Privacy Policy

In short

Who is responsible

Open Studio is run by Marco Lüthi, the controller responsible for data processing under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Marco Lüthi
Gutstrasse 172, 8055 Zürich, Switzerland
hi@luthi-mar.co

Making a card

Your cards are drawn, kept and turned into PDFs in your browser. They’re saved in your browser’s storage (IndexedDB) so that you can carry on where you left off, and they aren’t sent to us: we can’t read them. The type engine runs in your browser too. Deleting a card from “Your cards” removes it.

Buying fonts

When you go to checkout, your browser sends this website’s server the fonts you chose: each typeface’s settings and its name, which includes the name on your card. We pass them to Stripe, which shows the names on the checkout and your receipt, and keeps the settings with the purchase so that the fonts can be made from them.

Checkout happens on Stripe’s own pages. Stripe receives your email address, your payment details and whatever else its checkout asks for. We never see your full card number. Stripe’s own privacy policy applies to what it collects there. Open Studio is sold through the Stripe account of our font site, Typomat, which only Marco Lüthi can open.

We don’t keep a database of sales: Stripe’s record of your purchase is the record. When you’ve paid, our server makes your fonts from it, and Resend, Inc. emails them to you. The download link in that email, and on the page you land on, works by asking Stripe about that purchase. We only email you to deliver what you bought. There’s no mailing list.

In your browser

Open Studio sets no cookies, and has no analytics, advertising or tracking. Your cards are kept in your browser’s storage, as above. The typefaces, the type engine and everything else on the pages come from this website, so pages don’t call anyone else’s servers. Links to Typomat only open when you click them.

Server logs

This website is hosted by Vercel Inc., which keeps short-lived server logs of requests, as for any website, which include your internet address.

How long we keep things

We keep nothing about you ourselves. Stripe keeps the record of a purchase, and Resend keeps a record of the emails it sends, each for as long as their own policies say. If you’ve bought fonts, the accounting records of the sale have to be kept for as long as Swiss law requires, currently ten years. Write to hi@luthi-mar.co if you’d like anything else deleted that we can delete.

Legal basis

Where the GDPR applies, taking payment and delivering your fonts rest on providing what you asked for (Art. 6(1)(b) GDPR). Keeping accounting records rests on a legal obligation (Art. 6(1)(c) GDPR). Keeping the site secure rests on legitimate interest (Art. 6(1)(f) GDPR). Under the Swiss FADP, we process personal data only as described here and in line with its principles.

Your rights

You can ask for access to your personal data, and to have it corrected or deleted. You can object to or restrict processing, and ask for your data in a portable form. As there are no accounts, tell us the email address you paid with, so that we can find your purchase. Write to hi@luthi-mar.co.

You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and in the EU the data protection authority of your country.

International transfers

Vercel is based in the United States. Vercel, Stripe and Resend may process data outside Switzerland and the EU, under safeguards such as standard contractual clauses and the Data Privacy Framework.

Children

Open Studio is made for people and businesses. It isn’t directed at children and doesn’t knowingly collect data from them.

Changes to this policy

If Open Studio starts handling data differently, this page will be updated before the change ships, and the date at the top will change. See also our Terms of Use.