Privacy Policy

1. Controller

2. Website hosting and server logs

This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, California 94105, USA (“Netlify”). When you access the website, Netlify and its infrastructure providers process technical request data needed to deliver and protect the site. This can include your IP address, date and time of access, requested page or file, referrer URL, browser and operating-system information, HTTP status, and the amount of data transferred.

Processing is necessary to provide a stable and secure website. The legal basis is Article 6(1)(f) GDPR; the legitimate interests are reliable delivery, security, abuse prevention, and troubleshooting. Where processing is necessary to provide a service you expressly request, Article 6(1)(b) GDPR also applies.

We do not keep separate website access logs unless needed to investigate a technical or security incident. Hosting data is retained only for as long as required for delivery, security, troubleshooting, or applicable legal obligations. Netlify may process data in the United States and other countries. Netlify states that it uses the EU–US Data Privacy Framework and, where appropriate, the European Commission’s Standard Contractual Clauses for international transfers. More information is available in Netlify’s Privacy Statement.

3. Local session storage and checkout URLs

The site uses your browser’s session storage to preserve short-lived interface state, such as transitions between the typeface overview and detail pages. This information remains in your browser for the current tab session and is removed when the session ends. It is not used for advertising or cross-site tracking.

This storage is strictly necessary to provide the interface requested by you and therefore does not require consent under Section 25(2)(2) TDDDG. If any associated data is personal, processing is based on Article 6(1)(f) GDPR and our legitimate interest in a functional, consistent interface.

License selections—and, when purchasing for a client, the client or company name—can temporarily appear in the checkout page URL so that a configuration can be restored after navigating back or cancelling checkout. If that URL is requested from the server, it may also appear in the technical request data described above. Please enter only the business name required for the license.

4. Purchases, payment, and license fulfilment

When you configure a license, we process the selected typeface, buyer type, company size tier, social-reach tier, license type and, where applicable, the client or company name. To start and fulfil a purchase, this information is sent to our server-side checkout functions and to Stripe as transaction metadata.

Payment is completed on a Stripe-hosted checkout page. Stripe collects the information needed for the transaction, which can include your name, email address, billing address, payment-method details, device and network information, and fraud prevention data. Metriculous does not receive your complete card or bank-account details.

The integration uses Stripe Managed Payments. For these transactions, Sold through Link, LLC, a Stripe affiliate, acts as merchant of record and handles payment, indirect-tax compliance, fraud prevention, disputes, receipts, and transaction-level customer support. Other Stripe entities may process data depending on your location and payment method. Stripe acts as an independent controller for some processing and as a processor for Metriculous where applicable.

After a successful payment, we receive and store an order record containing the Stripe Checkout Session ID, Stripe event and payment references, customer email, amount and currency, purchased typeface and license, licensed party, and fulfilment time. The record is stored using Netlify Blobs. It is used to verify payment, deliver the files, support the customer, prevent duplicate fulfilment, keep accounting records, and establish or defend legal claims. Signed download links expire after seven days.

Processing needed to initiate and perform the purchase is based on Article 6(1)(b) GDPR. Processing needed for tax, commercial, and accounting records is based on Article 6(1)(c) GDPR. Fraud prevention, IT security, customer support, and the establishment or defence of legal claims are based on Article 6(1)(f) GDPR.

Stripe may transfer personal data internationally using the safeguards described in its legal documentation, including adequacy decisions and Standard Contractual Clauses where applicable. Details are available in Stripe’s Privacy Policy and Data Processing Agreement.

5. Contact by email

If you contact Metriculous by email, we process your email address, your message, any information you choose to provide, and the technical message data needed to deliver and answer it. If your request concerns a contract or steps before entering a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR and our legitimate interest in responding to you and managing business correspondence.

Correspondence is deleted when the matter has been conclusively dealt with, unless it must be retained for contractual, tax, commercial-law, security, or legal-claims purposes.

6. External links

The site contains ordinary links to external services, including Instagram. No Instagram content is embedded on this website. Data is transmitted to the external provider only when you choose to follow such a link; the provider’s own privacy terms then apply.

7. Retention

We keep personal data only for as long as needed for the purpose for which it was collected. Purchase and accounting records are retained for the statutory periods applicable under German tax and commercial law. Other data is deleted when it is no longer needed, unless a longer period is required by law or justified for the establishment, exercise, or defence of legal claims. Data subject to a preservation obligation is restricted to that purpose until the obligation ends.

8. Your rights

Subject to the conditions of the GDPR, you have the right to:

• request access to your personal data (Article 15 GDPR);
• request correction of inaccurate data (Article 16 GDPR);
• request erasure or restriction of processing (Articles 17 and 18 GDPR);
• receive data you provided in a portable format (Article 20 GDPR); and
• object to processing based on legitimate interests (Article 21 GDPR).

To exercise these rights, email info@metriculous.de. You also have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for Metriculous is the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden, Germany.

9. Automated decisions

Metriculous does not itself make decisions based solely on automated processing that produce legal or similarly significant effects. Stripe may use automated systems for fraud prevention and payment-risk assessment under its own privacy information.

10. Changes to this policy

This policy may be updated when the website, service providers, or legal requirements change. The current version is always published on this page.