Privacy Policy

Company Name: spacetype OOD
UIC / EIK (Company Registration Number): 206100269
VAT Number: BG206100269
Operating Name: Type Forward
Location: 1574, Georgi Asparuhov Gundi, bl. 27 A, ent. V, ap. 42, Sofia, Bulgaria
Contact Email: hello@typeforward.com
Website: typeforward.com

If you have any questions about this privacy policy or wish to exercise your data protection rights, please use the email address above.

A. Information from All Website Visitors

1. Mailing List Subscriptions Data

• Data: Email address and your consent. Our email provider (Brevo) also records technical data such as time, IP address, and a consent log to manage your subscription.
• Why: To send newsletters (e.g., new font releases, sales) and manage welcome/trial font emails.
• Legal basis: Consent. You can withdraw at any time via the unsubscribe link.

2. Contact forms

• Data: Name, email address, message topic/subject, your message, and technical information associated with the submission, including your IP address and basic browser/device information.
• Why: To reply to and manage your enquiry, and to protect the contact form from spam and abuse. If your message is about purchasing a service or licence, we may also process it as a step toward a contract.
• Legal basis: Legitimate interests (to answer and manage enquiries and protect the form from abuse); Contract where the message relates to buying a service or licence.
• Handling: The website contact form sends your submission and associated technical information to authorised Type Forward team inboxes by email. We use that data to answer and manage your enquiry and protect the form from abuse. Contact-form information is not used for marketing unless you separately choose to subscribe. Messages and related correspondence are kept only as long as needed for those purposes, applicable legal obligations, or disputes.

3. Technical data

• Data: When you visit, our hosting service receives your IP address and basic browser/device details in security and error logs.
• Why: To keep the site working, diagnose errors, and prevent abuse.
• Legal basis: Legitimate interests (site security and reliability).

4. Cookies & Consent Logs (via CookieYes)

• Data: Anonymized IP address, your country, your consent status, and a timestamp of when you consented.
• Why: To remember your cookie choices and meet our legal record-keeping duties.
• Legal basis: Legal obligation. For a detailed list, see our Cookie Policy.

5. Analytics data (via Google Analytics)

• Data: Pseudonymized data about pages visited, device type, and general location. Google Analytics 4 uses an IP address at collection time to derive general location, then discards it before Analytics data is logged; Type Forward does not receive or store the full IP address in Analytics.
• Why: To analyze website performance and improve user experience.
• Legal basis: Consent. Manageable via our cookie settings.

6. Behavior Analytics (via Hotjar & Microsoft Clarity)

• Data: After you give analytics consent, Hotjar and Microsoft Clarity may process interaction events such as clicks, scrolling, and mouse movement and, depending on configuration, session recordings for usability analysis.
• Why: To identify usability issues and improve website design.
• Legal basis: Consent. Manageable via our cookie settings.

7. Affiliate links. Some pages include affiliate links to external font shops (e.g., Fontspring, MyFonts). If you click a link and make a purchase, we may earn a small commission at no extra cost to you. The external website will process your data under its own privacy policy, which we do not control.

B. Information from Our Clients (E-commerce)

8. Account, order contact, and authentication

• Data: A registered account is required to buy. We process the account email (which is also the order contact email), names used on the account/order, and account/authentication details needed to sign in securely (such as a hashed password). We do not require a phone number for standard checkout.
• Why: To create and maintain your account, deliver digital goods, communicate about the order, and protect account access.
• Legal basis: Contract.

9. Google sign-in

• Your choice: You may use “Continue with Google” to create, connect, or sign in to the same Type Forward account. Google is not contacted just because you open a Type Forward sign-in page. The Google process starts only after you choose the button and your browser redirects to Google. Email-and-password sign-in and password recovery remain available.
• Data: Google sends us your verified email address and a stable Google account identifier. It may also send basic name details and, for some managed accounts, a Google Workspace domain indicator. We immediately convert the account identifier into a protected one-way fingerprint before storing it. The short-lived authorization code and sign-in tokens are used only to complete that sign-in and are then discarded; we do not keep a Google refresh token. We do not receive your Google password and do not request access to Google Drive, Calendar, contacts, or other Google services.
• Why: To authenticate you securely, prevent one Google identity from being connected to more than one customer, and keep your orders, licences, documents, and downloads in one Type Forward account.
• Marketing: Using Google sign-in does not subscribe you to marketing. Marketing choices remain separate and optional.
• Managing the connection: When your account is connected, you can disconnect Google in Account Settings after confirming your current Type Forward password. If you created the account with Google or do not know that password, use the normal password-recovery process first. Disconnecting removes the local Google sign-in connection but does not delete your Type Forward account, purchases, licences, documents, or downloads. You can also stop using Type Forward from your Google Account’s third-party connections page. That Google-side action stops future Google authorization, but it does not delete information already held in your Type Forward account and may not remove the local connection record; use Disconnect Google in Type Forward Account Settings when you want that local record removed.
• Legal basis: Contract, and Legitimate interests in secure sign-in and protecting accounts from incorrect connections.

