Legal
Privacy Policy
Last updated
In short: the PenLayer app has no account, no analytics and no tracking. It goes online for two things only: checking your licence, and checking for updates. What you draw never leaves your Mac. This website is different: if you accept cookies, it uses Google Analytics and Microsoft Clarity to understand how visitors use it. When you buy, our payment provider Creem handles your payment details; we never see your card.
Who is responsible
Web Freestyle SRL, IDNO 1021600031185, Moldova is the data controller for PenLayer and penlayer.com. Contact: support@penlayer.com.
The app
- Your drawings are held in memory while PenLayer runs. They are never written to our servers or sent anywhere.
- What you see on screen: PenLayer draws on top of your screen. It doesn’t capture, read or record what’s underneath.
- Licence checks. When you activate, and now and then afterwards, the app sends your licence key and a name for your Mac (for example “Ada’s MacBook Pro”) to
api.penlayer.com, which passes them to Creem to confirm the licence. The Mac name is what you’ll see in Creem’s portal when you manage your devices. The answer is cached on our server for up to 7 days, stored under a one-way fingerprint of the key, not the key itself. - Update checks. The app asks
api.penlayer.comwhether a newer version exists and downloads it if so. You can turn automatic updates off in Preferences. - On your Mac: your preferences, recently used icons and licence details are saved locally, in the app’s own folder.
- Nothing else. No usage analytics, no crash reports, no advertising identifiers.
Buying a licence
Checkout is run by Creem, our Merchant of Record. Creem collects your name, email, billing country and payment details to take the payment, prevent fraud, calculate tax and send your receipt and licence key. Creem processes this under its own privacy policy. We never receive your card details.
Creem shares with us your name, email, country, what you bought and the order details. We use them to deliver and support your licence, answer your emails, and keep the records the law requires.
After checkout, the thanks page shows your first name, plan and licence key. It reads them from a link that Creem signs; the link stops working after 14 days, and the page removes it from your address bar once loaded.
This website
Everything in this section is about penlayer.com, the website. None of it applies to the app.
- Analytics, only if you accept. When you first visit, a banner asks whether we may count your visit. Until you accept, neither Google Analytics nor Microsoft Clarity loads and no analytics cookies are set. If you decline, nothing changes.
- What it collects. The pages you view, the page that sent you here, your browser, device type and screen size, and your approximate location (country and city), worked out from your IP address. Google Analytics doesn’t store the IP address itself. We use it to see which pages are read and where visitors come from, so we can improve the site.
- Microsoft Clarity records how you use a page: mouse movements, clicks, scrolling and taps, which it can replay as a session recording and combine into heatmaps. It masks text you type into fields and doesn’t record keystrokes. We use it to find pages that confuse people or parts that don’t work.
- Cookies. Accepting sets Google Analytics cookies (
_gaand_ga_01M91Y8R4K, up to two years) and Clarity cookies (_clck, one year, and_clsk, one day), which tell one visit from the next. - No advertising. We have turned off Google signals and ad personalisation, and we don’t link the data to Google Ads, Microsoft Advertising or any other advertising.
- Changing your mind. “Cookie settings” at the bottom of every page brings the banner back. Declining stops both and removes their cookies.
- On your device: your cookie choice and your light/dark theme are kept in your browser’s local storage. The drawing tool on this site runs entirely in your browser and stores nothing. Fonts are served from this site.
Google processes this data for us under its data processing terms, and Microsoft under the Clarity terms and privacy statement. The thanks page you see after buying never loads either, because its address carries your licence key.
Server logs
Like any website, our servers see the IP address, browser and time of each request. The site, the licence server and downloads run on Cloudflare, which keeps short-lived request logs to run the service and protect it from abuse. We use them only for security and fixing problems.
If you write to support@penlayer.com, we use your address and message only to reply and help you. Our email is hosted by Google Workspace.
Who processes data for us
| Provider | What for |
|---|---|
| Creem | Payments, tax, receipts, licence keys, customer portal |
| Cloudflare | Hosting the site, the licence server and downloads; request logs |
| Google Workspace | Support email |
| Google Analytics | Website visit statistics, only with your consent |
| Microsoft Clarity | Website session recordings and heatmaps, only with your consent |
These providers may process data outside your country. They use the safeguards the law requires for such transfers, such as the EU Standard Contractual Clauses. We don’t sell personal data, and we don’t share it for advertising.
Legal bases
Where the GDPR or similar laws apply, we rely on: contract (delivering and checking your licence, updates, support); legitimate interests (keeping our servers secure and preventing abuse of licences); consent (website analytics, which you can withdraw at any time); and legal obligation (keeping purchase records for tax).
How long we keep it
- Cached licence answers: up to 7 days.
- Server logs: kept by Cloudflare for a short period, typically days.
- Website analytics: 14 months in Google Analytics; in Clarity, session recordings for 30 days and heatmaps for up to 13 months. Both are then deleted automatically.
- Purchase records: as long as tax law requires, usually up to 10 years.
- Support emails: until your question is resolved, and then for a reasonable time in case you follow up.
Your rights
You can ask us to access, correct, delete or export your personal data, or object to how we use it. Email support@penlayer.com, and we’ll reply within 30 days. Deleting purchase data may end your licence, and some records we must keep by law. You can also complain to your local data protection authority.
Children
PenLayer isn’t directed at children under 16, and we don’t knowingly collect their data.
Changes
If this policy changes, we’ll update the date at the top. For significant changes we’ll also give notice on this site.