Privacy Policy

Controller: spacetype OOD, trading as Type Forward
Company number: 206100269
VAT number: BG206100269
Address: 1574, Georgi Asparuhov Gundi, bl. 27 A, ent. V, ap. 42, Sofia, Bulgaria
Email: hello@typeforward.com

Use this email for privacy questions or to exercise your rights.

Website browsing

Our hosting and security providers receive technical details needed to deliver and protect the websites. These can include your IP address, visit time, requested page, browser or device, response status and error or security information.

We use this information to keep the websites reliable, diagnose problems and prevent fraud, abuse and attacks. Our legal basis is legitimate interests.

Some pages link to external font shops. If you follow a link, that website handles the visit under its own privacy policy. We may receive a commission if you later buy there, at no extra cost to you.

Contact and subscriptions

If you contact us, we use your name, email address, message and submission details to reply, manage your enquiry and prevent spam. We rely on legitimate interests, or contract when you ask about a purchase or licence.

If you choose to subscribe to newsletters, trial-font messages or checkout marketing, we send your email address and consent record to Brevo. Subscription is optional and every marketing email has an unsubscribe link. Our legal basis is consent.

Accounts and sign-in

We use your email address, name and sign-in details to create and protect your account, provide orders and downloads, and send service messages. You need an account to buy, but not a telephone number. Our legal basis is contract.

If you choose “Continue with Google”, your browser opens Google’s page. Google handles the sign-in information under its own Privacy Policy and returns your verified email address, a stable account reference and, where available, basic name or managed-domain details.

We never receive your Google password or access your Drive, Calendar or contacts. Temporary sign-in codes and tokens are discarded when sign-in finishes, and we do not keep a Google refresh token.

We keep a protected connection reference to stop one Google identity being linked to different Type Forward customers. You can disconnect it in Account Settings after confirming your password.

Disconnecting does not remove your Type Forward account, orders, licences, documents or downloads. Password sign-in and recovery remain available. Google sign-in does not subscribe you to marketing. Our legal bases are contract and legitimate interests in secure account access.

Purchases, licences and payments

To complete an order, we use your account and contact details, licence owner, chosen fonts and licence scope, billing and tax details, delivery details, and payment or refund status. We keep the records needed for downloads, updates and licence administration.

If you give us details for another person or company, make sure you are allowed to do so and show them this policy.

Stripe processes card payments. Type Forward does not receive or store full card numbers.

We keep the payment and order identifiers, amount, currency, status, refund and payment-matching information needed to fulfil the order, prevent fraud and meet accounting duties.

If you pay by bank transfer, our banking partners process it and we keep the statement information needed to match it to the invoice.

For an EU company purchase, we may verify the VAT number through VIES and keep the result, time and returned business details. We also keep the wording, time, IP address and policy versions needed to show the required checkout agreements and immediate-access request. Marketing remains optional.

We rely on contract to provide the account, order, payment, delivery and licence; legal obligation for tax, accounting and consumer records; and legitimate interests for security, fraud prevention and legal claims. If you do not provide required account, licence, billing or payment information, we cannot complete the order and licence.

Optional analytics and your consent choices

Each website asks separately. Closing the notice, scrolling or making no choice is not consent. Google Analytics and Microsoft Clarity stay off on that website until you allow the corresponding purpose, and you can withdraw permission at any time through Cookie settings.

If you allow a service, change your choice or withdraw it, we may keep a minimal record of the website, your choices, the action, time and expiry. It does not contain your name, email address, IP address, account, order, page history or analytics identifier. We use it to demonstrate and protect the integrity of the choice, based on our legal obligation to keep appropriate consent evidence and our legitimate interests in preventing tampering and handling legal claims. The record can never turn an optional service on by itself.

Google Analytics: If you allow Website statistics, it measures visits, pages, traffic source, broad location and broad device type. Google briefly uses the IP address to derive broad location, then discards it before Analytics data is logged; Type Forward does not receive or store the full IP address in Analytics. Each website uses a separate Analytics property. Rejection or no action sends no Analytics visit. Our legal basis is consent.

Microsoft Clarity: If you allow Session recordings, Clarity may receive the page URL and referrer; page structure, layout and content subject to masking; clicks, scrolling, pointer movement, selections, input interactions and resizing; and diagnostic, performance and error information. It produces session playback and heatmaps on eligible pages. We use Strict masking and exclude sensitive routes, but these safeguards reduce rather than eliminate the chance that a URL, page structure or interaction could identify someone. Type Forward does not connect Clarity’s browser identifier to a name, email address, account or order.

Type Forward and Microsoft are independent controllers for Clarity. Microsoft may use the information for its own purposes under its terms, including product improvement and advertising profiles. If you separately allow Clarity on more than one Type Forward website, Microsoft may recognise the same browser across those websites; permission on one website never grants permission on another. Our legal basis for activating Clarity is consent.

Microsoft normally keeps playback data for 30 days. Click and heatmap information, labelled or favourited sessions, and randomly selected recordings may remain for up to nine months. Because Type Forward does not identify a visitor in Clarity, we generally cannot isolate and delete one visitor’s recording without deleting the whole project.

