Privacy Policy

01The short version

02What is collected, and why

Email

To send your download link and receipt, and to answer you. It is also how you prove a purchase was yours.

Order

What you bought, what you paid, in which currency, and when. Required for accounting and for the tax that was charged.

License key

For TypeKit only, plus how many machines it has been activated on, so the three-machine limit works and so I can reset it when you ask.

Consent

Whether you ticked the box at checkout asking for your download to start immediately. Recorded per order, because that is what a refund conversation turns on.

Country

Which currency to show you. Read from your connection as the page loads, and never stored.

Two things are worth being precise about rather than glossing. Stripe asks for your name and billing address at checkout, because it needs them to work out the tax. That stays with Stripe — it is never sent to this store and there is no column for it here. And your IP address is seen by Cloudflare in the course of delivering the page to you, as it must be by any web host anywhere; I never store it, and the only thing the store does with it is read the country it implies, in order to pick a currency.

Beyond that: no card details, no record of which pages you looked at, and nothing about you bought or gathered from anywhere else. If you have not bought anything and not joined the drop list, I hold nothing about you at all.

Why I am allowed to hold each of these, in the GDPR’s own terms:

Your order

Performance of our contract — Art. 6(1)(b). You cannot buy a download without me being able to send it to you, so this part is not optional: no email, no order.

License keys

Performance of the same contract. The activation count exists to make the three-machine limit work, which is a term of the license you bought.

Invoices and accounting

A legal obligation — Art. 6(1)(c). Spanish tax and commercial law require the records to exist for a set number of years, so this is not mine to delete on request.

The drop list

Your consent — Art. 6(1)(a). Entirely optional, and you can take it back at any time without affecting anything else.

There is no profiling here and no automated decision-making. Nothing about you is scored, ranked or decided by a machine.

03Who else sees it

Three companies work for me, on my instructions and nothing else:

• Supabase — the database holding orders, entitlements and license keys, hosted in the European Union (Central EU, Frankfurt).
• Resend — sends the receipt and download link.
• Cloudflare — serves the site and stores the product files.

The payment side is different, and the difference matters to you rather than being a technicality. Sold through Link, LLC and Stripe are not working for me there — they decide for themselves what they do with payment and identity data, as the seller and the payment processor. They hold your card details, your name and your billing address; I never receive any of it. For anything to do with that data — a copy of it, a correction, a deletion — they are the ones to ask, not me, and I will say so rather than pretend I can act on it. Link’s privacy center · Stripe’s privacy policy.

What comes back to me from them is the order: an email address, what was bought, what was paid. That part I am responsible for, and everything else on this page is about it.

Some of this leaves Europe. Several of these companies are based in the United States or process data there. Where that happens the transfer relies either on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, where the company is certified under it, or on the Commission’s Standard Contractual Clauses. Ask me which applies to a particular company and I will tell you, and send you a copy of the clauses.

Nothing is sold, rented, or shared with anyone else. There is no advertising network here and there never will be.

04Cookies, and what your browser keeps

No cookies. No analytics, no advertising, no tracking of any kind.

There is no consent banner, and the reason is narrower than “we don’t use cookies”. Spanish law here is not about cookies at all — it covers anything stored on your device, whatever the technology. What it exempts is storage that is strictly necessary for a service you actually asked for, which is what all four of the things below are: a basket you filled, a currency you picked, and two records of something you closed so it would not reappear at you. Nothing is stored from a guess; the currency is only remembered once you choose one yourself.

So the site does keep four small things in your own browser. None of them identifies you, none of them is read by anyone else, and none of them ever leaves your machine:

• Your installation queue — which products you have added, so it survives a reload.
• Your currency choice — only if you pick one yourself, so you are not asked twice.
• Two “you have seen this” markers — one for the short note explaining what the queue is, one for the drop-list panel, so neither reappears at you on every visit.

Clearing your browser data removes all four, and everything here works exactly the same afterwards.

05How long it is kept

Orders, invoices and accounting records: six years, counted from the last entry in the books. That is what the Spanish Commercial Code requires of any business, and tax law sets its own overlapping period on top. It is not my choice and I cannot shorten it for an individual order.

If you ask me to delete data that is inside that period, what happens is that it is blocked rather than erased: taken out of ordinary use, kept only so it can be produced to a tax authority or a court, and then deleted at the end. Spanish data-protection law asks for exactly that, and I would rather tell you now than have it sound like a refusal later.

Entitlements and license keys are kept while they are useful to you: they are how you re-download something you bought two years ago, and how I reset your key when you change computer. Delete them and you lose access to what you paid for.

The drop list keeps your address only until you unsubscribe.

06Your rights, and how to use them

Under the GDPR you can ask me to give you a copy of everything held about you, correct it, delete it, restrict what I do with it, or hand it over in a portable form. You can object to processing based on my legitimate interests. And if you joined the drop list, you can withdraw that consent whenever you like — every email has an unsubscribe link, and withdrawing does not undo anything done before it or affect your purchases.

I will answer within one month. If a request is genuinely complicated I can extend that, but I have to tell you why and I will.

Email support@augustovnd.com from the address you used. There is no form and no verification hoop — that address is the identity here.

Two honest limits. Orders inside the legal retention period cannot be deleted, only anonymized at the end of it. And deleting your entitlements means losing your downloads and license — I will say so before doing it, not after.

If you think I have handled your data badly, you can complain to the Spanish data protection authority (AEPD) or to the one in your own country.