Privacy Policy
Last updated: [DATE]
This policy covers the hosted Typefold service at app.typefold.dev and this website. If you
run Typefold on your own servers, your installation sends us nothing beyond license checks, and
this policy covers only those.
Who we are
Section titled “Who we are”Runecode OÜ (registry code [REGISTRY CODE]), [ADDRESS], Estonia, is the controller for the personal data described here. Contact us at [email protected].
For the content you put into the service, such as templates and the data you render, your organization is the controller and we process it on its behalf, under our Data Processing Terms.
What we collect and why
Section titled “What we collect and why”| Data | Why | Legal basis |
|---|---|---|
| Email address, name, and your workspace memberships and roles | To create your account, sign you in with email codes, and send invitations and service notices | Contract |
| Two-factor secrets and recovery codes, if you turn them on | To protect your account | Contract |
| Sessions, with the IP address and browser they came from | To keep you signed in and protect your account | Contract |
| A record of actions in your workspace (who did what, when) | So workspace owners can see changes, and to investigate problems | Legitimate interest |
| Usage counts per workspace (documents rendered, storage used) | To apply plan limits | Contract |
| Server logs, with IP addresses and request details | To run, secure and fix the service, and to stop abuse | Legitimate interest |
| Company name and email, if you start a self-hosted license or trial | To issue and check the license | Contract |
| Your workspace’s plan, and the ID Polar gives its subscription | To give a paid plan its limits | Contract |
| Your content: templates, assets, render data and the documents produced | To provide the service | On your organization’s behalf |
We do not sell personal data, do not use it for advertising, and do not use your content to train AI models.
Cookies
Section titled “Cookies”Studio uses cookies only for signing in: one keeps you signed in, and short-lived ones protect two-factor and Microsoft sign-in. They are needed for the service to work, so we don’t ask for consent. Studio also saves your theme and editor layout in your browser’s local storage. We use no analytics or advertising cookies.
Who else processes it
Section titled “Who else processes it”We use these providers to run the service. Each processes data only on our instructions.
| Provider | What for | Where |
|---|---|---|
| netcup GmbH | The servers that run the service and its database | Austria |
| Hetzner Online GmbH | File storage and backups | Germany |
| [Backblaze, Inc.] | Off-site copies of the backups (the database encrypted) and of files | [EU (Netherlands)] |
| Resend | Sending sign-in codes, invitations and notices | [EU region] |
| Cloudflare | Serving this website, and passing connections to the service on to our servers, without storing them | Global network |
| Anthropic | Only when you use an AI feature, such as creating a template from a PDF: the file you give it | United States |
| Functional Software (Sentry) | Error tracking: error messages, stack traces and page paths, without user details or request contents | EU (Germany) |
Where a provider is outside the EU, we rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. We may also disclose data when the law requires it.
Payments. Paid plans and self-hosted licenses are sold by [Polar Software, Inc.] (United States) as merchant of record. When you buy, you give your name, email, billing address, tax ID and card details to Polar, which processes them as a controller under [its own privacy policy]. We see your name, email, billing address and what you bought, and we never see your card details. We tell Polar which workspace a purchase is for, by an ID; Polar gets none of your content.
How long we keep it
Section titled “How long we keep it”- Account data: until you delete your account.
- Workspace content: until you delete it or shut down the workspace. A deleted template’s published versions are deleted 30 days after the template; its draft history stays until the workspace is shut down.
- Renders: once a render has finished, its input data and the document produced are deleted 30 days after the render was created.
- Server logs: 30 days.
- Emails we send you: our email provider keeps them for 30 days, also after you delete your account.
- Self-hosted licenses: the company name and email stay with the license after you delete your account, for as long as the license can be used. Ask us to delete them sooner.
- Purchases: Polar keeps invoices and payment records for as long as tax law requires.
- Backups: database backups and earlier versions of files are kept for 30 days. Data you delete stays in them until they expire. If a backup is ever restored, deleted accounts and workspaces are deleted again.
Your rights
Section titled “Your rights”You can ask us to access, correct, delete, restrict or port your personal data, and you can object to processing based on legitimate interest. You can delete your account yourself in Studio under Account security. For anything else, email [email protected]. We answer within one month.
If your data is in a customer’s workspace content, contact that customer first; we help them answer.
You can also complain to a data protection authority, such as the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the one where you live.
Security
Section titled “Security”Connections to the service use HTTPS. Database backups are encrypted. Access keys you save for a storage destination are encrypted at rest, used only to upload your workspace’s renders to it, never shown again, and deleted with the destination or the workspace. Each workspace’s data is kept apart from other workspaces’. If a breach affects your personal data, we tell you and the authorities as the law requires.
Changes
Section titled “Changes”We tell you by email or in Studio before a change to this policy that affects you.