At a glance
- Font projects are stored on our server; document versions and some editor settings are stored in your browser.
- Import, OCR and PDF generation use server processing. AI requests are sent to OpenAI when you start an AI feature.
- Google Analytics starts only with your permission. You may refuse it or change your choice in Cookie settings.
This is a summary. The full terms appear below.
1. Controller and scope
This policy covers fontpainter.com, accounts, font creation, the document editor, paid access and support. Reading this policy or accepting the terms is not blanket consent to data processing or advertising. The service is not intended to identify people by their handwriting. Do not upload sensitive data or other people's information without a lawful basis.
The identified individual entrepreneur and AllHorizons Nexus LLC jointly manage accounts, uploaded files and site data to provide and protect FontPainter. Sales and payment records are handled by the seller of the relevant order. Requests can be addressed to either controller through the shared contact below; this does not limit your rights against either entity.
Data controllers: ИП Фатхуллов Р. Ш. · ИНН 505399287924 · ОГРНИП 321508100056857; AllHorizons Nexus LLC · Wyoming, USA · Filing ID 2023-001314437 · 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA. r.19997@gmail.com
2. Data we process
Depending on the features used: email, name, account and sign-in identifiers, registration information and protected password representation; glyph images, outlines, fonts, text, imported files and settings; order, payment status, amount, currency and access period; support messages; IP address, browser, device, language, session identifiers and errors. Card details are entered with the payment provider, not in the FontPainter editor.
3. Purposes and legal grounds
Account access, font storage, file processing and paid functionality are processed to provide the requested service and perform the contract. Accounting and legally required records are processed to comply with law. Security and abuse prevention rely on an applicable lawful basis, including legitimate interests where permitted and balanced against your rights. Optional analytics and advertising communications require separate consent where applicable; refusing them does not prevent core service use.
4. Documents, server processing and AI
Font projects are saved on the server. Document versions, presets and favourites may remain in your browser: clearing site storage or changing devices can remove access to them. Import, OCR and PDF generation send the selected materials to the server. Starting an AI feature sends your prompt and included text, document blocks or drawing data through our server to OpenAI. Check and minimise the material before sending; do not assume that external processing has no retention.
6. Recipients
Recipients depend on the feature: hosting and email providers; Google, VK or Yandex for the sign-in method you choose; Robokassa or Stripe for payments; OpenAI for AI requests; Google for permitted analytics. Providers may act as processors or independent controllers for their own operations. We disclose data to authorities only where legally required. Provider policies are linked below; request information about recipients for your account by email.
AllHorizons Nexus LLC is the seller for Stripe orders and receives the order and payment information needed to fulfil them. Its US registration does not determine where all site data is stored.
The site also loads a font from Google Fonts, which receives connection data such as your IP address independently of optional Google Analytics.
7. Retention and deletion
Account data is retained while necessary to provide access and meet legal obligations. Current font-source retention is 20 days after the last saved edit; source cleanup can leave the generated font and metadata. Download important files yourself. Browser records remain until you or the browser remove them. Payment records follow statutory retention; security logs and support correspondence are kept only as necessary for their purposes and claims. Hiding a project is not necessarily permanent deletion; request account and material deletion by email.
8. International processing
External providers may process data outside your country. Applicable transfer requirements remain separate from acceptance of these documents: they may require adequacy, contractual safeguards, other legal mechanisms or specific consent. Localisation rules may also apply. Ask for the destinations and safeguards relevant to your use.
The server, database and backups are located in Germany. Access by the controllers and processing by external providers may involve other countries. Hosting in Germany does not itself fulfil localisation requirements or authorise international transfers.
9. Your rights and requests
Email the contact below to request access, correction, deletion, restriction, portability, objection or withdrawal of consent, where the applicable law grants these rights. Include your account and request; never send passwords or full card details. We may request proportionate identity verification. Responses follow the applicable statutory deadline (under GDPR, normally one month). Withdrawal does not undo earlier lawful processing, and legal obligations may require limited continued retention. You may complain to your competent data protection authority or court, including an EEA authority, the ICO, ANPD, KVKK, the Ukrainian Ombudsman or Roskomnadzor where relevant. Where Belarus Law No. 99-Z applies, information on processing is normally supplied within five working days; withdrawal and other statutory requests have their applicable deadlines, including 15 days. Complaints may be lodged with the Belarus National Personal Data Protection Center. A formal application may require written or electronic-document form and a signature; support can explain the procedure without requesting excessive data.
10. Security and policy changes
We use access controls and protected password storage, but no service can guarantee absolute security. Keep your sign-in credentials private and report suspected misuse. Users lacking contractual capacity need the appropriate representative or permission; parental consent requirements depend on applicable law. The dated policy is updated when processing changes. New optional purposes requiring consent are not authorised merely by publishing an update.
11. United States residents
Where applicable US state law grants them, you may request access, correction, deletion, a copy, and opt out of sale, sharing or targeted advertising; you may also appeal a denied request and exercise rights without unlawful discrimination. Email the contact above; verification and statutory deadlines apply. Global Privacy Control and Do Not Track signals block optional Google Analytics in this browser. Google advertising signals and ad personalisation are disabled. This does not replace requests concerning other processing. Parents should contact us about data relating to children under 13. Where COPPA applies, verifiable parental consent is required before covered processing; a cookie choice or acceptance of these documents does not supply that consent.