Privacy

The controller responsible for processing personal data on this website within the meaning of Art. 4(7) GDPR is:

This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you request a page, Netlify necessarily processes technical request data such as your IP address, browser and device information, requested URL, referring page, and date and time of access. Netlify may retain access and security logs for a limited period to deliver, protect, and maintain its hosting service.

Purpose: delivering the website, preventing abuse, and maintaining security and stability.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in providing a secure and reliable website.

More information is available in Netlify's Privacy Statement.

We use Fathom Analytics, a privacy-focused analytics service provided by Conva Ventures Inc. (operating as Fathom Analytics), Canada, to understand aggregate website use.

When a page is viewed, Fathom receives the page URL, referrer, IP address, and user-agent information sent by your browser. It uses the IP address and user agent with a site-specific salt to create a short-lived, pseudonymous signature for counting visits. The salt changes daily, raw IP addresses are not stored with browsing activity, and the data cannot be used by us to identify you. Fathom retains the pseudonymized data needed for visit counting for approximately 48 hours. EU visitor traffic is routed through Fathom's EU Isolation infrastructure.

Fathom does not use cookies or similar tracking technologies, does not create cross-site profiles, and does not provide us with visitor-level profiles.

Purpose: measuring aggregate page views, visits, referrers, and general device or country statistics so we can understand and improve the website.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in privacy-preserving audience measurement and improving the site.

More detail is available in Fathom's explanation of its data journey and its Privacy Policy.

The purchase buttons link to Gumroad, Inc., USA. No checkout information is sent to Gumroad merely because you view this site. When you follow a purchase link and complete checkout, Gumroad processes the information you enter, which may include your name, email address, billing details, payment information, country, tax information, purchased product, and transaction details.

Gumroad acts as merchant of record for the sale and is responsible for payment processing, fraud prevention, receipts, and sales-tax collection and remittance. Gumroad processes some information as an independent controller under its own privacy policy. It also provides us with order information needed to deliver and support the font license, generally including your name, purchase email, product, and transaction details. We do not receive your full card or bank details.

Purpose: completing and documenting the purchase, delivering the product, license administration, customer support, and compliance with tax and accounting obligations.
Legal bases: Art. 6(1)(b) GDPR for performance of the purchase and license agreement, and Art. 6(1)(c) GDPR for legal record-keeping duties.

See Gumroad's Privacy Policy for its processing.

When you contact us, we process your email address, message, attachments, and any other information you choose to provide. Email is handled through Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: responding to enquiries, providing customer support, and handling contractual or legal matters.
Legal bases: Art. 6(1)(b) GDPR where your message concerns a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR, our legitimate interest in responding to enquiries.

Personal data is disclosed only where necessary to the providers described above, professional advisers, or public authorities where required by law.

• Hosting: Netlify, Inc., USA.
• Analytics: Fathom Analytics, Canada, with EU Isolation for EU visitor traffic.
• Checkout and delivery: Gumroad, Inc., USA.
• Email: Google Ireland Limited and affiliated Google service providers.

Where data is transferred outside the EU or EEA, the provider must use an applicable transfer mechanism. Depending on the provider and transfer, this may include an adequacy decision, participation in the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. Further details are available in each provider's linked privacy information.

This website does not set cookies and does not use advertising or cross-site tracking. Fathom's analytics script works without cookies or similar identifiers. For that reason, no cookie consent banner is displayed.

Third-party websites that you choose to visit, including Gumroad, may use cookies under their own policies.

Hosting and security logs are retained by Netlify only for its operational and security needs. Fathom's short-lived pseudonymous visit signatures cease to be linkable after approximately 48 hours; aggregate analytics may be retained for longer without identifying individual visitors.

Order and transaction records are retained for as long as needed to fulfil the contract and for applicable commercial and tax retention periods. Customer-support correspondence is kept until the matter is resolved and for any further period needed to establish, exercise, or defend legal claims. Data is deleted or anonymized when its purpose and any legal retention duty end.

Subject to the legal requirements, you have the right to:

• access your personal data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR), and
• object to processing based on legitimate interests (Art. 21 GDPR).

To exercise these rights, email jonas@xofoundry.com. If processing is based on consent, you may withdraw that consent at any time with effect for the future.

Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will stop that processing unless compelling legitimate grounds override your interests, rights, and freedoms, or the processing is needed for legal claims.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), particularly in the EU member state of your residence, workplace, or the alleged infringement. The supervisory authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

You can browse this website without providing information directly to us. Information marked as required during Gumroad checkout is needed to complete a purchase. Without it, the transaction and product delivery cannot take place.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

We may update this policy when the website, providers, or legal requirements change. The current version and its update date are always available on this page.