10. Licence and order information

• Data: Licence owner details; the fonts and licence tiers you select; project/scope information needed for the licence (for example intended use, seat/domain or other scope details you supply); and, for custom orders we arrange with you, the commercial and licence information captured for that order.
• Why: To issue the correct licence, fulfil the order, and administer ongoing access and updates.
• Legal basis: Contract.

11. Billing, invoice, and tax information

• Data (by scenario): billing identity and address; where a personal invoice requires it, a personal tax identification number such as a Bulgarian EGN; for company purchases, company name, EIK/BULSTAT, VAT registration/number or another non-EU tax/registration identifier as applicable; alternate invoice-recipient details where used; company contact email; and an optional separate delivery email where you supply one.
• Acting for others: You may name another licence owner, invoice recipient, company contact, or delivery recipient. You should be authorised to provide their details and to direct them to this Privacy Policy.
• Saving details for next time: During checkout, you may choose “Save these details in my account for next time.” This is a convenience feature for future checkouts, not a marketing opt-in.
• Legal basis: Legal obligation for invoicing, accounting, and tax; Contract where needed to complete the purchase.

12. EU company VAT checks (VIES)

• Data: Where you buy as an EU company and provide a relevant EU VAT number, we may check that number through the EU VIES service. We may retain the validation status and, where returned, business identity/address information and the time of the check.
• Why: To apply the correct VAT treatment for the transaction (for example reverse charge where a valid VIES result supports it).
• VAT checks and IP addresses: We use your billing country and any VIES result to decide the correct VAT for the order. That is separate from the IP address we may record when you accept legal documents or for security — we do not use that IP address to claim it determines your VAT location.
• Legal basis: Legal obligation and Contract.

13. Payment Processing (Stripe & Bank Transfers)

• Card payments through Stripe: Type Forward does not store full card details on our servers. Card payments are processed by Stripe. We may retain high-level payment and order identifiers, amounts, currency, payment status, fraud and security information Stripe provides for the payment, refunds, and payment-matching records we need for accounting. Stripe also acts as an independent data controller for some processing (including fraud prevention). See Stripe’s Privacy Policy.
• Bank transfers: If you pay a manual invoice by wire transfer, the transaction is processed by our banking partners. We retain resulting bank-statement information needed for accounting and to match payments to invoices.

14. Checkout legal consent and immediate access

• Two separate required actions: At checkout you must (1) agree to the Terms, License, and Refund Policy, and acknowledge that you have read this Privacy Policy; and (2) separately request/acknowledge immediate access to the fonts. Immediate delivery may end the EU cooling-off / withdrawal right where that right applies and the applicable legal conditions are met. Our voluntary Return Promise described in the Refund Policy remains separate.
• What we keep: We may retain a record of which versions of the Terms, License/EULA, and Refund Policy you agreed to, and which version of the Privacy Policy was presented and acknowledged with that order, together with the wording shown, the time, and your IP address.
• Why: To keep a clear record of what you agreed to and what privacy information was presented with the order, for legal, consumer, and accounting requirements, and to help resolve disputes.
• Legal basis: Contract and Legal obligation.
• Orders arranged directly with us: For orders arranged directly with us, custom quotes, or bank-transfer invoices, we may record your consent based on written communication (such as email confirmation) rather than the website checkout form.

15. Registration agreement and privacy acknowledgment

• Data: When you create an account, we record your required agreement to the Terms and your confirmation that the Privacy Policy was presented and read, including the wording shown, the version of each document, the timestamp, and your IP address.
• Marketing: Marketing subscription remains separate and optional.
• Legal basis: Contract, and Legal obligation where record-keeping is required.

16. Checkout Marketing Opt-In (Optional)

• Data: Your email address and, if you opt in, a record that you chose to receive marketing communications (for example, font updates, new releases, and foundry news).
• When we use it: We send marketing emails only if you subscribe through our mailing list or trial-font signup, or if you tick the optional marketing checkbox at checkout. This is separate from the required legal-documents and immediate-access actions above.
• Legal basis: Consent. You can withdraw at any time using the unsubscribe link in every marketing email.

17. Records we may need to keep

• Data: We may also keep records of which versions of contractual documents you agreed to and which Privacy Policy version was presented and acknowledged; refund, cancellation or correction, and tax documents; first download/access timestamps where recorded; and licence and order records needed to administer licences and handle disputes or misuse.
• Why: Licence administration, accounting/tax compliance, security, and dispute handling.
• Legal basis: Legal obligation, Contract, and Legitimate interests where applicable.

