Privacy Policy

Effective date: 14 July 2026 · Version 1.2

Typegate ("Typegate", "we", "us") is a font-trial platform: type foundries upload fonts and share protected trial versions with designers through an embeddable CDN link, a public preview page and a Figma plugin. This policy explains what personal data we process when you use typegate.ch, dashboard.typegate.ch, fonts.typegate.ch or the Typegate Figma plugin (together, the "Service"), why we process it, and the rights you have.

1. Who is responsible

The controller of the personal data described in this policy is:

Typegate (typegate.ch)
United States
Email: hello@typegate.ch

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU/UK General Data Protection Regulation (GDPR).

2. What we do not do

• We do not sell or rent personal data.
• We do not run advertising or cross-site tracking.
• We do not use fingerprinting on our websites.
• We do not run analytics on typegate.ch unless you have given consent - see section 3.3.
• We do not make automated decisions with legal or similarly significant effects.

3. Data we process, and why

3.1 Foundry accounts (dashboard users)

• Email address – collected at signup; used to create and secure your account and to send transactional email (verification, password reset, account notices). Legal basis: performance of a contract.
• Password – stored only in salted, hashed form. We never store or see your plaintext password. Legal basis: performance of a contract.
• Foundry name – shown publicly on your font preview pages and in the Figma plugin. Legal basis: performance of a contract.
• Marketing email preference – a flag you can toggle in Profile Settings at any time. Product and marketing email is sent only while it is enabled; transactional and security email is sent regardless, because the Service cannot work without it. Legal basis: consent / legitimate interest in communicating with customers; you can opt out at any time.
• Session data – a random session token stored server-side and referenced by a session cookie (see the Cookie Policy). Sessions expire after a set period and can be revoked server-side. Legal basis: performance of a contract.
• Verification and reset tokens – short-lived, single-use random tokens used to confirm your email address or reset your password. Legal basis: performance of a contract.

3.2 Font files and content you upload

Font binaries you upload are stored in private object storage and served only as trial versions through tokenised CDN URLs. Font files are your content, not personal data about you, but to the extent any uploaded content contains personal data, we process it solely on your behalf – see our Data Processing Addendum.

3.3 Analytics on typegate.ch

The typegate.ch marketing site can use Microsoft Clarity, an analytics tool that records page views, clicks, scrolling and mouse movement, and produces session recordings and heatmaps so we can see how the site is used and improve it. Clarity sets the cookies listed in our Cookie Policy and may mask or exclude fields it detects as sensitive, but we do not deliberately direct it to record any font upload, account or dashboard page - it only runs on the public marketing site.

If you connect from the EU/EEA, the UK or Switzerland (determined from your connection's country, as resolved by our hosting provider Cloudflare), we show a cookie banner first and only load Clarity if you click Accept; if you click Reject, or don't respond, Clarity is never loaded. Legal basis: consent. Outside those jurisdictions, Clarity may load without a prior banner. Legal basis: legitimate interest in understanding and improving the marketing site, balanced against the limited, non-sensitive nature of this data. Wherever you are, you can withdraw consent or opt out at any time via the "Cookie preferences" link in the site footer, which stops Clarity even if it had already loaded.

3.4 Trial CDN usage (visitors of pages that embed a trial font)

When a web page embeds a Typegate trial font, the visitor's browser requests the trial stylesheet and font files from fonts.typegate.ch. We record only an aggregate daily counter per font and per embedding website domain (taken from the request's Referer/Origin header). We do not store IP addresses, user-agent strings, cookies or any per-visitor identifier for CDN requests. Our infrastructure provider (Cloudflare) processes IP addresses transiently as part of delivering the requests. Legal basis: legitimate interest in providing foundries with usage statistics and in operating and protecting the Service.

3.5 The Typegate Figma plugin (trial users)

When you use the Typegate plugin in Figma and press "Add to design", the plugin sends an import record to Typegate so that foundries' trial fonts can be protected against misuse and license evasion. That record includes:

• the font family, weight/style, axis values and font size used;
• the text you inserted (truncated to a reasonable length) and derived statistics (character, word and line counts, dominant script);
• your Figma account's public identity as exposed by Figma to plugins: stable user ID, display name and avatar image URL (Figma does not expose your email address to plugins, and we do not receive it);
• the name of the Figma file and page the text was placed in, and Figma's file key;
• your browser locale, timezone and a coarse device label (e.g. "macOS · Figma desktop");
• an approximate location (country, region, city) derived at the network edge from your IP address. The raw IP address itself is not stored.

Legal basis: our and our foundry customers' legitimate interest in monitoring trial use of licensed font software, preventing abuse, and enforcing trial license terms. This data is visible to Typegate staff only; it is not published.

3.6 Staff and administration

Administrative actions on the staff dashboard are authenticated through single sign-on and recorded in an audit log together with the acting staff member's email address. Legal basis: legitimate interest in the security and accountability of the Service.

3.7 Email delivery

Transactional email (verification, password reset, account notices) is delivered through our email provider, MailerSend, which processes your email address and message content on our behalf.

4. Who we share data with

We share personal data only with the service providers (processors) needed to run the Service - currently Cloudflare (hosting, storage, delivery, staff access control), MailerSend (transactional email) and, only if you accept analytics cookies, Microsoft (Clarity analytics on typegate.ch). The current list, including locations and safeguards, is maintained on our Subprocessor List. We may also disclose data where required by law or to establish, exercise or defend legal claims.

Note that Figma, Inc. is an independent platform, not our processor: your use of Figma itself is governed by Figma's own privacy policy.

5. International transfers

Typegate is based in the United States, and our infrastructure runs on Cloudflare's global edge network, so if you are located in Switzerland or the EEA, your data will be processed outside your country, including in the United States. Where that happens, transfers are protected by recognised safeguards – in particular the EU Standard Contractual Clauses (with the Swiss addendum) and, where applicable, the EU–US / Swiss–US Data Privacy Framework certifications of Typegate and our providers, including Microsoft.

6. How long we keep data

7. Your rights

Subject to the conditions of the FADP and GDPR, you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time (without affecting past processing).

Foundry account holders can delete their account directly in Profile Settings; this permanently removes the account, uploaded fonts and associated data as described above. For any other request – including requests concerning Figma plugin import records – contact hello@typegate.ch. We may need to verify your identity before acting on a request.

You also have the right to lodge a complaint with a supervisory authority – in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EEA, your local data protection authority.

8. Security

We protect personal data with technical and organisational measures appropriate to the risk, including TLS encryption in transit, encryption at rest on our storage providers, salted password hashing, hardened session cookies, strictly limited and audited staff access, and short-lived security tokens. Details are on our Security page.

9. Children

The Service is intended for professional use and not directed at children under 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced to account holders by email or in the dashboard. The effective date at the top tells you when this version took effect.

11. Contact

Questions about privacy at Typegate: hello@typegate.ch.