user data and advertising personalization are granted only with advertising consent.
Learn more in Google's Business Data Responsibility information and Google's Privacy Policy.
With Your analytics consent, We use Hotjar, provided by Hotjar Limited, to understand Website usage and improve usability. Hotjar may process device and browser information, approximate location, page and interaction data and online identifiers. Form fields intended for personal or payment data are not used for analytics. Hotjar cookies may remain for up to one year. See Hotjar's Privacy Policy.
With Your advertising consent, We use the Meta Pixel from Meta Platforms Ireland Limited for campaign attribution, conversion measurement, audience creation and personalized advertising. Meta may receive page and interaction data, IP address, device and browser information, cookie identifiers and click identifiers. Cookies such as _fbp and _fbc may remain for approximately 90 days. See Meta's Privacy Policy.
With Your advertising consent, We use the TikTok Pixel from TikTok Technology Limited for campaign attribution, conversion measurement, audience creation and personalized advertising. TikTok may receive page and interaction data, IP address, device and browser information, cookie identifiers and click identifiers. TikTok cookies may remain for up to 13 months. See TikTok's Privacy Policy.
With Your advertising consent, We use the Pinterest Tag from Pinterest Europe Ltd. for campaign attribution, conversion measurement, audience creation and personalized advertising. Pinterest may receive page and interaction data, IP address, device and browser information, cookie identifiers and click identifiers. Pinterest cookies may remain for approximately 90 days. See Pinterest's Privacy Policy.
Some pages load fonts from Google Fonts and open-source scripts or styles from the jsDelivr content-delivery network. The providers necessarily receive technical request data, including Your IP address, to deliver these resources. The legal basis is Article 6(1)(f) GDPR, based on Our interest in reliable and consistent Website delivery. See Google's Privacy Policy and jsDelivr's Privacy Policy.
Documentation pages use Algolia DocSearch to provide search. Search queries, selected results and technical request data may be processed by Algolia. Search insights are used to improve documentation results. The legal basis is Article 6(1)(f) GDPR. See Algolia's Privacy Policy.
The Blueprints page requests published Blueprint information and previews from Our service hosted through Fly.io. Fly.io receives technical request data when this service is accessed. The legal basis is Article 6(1)(f) GDPR. See Fly.io's Privacy Policy.
If You submit Your email address through the newsletter form, We use it only to send the requested Lay Theme newsletter. The legal basis is Your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time through the unsubscribe link in an email or by contacting Us. Withdrawal does not affect earlier lawful processing.
The newsletter is managed with a self-hosted listmonk installation on Railway infrastructure. Railway may process technical and subscriber data on Our behalf. Newsletter data is retained until You unsubscribe or request deletion, subject to limited suppression records needed to respect an unsubscribe request. A Lay Theme purchase does not by itself subscribe You to marketing emails. See Railway's Privacy Policy.
Checkout and payment processing are provided by Dodo Payments as Merchant of Record. When You begin checkout, You are redirected to Dodo Payments. Dodo determines and collects applicable VAT, GST or sales tax and handles payment methods, fraud prevention, invoicing, refunds and payment compliance.
Dodo may collect Your name, email address, billing address, country, postal code, tax identification number, payment details and transaction information. Payment-card details are entered directly with Dodo and are not received by Our Website server. Dodo processes this data under its own privacy information and as necessary to perform the purchase contract and comply with legal obligations. See Dodo Payments' Privacy Policy.
Our checkout service is hosted on Railway and stores temporary checkout state and purchase fulfilment data in a PostgreSQL database. It processes product selection, Dodo transaction identifiers, consented campaign attribution, email address, name, license information and download information as necessary to complete Your order. The legal bases are Article 6(1)(b) and 6(1)(c) GDPR.
We use Twilio SendGrid to send transactional emails containing purchase confirmations, license keys and download links. SendGrid processes the recipient address and email contents on Our behalf. See Twilio's Privacy Notice.
To create, activate, upgrade and deliver licenses, We process purchase identifiers, email address, name, license key, activation limit and product information through Our license-management systems and Kernl download infrastructure. This processing is necessary to perform the purchase contract under Article 6(1)(b) GDPR.
If You contact Us, We process the information You provide, such as Your email address, name, message, license information and attachments, to respond to Your request. The legal basis is Article 6(1)(b) GDPR for contract-related support and otherwise Article 6(1)(f) GDPR. Support correspondence is retained only as long as needed to resolve the request and meet applicable record-keeping obligations.
Links to the Lay Theme Forum and other third-party websites take You to services operated under their own privacy policies.
We retain personal data only as long as required for the relevant purpose. Purchase, invoice and tax records may be retained for up to ten years where required by German commercial or tax law. License records are retained while the license remains valid and as needed to prevent misuse and provide downloads or support. Optional analytics and advertising data follow the provider retention periods described above and in the Cookie Settings.
We disclose personal data only to providers needed for hosting, analytics, advertising, newsletter delivery, payment processing, email delivery, licensing and support, or where required by law. Some providers may process data outside the European Economic Area, including in the United States. Depending on the provider and processing, safeguards may include an adequacy decision such as the EU-US Data Privacy Framework or standard contractual clauses.
Subject to the applicable legal requirements, You may request access to, correction or deletion of Your personal data, restriction of processing, data portability, or object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future.
To exercise Your rights, contact info@laytheme.com. You also have the right to lodge a complaint with a data-protection authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information.
We use technical and organizational measures appropriate to the nature of the data processed. No method of transmission or storage is completely secure, but We review access controls, encrypted connections and data minimization as part of operating the Service.
We may update this Privacy Policy when Our services, providers or legal obligations change. The current version and update date are published on this page.
Questions about this Privacy Policy can be sent to info@laytheme.com.