The legal bases named in this policy have the following meanings under Article 6 GDPR:

• Consent: you choose whether we may send marketing or activate Google Analytics or Microsoft Clarity. You may withdraw consent at any time.
• Contract: we need the information to answer a purchase request, provide an account, process and deliver an order, take payment or administer a licence.
• Legal obligation: we must keep or use information for tax, accounting, consumer-protection and data-protection duties.
• Legitimate interests: we need the information to operate secure and reliable websites, answer enquiries, prevent fraud, protect consent records and establish or defend legal claims. We use this basis only after balancing it against your rights.

Account, order, payment, delivery, licence and requested-support messages are sent where needed for a contract. Legally required confirmations rely on legal obligation, and necessary security or operational notices rely on legitimate interests. These service messages are not newsletter marketing.

We share information only with recipients needed for the purposes described above:

• Hostinger International Ltd. hosts the main Type Forward website and processes website requests and operational logs for delivery, reliability and security. See Hostinger’s Privacy Policy.
• DigitalOcean provides microsite infrastructure and storage used for website assets and private order packages where applicable. See DigitalOcean’s Privacy Policy.
• Cloudflare, Inc. protects and delivers microsite traffic and processes network requests and security signals to detect abuse. See Cloudflare’s Privacy Policy.
• Stripe Payments Europe Limited and relevant Stripe companies process card payments, authentication, security and fraud prevention. Stripe acts on our instructions for some payment services and as an independent controller for its own fraud-prevention, compliance and regulated-payment duties. See Stripe’s Privacy Policy.
• Banking partners process bank transfers and related compliance information as independent controllers.
• Brevo SAS acts as our processor for newsletters and email delivery. See Brevo’s Privacy Policy.
• Google Ireland Limited provides Google Analytics as our processor for the EEA relationship. Google also provides the Google sign-in pages and business email services described above under the roles that apply to those services. See Google’s Privacy Policy.
• Microsoft Ireland Operations Limited provides Microsoft Clarity. Type Forward and Microsoft act as independent controllers for Clarity. See Microsoft’s Privacy Statement and Clarity Terms.
• Professional advisers and public authorities receive information only where needed for legal advice, claims, tax, accounting or another legal requirement.

Some recipients process information outside the European Economic Area. Where required, transfers use an adequacy decision, including the EU–US Data Privacy Framework where the recipient participates, or contractual safeguards such as the European Commission’s Standard Contractual Clauses. The provider privacy links above explain their current transfer arrangements. Contact us if you would like more information about the safeguards relevant to your data.

• Accounts and Google sign-in: account information is kept while the account is active or as needed for the purposes below. A Google connection reference is removed when you disconnect Google in Type Forward or delete the account. Temporary sign-in records expire within 30 minutes.
• Orders, invoices, tax, payments, licences and legal agreements: kept for the periods required by tax, accounting, consumer law, licence administration and legal claims. Account deletion does not require us to erase records we must lawfully retain.
• Newsletters: kept by Brevo until you unsubscribe or the subscription is otherwise no longer needed. Minimal evidence of the subscription or withdrawal may remain where required to demonstrate compliance.
• Enquiries: kept only while needed to answer and manage the enquiry, meet a legal duty or handle a dispute.
• Website request, security and error logs: kept only for the short operational period needed for delivery, diagnosis and abuse prevention; logs available to Type Forward are normally kept for no more than about 90 days, while infrastructure providers apply their documented service periods.
• Cookie choices and consent records: the browser choice lasts no more than 180 days. A receipt cookie lasts no longer than that choice cycle. A minimal server record is scheduled for deletion 24 months after the choice is withdrawn, replaced or expires. If an active dispute or legal hold requires it, we restrict the record to that purpose, review the hold and delete the record when the hold ends.
• Google Analytics: each website’s user-level and event-level data is kept for two months, without extending the period when new activity arrives. Standard aggregated reports may remain available for longer under Google’s product operation.
• Microsoft Clarity: playback is normally kept for 30 days; click and heatmap information and selected sessions may remain for up to nine months.

You may ask us for access to your personal data, correction, deletion, restriction or portability, and you may object when we rely on legitimate interests. Where we rely on consent, you may withdraw it at any time. Withdrawal stops future processing for that purpose but does not undo earlier lawful processing or automatically delete information already held by a provider.

To exercise a right, email hello@typeforward.com. We will respond without undue delay and may need enough information to verify the request. You may complain to Bulgaria’s Commission for Personal Data Protection or the data protection authority where you live, work or believe a problem occurred.

Account deletion: deleting an account removes the account profile and connected marketing contact where applicable. We may still keep order, invoice, tax, licence, consent and legal-agreement records when required for the purposes and periods described above.

We use access controls, reputable service providers and proportionate technical and organisational measures to protect personal data. No online service can guarantee complete security. If a breach creates a legal notification duty, we will notify the relevant authority and affected people within the applicable time.

Our websites are not directed to children under 18, and we do not knowingly collect their data. If you believe a child has provided personal data, email hello@typeforward.com.

We may update this Privacy Policy when our services or the law change. The current version and its Last updated date appear on this page. If a change materially affects a consent choice, we will ask again where required.