Privacy Policy

Company Name: spacetype OOD
UIC / EIK (Company Registration Number): 206100269
VAT Number: BG206100269
Operating Name: Type Forward
Location: 1574, Georgi Asparuhov Gundi, bl. 27 A, ent. V, ap. 42, Sofia, Bulgaria
Contact Email: hello@typeforward.com
Website: typeforward.com

If you have any questions about this privacy policy or wish to exercise your data protection rights, please use the email address above.

A. Information from All Website Visitors

1. Mailing List Subscriptions Data

• Data: Email address and your consent. Our email provider (Brevo) also records technical data such as time, IP address, and a consent log to manage your subscription.
• Why: To send newsletters (e.g., new font releases, sales) and manage welcome/trial font emails.
• Legal basis: Consent. You can withdraw at any time via the unsubscribe link.

2. Contact forms

• Data: Name, email, message topic/subject, and your message (and, where shown, a processing consent tick).
• Why: To reply to your enquiry. If your message is about purchasing a service or licence, we may also process it as a step toward a contract.
• Legal basis: Legitimate interests (to answer and manage enquiries); Contract where the message relates to buying a service or licence.
• Handling: The website contact form sends your message to our team by email. We use that data to answer and manage your enquiry. Messages and related correspondence are kept only as long as needed for that purpose, applicable legal obligations, or disputes.

3. Technical data

• Data: When you visit, our hosting service receives your IP address and basic browser/device details in security and error logs.
• Why: To keep the site working, diagnose errors, and prevent abuse.
• Legal basis: Legitimate interests (site security and reliability).

4. Cookies & Consent Logs (via CookieYes)

• Data: Anonymized IP address, your country, your consent status, and a timestamp of when you consented.
• Why: To remember your cookie choices and meet our legal record-keeping duties.
• Legal basis: Legal obligation. For a detailed list, see our Cookie Policy.

5. Analytics data (via Google Analytics)

• Data: Pseudonymized data about pages visited, device type, and general location. Google Analytics 4 uses an IP address at collection time to derive general location, then discards it before Analytics data is logged; Type Forward does not receive or store the full IP address in Analytics.
• Why: To analyze website performance and improve user experience.
• Legal basis: Consent. Manageable via our cookie settings.

6. Behavior Analytics (via Hotjar & Microsoft Clarity)

• Data: After you give analytics consent, Hotjar and Microsoft Clarity may process interaction events such as clicks, scrolling, and mouse movement and, depending on configuration, session recordings for usability analysis.
• Why: To identify usability issues and improve website design.
• Legal basis: Consent. Manageable via our cookie settings.

7. Affiliate links. Some pages include affiliate links to external font shops (e.g., Fontspring, MyFonts). If you click a link and make a purchase, we may earn a small commission at no extra cost to you. The external website will process your data under its own privacy policy, which we do not control.

B. Information from Our Clients (E-commerce)

8. Account, order contact, and authentication

• Data: A registered account is required to buy. We process the account email (which is also the order contact email), names used on the account/order, and account/authentication details needed to sign in securely (such as a hashed password). We do not require a phone number for standard checkout.
• Why: To create and maintain your account, deliver digital goods, communicate about the order, and protect account access.
• Legal basis: Contract.

9. Licence and order information

• Data: Licence owner details; the fonts and licence tiers you select; project/scope information needed for the licence (for example intended use, seat/domain or other scope details you supply); and, for custom orders we arrange with you, the commercial and licence information captured for that order.
• Why: To issue the correct licence, fulfil the order, and administer ongoing access and updates.
• Legal basis: Contract.

10. Billing, invoice, and tax information

• Data (by scenario): billing identity and address; where a personal invoice requires it, a personal tax identification number such as a Bulgarian EGN; for company purchases, company name, EIK/BULSTAT, VAT registration/number or another non-EU tax/registration identifier as applicable; alternate invoice-recipient details where used; company contact email; and an optional separate delivery email where you supply one.
• Acting for others: You may name another licence owner, invoice recipient, company contact, or delivery recipient. You should be authorised to provide their details and to direct them to this Privacy Policy.
• Saving details for next time: During checkout, you may choose “Save these details in my account for next time.” This is a convenience feature for future checkouts, not a marketing opt-in.
• Legal basis: Legal obligation for invoicing, accounting, and tax; Contract where needed to complete the purchase.

11. EU company VAT checks (VIES)

• Data: Where you buy as an EU company and provide a relevant EU VAT number, we may check that number through the EU VIES service. We may retain the validation status and, where returned, business identity/address information and the time of the check.
• Why: To apply the correct VAT treatment for the transaction (for example reverse charge where a valid VIES result supports it).
• VAT checks and IP addresses: We use your billing country and any VIES result to decide the correct VAT for the order. That is separate from the IP address we may record when you accept legal documents or for security — we do not use that IP address to claim it determines your VAT location.
• Legal basis: Legal obligation and Contract.

12. Payment Processing (Stripe & Bank Transfers)

• Card payments through Stripe: Type Forward does not store full card details on our servers. Card payments are processed by Stripe. We may retain high-level payment and order identifiers, amounts, currency, payment status, fraud and security information Stripe provides for the payment, refunds, and payment-matching records we need for accounting. Stripe also acts as an independent data controller for some processing (including fraud prevention). See Stripe’s Privacy Policy.
• Bank transfers: If you pay a manual invoice by wire transfer, the transaction is processed by our banking partners. We retain resulting bank-statement information needed for accounting and to match payments to invoices.