Where this policy names a legal basis, we mean one of the following under Article 6(1) GDPR:

• Consent — Art. 6(1)(a): you have given clear permission (for example, marketing or optional analytics cookies). You can withdraw consent at any time.
• Contract — Art. 6(1)(b): processing is needed to provide the account, order, licence, or related service you requested, or to take steps at your request before a contract.
• Legal obligation — Art. 6(1)(c): we must process data to meet accounting, tax, consumer, or other legal duties.
• Legitimate interests — Art. 6(1)(f): processing is needed for our legitimate interests (such as security, answering enquiries, or defending legal claims), balanced against your rights.

We use these labels in the sections above so the policy stays readable. The Article 6 references here are the formal GDPR grounding for those labels.

We use trusted service providers and other recipients so we can operate the website, shop, payments, delivery, analytics, and communications. Each recipient receives only the data needed for its service. Depending on the service and legal context, a recipient may act as a processor under our instructions or as an independent controller for its own purposes.

1. Infrastructure & E-commerce

• Hostinger International Ltd. — website hosting and related infrastructure.
• DigitalOcean Spaces — European cloud storage for private order packages and related documents in your account.
• Stripe — checkout and payment processing. Stripe may also act as an independent controller for its own fraud prevention, compliance, and related payment duties. See Stripe’s Privacy Policy.
• Banking partners — processing of manual wire transfers. They may act as independent controllers under applicable banking and anti-money-laundering rules.

2. Analytics & Consent tooling

• Google LLC — Google Tag Manager and Analytics (where enabled with consent).
• Hotjar Ltd. — behavior analytics (where enabled with consent).
• Microsoft Corporation — Clarity analytics (where enabled with consent).
• Mozilor Limited (CookieYes) — cookie consent management.

3. Marketing & Communication

• Brevo SAS — newsletters and transactional emails.
• Google LLC — Google Workspace email for business correspondence.

4. Optional account sign-in

• Google sign-in: When you deliberately choose “Continue with Google,” your browser leaves Type Forward and opens Google’s account-selection or sign-in page. Type Forward does not load a Google sign-in script, iframe, or Google cookie merely because you open one of our sign-in pages. Google may process browser, device, network, session, and account-choice information on its own pages under its Privacy Policy. After Google securely returns you to Type Forward, we use its response only for account authentication—not for Type Forward analytics or advertising.

International transfers: Some of these providers may process personal data outside the EEA. Where required, we rely on applicable safeguards, which may include an adequacy decision or contractual safeguards.

• Order, invoice, tax, consent, refund, licence, and related records: Exact retention depends on the type of record and the applicable accounting, tax, legal-claim, and licence-administration obligations.
• Other profile, support, marketing, and analytics data: Kept only as long as needed for the stated purpose, or until you validly withdraw consent or request deletion, subject to lawful exceptions (for example where we must keep evidence of a request or a security incident).
• Newsletter subscribers (Brevo): Kept until you unsubscribe; minimal consent logs may be retained afterward where needed for legal record-keeping.
• Contact-form messages and related correspondence: Kept according to the criteria above — only as long as needed for the enquiry, applicable legal obligations, or disputes.
• Server access/security logs: Typically kept for a short operational period (for example up to about 90 days).
• Backups: Automatic backups may retain restore points for a limited operational window.
• Google sign-in connection: The protected account fingerprint and connection dates are kept while the local connection remains active. They are removed when you disconnect Google in Type Forward or your Type Forward account is deleted. Temporary sign-in, browser-binding, and return records expire automatically within 30 minutes; authorization codes and sign-in tokens are not kept after the sign-in request is completed.
• Right to be Forgotten: If you request account deletion, your user profile and marketing data can be removed. Statutory order/document records and licence/related records may still need to remain for the reasons above, including after a refund or cancellation.

You have the right to request access, correction, erasure, restriction, portability, and to object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time.

To exercise your rights, email hello@typeforward.com. We will respond without undue delay. You also have the right to lodge a complaint with your local authority. In Bulgaria, that is the Commission for Personal Data Protection (CPDP).

We use reputable hosting, industry‑standard security measures, and limited access to data. If a data breach occurs, we will investigate, mitigate risk, and notify the relevant authority within the applicable GDPR timeframe where legally required, and inform affected individuals where required.

Our site does not target children under 18, and we do not knowingly collect their data. If you believe we have inadvertently collected such information, please contact us at hello@typeforward.com so we can promptly take corrective action.

We may update this privacy policy when our services or the law change. We will post the updated version on this page and change the “Last updated” date shown in the sidebar.