Privacy Policy
Last updated: 26 July 2026
Who we are
Yep! Type Foundry is an independent type foundry operated by ROMAN SHAMIN in Lisbon, Portugal. We are the data controller for the personal data described here. You can reach us any time at hello@yeptype.com.
What we collect, why, and on what legal basis
| Data | Why | Legal basis (GDPR Art 6) |
|---|---|---|
| Name, email, billing address, country, VAT number (if you give one) | To sell and deliver font licences, issue your licence and receipt, and provide support | Contract—Art 6(1)(b) |
| Order and payment records (amount, items, licence tier, payment confirmation—never your full card number) | To process your purchase and prevent fraud | Contract—Art 6(1)(b); legitimate interests—Art 6(1)(f) |
| Invoice records (name, address, tax details, amount) | Portuguese invoicing and tax obligations | Legal obligation—Art 6(1)(c) |
| Email address, if you tick the newsletter box | To send occasional foundry news | Consent—Art 6(1)(a) |
| Account details (email, password hash) if you create an account | To let you sign in and re-download your fonts | Contract—Art 6(1)(b) |
Pseudonymous visitor ID and referrer/campaign data (cookie _fontdue_state) | To understand how the site is used | Consent—Art 6(1)(a) and ePrivacy Art 5(3) |
| Server logs and aggregate traffic statistics (IP address, page, referrer, country, user agent) | Security, fraud prevention, and basic aggregate statistics | Legitimate interests—Art 6(1)(f) |
| Emails you send us | To answer you | Legitimate interests—Art 6(1)(f) |
We don’t run advertising, we don’t sell or share your personal data, and we don’t build advertising profiles.
Cookies
We only set non-essential cookies after you agree. See our Cookie Policy for the full list and how to change your choice at any time.
Who processes your data on our behalf
| Processor | What they do | Where |
|---|---|---|
| Fontdue | Store platform, cart and checkout, licence delivery, webfont serving, site analytics | USA |
| Netlify | Website hosting and server-side, cookieless traffic statistics | USA |
| Stripe | Payment processing and payment fraud prevention—they receive your card details directly, we never see them | USA/EU |
| Moloni | Portuguese invoicing (Fatura-Recibo) | Portugal |
| MailerLite / MailerSend | Sending newsletter and transactional email | EU/USA |
| Google Maps Platform | Address autocomplete in the checkout address field, if you use it | USA |
| Gandi | Our email hosting | EU |
| Cloudflare | DNS, and content delivery for webfont files | USA/EU |
Each of them acts under a data-processing agreement and may only use your data to provide their service to us.
International transfers
Some of these processors are outside the EEA, mainly in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework, with additional safeguards where needed.
How long we keep it
- Invoices and order records: 10 years, as required by Portuguese tax law.
- Your account: for as long as it exists—email us and we’ll delete it.
- Newsletter: until you unsubscribe.
- Analytics: the visitor cookie expires after 1 year; traffic statistics are aggregate and short-lived.
- Support email: up to 2 years after the conversation ends.
Your rights
You can ask us to access your data, correct it, delete it, restrict or object to how we use it, and receive a copy of it. Where we rely on your consent, you can withdraw it at any time—use the unsubscribe link in any newsletter, or click “Cookie settings” in the footer to change your cookie choice. Withdrawing consent doesn’t affect processing that already happened.
Email hello@yeptype.com and we’ll reply within one month. We may need to confirm your identity first, and we won’t treat you differently for asking.
One limit: we can’t delete invoices we’re legally required to keep.
Complaints
If you think we’ve mishandled your data, please tell us first—we’d like the chance to fix it. You can also complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt, or to the authority where you live.
Children
Our fonts are sold to designers, developers, and businesses. The site isn’t intended for children, and we don’t knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we’ll delete it.
Automated decisions
We don’t make automated decisions with legal effects about you, and we don’t profile you for advertising. Stripe applies automated fraud checks to payments.
Changes
If we change this policy we’ll update the date above and post the new version here.