13. Checkout legal consent and immediate access

• Two separate required actions: At checkout you must (1) agree to the Terms, License, and Refund Policy, and acknowledge that you have read this Privacy Policy; and (2) separately request/acknowledge immediate access to the fonts. Immediate delivery may end the EU cooling-off / withdrawal right where that right applies and the applicable legal conditions are met. Our voluntary Return Promise described in the Refund Policy remains separate.
• What we keep: We may retain a record of which version of each legal document you agreed to with that order (including Terms, License/EULA, Privacy Policy, and Refund Policy), together with the wording shown, the time, and your IP address.
• Why: To keep a clear record of what you agreed to with the order, for legal, consumer, and accounting requirements, and to help resolve disputes.
• Legal basis: Contract and Legal obligation.
• Orders arranged directly with us: For orders arranged directly with us, custom quotes, or bank-transfer invoices, we may record your consent based on written communication (such as email confirmation) rather than the website checkout form.

14. Registration consent

• Data: When you create an account, we record required acceptance of the Terms and this Privacy Policy, including the wording shown, the version of each document, the timestamp, and your IP address.
• Marketing: Marketing subscription remains separate and optional.
• Legal basis: Contract, and Legal obligation where record-keeping is required.

15. Checkout Marketing Opt-In (Optional)

• Data: Your email address and, if you opt in, a record that you chose to receive marketing communications (for example, font updates, new releases, and foundry news).
• When we use it: We send marketing emails only if you subscribe through our mailing list or trial-font signup, or if you tick the optional marketing checkbox at checkout. This is separate from the required legal-documents and immediate-access actions above.
• Legal basis: Consent. You can withdraw at any time using the unsubscribe link in every marketing email.

16. Records we may need to keep

• Data: We may also keep records of which version of each legal document you agreed to; refund, cancellation or correction, and tax documents; first download/access timestamps where recorded; and licence and order records needed to administer licences and handle disputes or misuse.
• Why: Licence administration, accounting/tax compliance, security, and dispute handling.
• Legal basis: Legal obligation, Contract, and Legitimate interests where applicable.

Where this policy names a legal basis, we mean one of the following under Article 6(1) GDPR:

• Consent — Art. 6(1)(a): you have given clear permission (for example, marketing or optional analytics cookies). You can withdraw consent at any time.
• Contract — Art. 6(1)(b): processing is needed to provide the account, order, licence, or related service you requested, or to take steps at your request before a contract.
• Legal obligation — Art. 6(1)(c): we must process data to meet accounting, tax, consumer, or other legal duties.
• Legitimate interests — Art. 6(1)(f): processing is needed for our legitimate interests (such as security, answering enquiries, or defending legal claims), balanced against your rights.

We use these labels in the sections above so the policy stays readable. The Article 6 references here are the formal GDPR grounding for those labels.

We use trusted service providers and other recipients so we can operate the website, shop, payments, delivery, analytics, and communications. Each recipient receives only the data needed for its service. Depending on the service and legal context, a recipient may act as a processor under our instructions or as an independent controller for its own purposes.

1. Infrastructure & E-commerce

• Hostinger International Ltd. — website hosting and related infrastructure.
• DigitalOcean Spaces — European cloud storage for private order packages and related documents in your account.
• Stripe — checkout and payment processing. Stripe may also act as an independent controller for its own fraud prevention, compliance, and related payment duties. See Stripe’s Privacy Policy.
• Banking partners — processing of manual wire transfers. They may act as independent controllers under applicable banking and anti-money-laundering rules.

2. Analytics & Consent tooling

• Google LLC — Google Tag Manager and Analytics (where enabled with consent).
• Hotjar Ltd. — behavior analytics (where enabled with consent).
• Microsoft Corporation — Clarity analytics (where enabled with consent).
• Mozilor Limited (CookieYes) — cookie consent management.

3. Marketing & Communication

• Brevo SAS — newsletters and transactional emails.
• Google LLC — Google Workspace email for business correspondence.

International transfers: Some of these providers may process personal data outside the EEA. Where required, we rely on applicable safeguards, which may include an adequacy decision or contractual safeguards.

• Order, invoice, tax, consent, refund, licence, and related records: Exact retention depends on the type of record and the applicable accounting, tax, legal-claim, and licence-administration obligations.
• Other profile, support, marketing, and analytics data: Kept only as long as needed for the stated purpose, or until you validly withdraw consent or request deletion, subject to lawful exceptions (for example where we must keep evidence of a request or a security incident).
• Newsletter subscribers (Brevo): Kept until you unsubscribe; minimal consent logs may be retained afterward where needed for legal record-keeping.
• Contact-form messages and related correspondence: Kept according to the criteria above — only as long as needed for the enquiry, applicable legal obligations, or disputes.
• Server access/security logs: Typically kept for a short operational period (for example up to about 90 days).
• Backups: Automatic backups may retain restore points for a limited operational window.
• Right to be Forgotten: If you request account deletion, your user profile and marketing data can be removed. Statutory order/document records and licence/related records may still need to remain for the reasons above, including after a refund or cancellation.

You have the right to request access, correction, erasure, restriction, portability, and to object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time.

To exercise your rights, email hello@typeforward.com. We will respond without undue delay. You also have the right to lodge a complaint with your local authority. In Bulgaria, that is the Commission for Personal Data Protection (CPDP).

We use reputable hosting, industry‑standard security measures, and limited access to data. If a data breach occurs, we will investigate, mitigate risk, and notify the relevant authority within the applicable GDPR timeframe where legally required, and inform affected individuals where required.

Our site does not target children under 18, and we do not knowingly collect their data. If you believe we have inadvertently collected such information, please contact us at hello@typeforward.com so we can promptly take corrective action.

We may update this privacy policy when our services or the law change. We will post the updated version on this page and change the “Last updated” date shown in the sidebar.