Privacy Policy

This policy explains how Infilimits Technologies Private Limited ("we") handles personal data in FontPreview. We are the controller (data fiduciary) for account data about our customers. For data about visitors to our customers' websites, processed when those sites show our widgets, we act as a processor on our customer's behalf.

1. What we collect

Account holders and team members

• Account details: name, email address, company name (optional), a one-way hash of your password, plan and role.
• Content you upload: font files and their metadata, widget settings, watermark settings and logos, collections and webhook endpoints.
• Billing: subscription status, plan and identifiers from Stripe or Shopify. Card details are entered on Stripe's pages and go directly to Stripe; we never receive or store full card numbers.
• Usage and security data: sign-in times, IP address, browser details, API key usage counts, request logs and error logs.

Visitors to sites that embed our widgets

• The text typed into a widget, the page's origin, IP address and browser details, as part of each render request.
• We use the IP address for rate limiting and abuse prevention, and rendered images are cached for up to one hour. We don't set cookies on visitors, build profiles or track them across sites.

2. Why we use it (legal bases)

• To provide the Service and support you (contract).
• To bill you and keep records (contract, legal obligation).
• To secure the Service, prevent abuse and enforce our policies (legitimate interests).
• To send service emails such as verification, password reset, invitations and billing notices (contract). We don't send marketing email without consent.

3. Cookies

The dashboard sets one strictly necessary cookie, fp_session, which keeps you signed in. It is HttpOnly, Secure and lasts up to 30 days or until you sign out. Sign-up and password-reset forms use Cloudflare Turnstile to block bots. We use no advertising or analytics cookies, so we don't show a cookie banner.

4. Who we share it with

We use these subprocessors:

• Cloudflare, Inc.: hosting, compute, databases, private file storage (R2), caching, email delivery, bot protection (Turnstile) and usage analytics.
• Stripe, Inc.: payment processing for subscriptions (checkout, payment methods, invoices and receipts).
• Shopify: billing and app hosting, only if you install our Shopify app.

We don't sell personal data or share it for cross-context behavioural advertising. We may disclose data if required by law or to protect rights and safety.

5. International transfers

We are based in India. Our primary database and file storage are hosted by Cloudflare in the United States, and our providers may process data in other countries. Where required, transfers rely on safeguards such as the EU Standard Contractual Clauses.

6. How long we keep it

• Account data and content: while your account is open.
• Webhook delivery logs: 30 days.
• Rendered image caches: up to 1 hour.
• Daily usage totals: for your plan's analytics history (up to one year). Detailed operational metrics: about 90 days.
• After account deletion, residual copies in backups and logs are removed within 30 days. Billing records are kept as long as tax law requires.

7. Your rights

Depending on where you live (for example under India's Digital Personal Data Protection Act 2023, the GDPR, UK GDPR or the California Consumer Privacy Act), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can update your details and delete your account yourself in the dashboard. For anything else, email [email protected]. We won't discriminate against you for exercising these rights. You may also complain to your local data protection authority.

If you are a visitor to a site that uses our widgets, please contact that site first; we'll help them respond.

8. Grievance officer

Questions or complaints about how we handle personal data can be sent to our grievance officer at [email protected]. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

9. Security

Data is encrypted in transit; passwords and API keys are stored only as hashes; font files are kept in private storage with no public URL. No system is perfectly secure, and we'll notify you of a breach affecting your data as the law requires.

10. Children

The Service is for people aged 18 and over. We don't knowingly collect personal data from children; if you believe a child has given us data, contact us and we'll delete it.

11. Changes

We'll post updates here with a new date and notify account holders of material changes by email.

12. Contact

Infilimits Technologies Private Limited, India. [email protected]