1. Who We Are
Lapa Ninja (“Lapa”, “we”, “us”) is an independent, curated gallery of landing page designs and design resources. We are the data controller for the personal data described in this policy. You can reach us at [email protected].
2. What We Collect
Most of Lapa Ninja can be browsed without an account and without giving us any personal data. When you create an account or use member features, we collect:
Account data
- Email address — used as your login and for account-related email (verification, password reset, billing receipts, important notices).
- Password — stored only as a salted hash. We never see or store your plain-text password. Accounts created with Google Sign-In have no password unless you set one.
- Display name, handle, bio, website link and avatar — optional profile fields you choose to fill in. If you make your profile public, these are visible to anyone.
- Sign-in method — whether you signed up with a password or with Google, and whether your email is verified.
Boards & saves
- The designs you save, the Boards you create, their names and descriptions, and whether each Board is private or public.
Billing data (Lapa Pro only)
- Subscription status, billing interval, current period end date, and customer / subscription identifiers issued by our payment partner. We do not receive or store your card number, CVC or full billing address — those are held by the payment partner (see Who We Share It With).
Usage & technical data
- Pages viewed, referrer, approximate country, browser and device type, screen size, and interaction events collected by our analytics tools. IP addresses are used to derive approximate location and are not stored in our analytics.
- Standard server logs (IP address, user agent, requested URL, timestamp) kept briefly by our hosting and CDN provider for security and debugging.
Communications
- If you email us or subscribe to the newsletter, we keep your email address and the content of the conversation.
3. Google Sign-In Data
You can create an account or sign in using your Google account. When you do, Lapa Ninja requests only the following Google OAuth scopes:
userinfo.email— your Google account email address and whether it is verified.userinfo.profile— your name, profile picture URL and Google account ID.
We do not request access to your Gmail, Contacts, Drive, Calendar or any other Google service.
What we do with it
- Email — creates or matches your Lapa account and marks it as verified, since Google has already confirmed you own that address.
- Name — pre-fills your display name. You can change it at any time.
- Profile picture— used once to seed your avatar, and only if you don't already have one. You can replace or remove it in Account settings.
- Google account ID — stored so we can recognise your Google account on future sign-ins.
What we don't do with it
- We do not use Google user data for advertising, profiling or marketing.
- We do not sell, rent or share Google user data with third parties, except the service providers strictly needed to store it (our database host).
- We do not use Google user data to train machine-learning or AI models.
- We do not store your Google access token after sign-in completes.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Lapa Ninja's access to your Google account at any time from your Google Account permissions page. Revoking access does not delete your Lapa account — see Your Rights & Deletion for that.
4. How We Use Your Data
- Providing the service — signing you in, saving your Boards, showing your public profile, and delivering Lapa Pro features.
- Billing — starting, renewing and cancelling Pro subscriptions and sending receipts.
- Transactional email — verification links, password resets, and notices about your account or subscription. These cannot be opted out of while you hold an account.
- Newsletter — only if you subscribe. Every email has an unsubscribe link.
- Analytics & improvement — understanding which pages and features are used so we can improve the site.
- Advertising — showing ads to non-Pro visitors to keep the free tier free (see Cookies & Advertising).
- Security & abuse prevention — detecting fraud, spam, account takeover attempts and violations of our Policy.
We rely on the following legal bases: performance of our contract with you (account, Boards, Pro), your consent (newsletter, non-essential cookies), and our legitimate interests (analytics, security, keeping the free tier ad-supported).
7. Data Retention
- Account, profile and Boards — kept for as long as your account exists. Deleted within 30 days of an account-deletion request.
- Google Sign-In data — kept as part of your account and deleted with it. Access tokens are discarded immediately after sign-in.
- Billing records — subscription history is kept for up to 7 years after the last transaction where tax or accounting law requires it.
- Analytics — kept in aggregated, non-identifying form. Analytics data is not linked to your account and is periodically purged.
- Server logs — typically 30 days or less.
- Support email — kept for as long as needed to resolve your request and handle any follow-ups.
8. Your Rights & Deletion
Wherever you live, you can ask us to:
- Access — get a copy of the personal data we hold about you.
- Correct — fix inaccurate data. Most profile fields can be edited directly in Account settings.
- Delete — erase your account and everything attached to it: profile, Boards, saves, sign-in data (including Google Sign-In data) and subscription links.
- Export — receive your data in a machine-readable format.
- Object or restrict — object to processing based on legitimate interests, or ask us to limit it.
- Withdraw consent — unsubscribe from the newsletter or change cookie settings at any time.
To exercise any of these, email [email protected]from the address on your account. We respond within 30 days and never charge for these requests. If you're in the EU/EEA or UK you also have the right to lodge a complaint with your local data-protection authority.
Cancelling Lapa Pro does notdelete your account, and revoking Google access does not delete it either — send us a deletion request if that's what you want.
9. Security
All traffic is encrypted with HTTPS. Passwords are hashed, sessions use secure HTTP-only cookies, and access to production data is limited to the people who run the site. No system is perfectly secure; if we ever discover a breach affecting your data we will notify you and the relevant authorities as required by law.
10. Children
Lapa Ninja is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.
11. Changes
We may update this policy as the site evolves. The “last updated” date at the top always reflects the current version. For material changes that affect how we use your data, we will notify account holders by email before they take effect.
12. Contact
Questions, access or deletion requests: [email protected]. For terms of use, billing and copyright, see our Policy page.