YoFont

GDPR overview

GDPR handling is documented but partial. The privacy policy (effective 26 August 2026) states its legal bases - contract performance, legal obligation, legitimate interest, consent - and lists rights of access, rectification, erasure, withdrawal of marketing consent, objection and restriction, plus complaints to an EU or UK supervisory authority, the California Privacy Protection Agency or the California Attorney General. Requests are answered within 45 days, 30 under GDPR, after identity verification. Traffic is encrypted, passwords hashed, hosting exclusively United States, with transfers acknowledged. Generated font files are declared not to be personal data (Art. 4(1)) and escape erasure, under Art. 17(3)(b) and (e). Absent: no Article 27 EU representative, no named DPO, no GDPR email address, no DPA. Rights are exercised only through the support form or self-service deletion, and the site never calls itself GDPR compliant.

Who owns the data?

Yo Space LLC owns everything. Under the Terms (section 5) and the License Terms (section 4), the source code, design elements, documentation and all materials generated or uploaded by users - prompts, images, previews and font files - are the exclusive property of Yo Space LLC from the moment of creation. Users acquire no ownership rights: they receive only a limited, revocable licence under their active plan. That ownership survives account closure, deletion, suspension or expiry (5.1 / 4.1), and users waive moral rights, attribution, integrity and any remuneration (5.3 / 4.3). Pre-existing work uploaded as a reference stays the user's, subject to a usage licence granted to Yo Space LLC (5.4 / 4.4).

Reuse rights

YoFont collects account data (email, password hash, social login identifiers), usage data (prompts, generated fonts, metadata, API requests, IP address, browser and device data), payment data handled by Stripe, and support correspondence. The stated purposes are providing and improving the service, security and authentication, billing through third-party providers, transactional messages and, on explicit consent only, marketing. Generated materials may be stored temporarily for technical optimisation and auditing. Three third parties are named: Stripe for payments, SendGrid for transactional email and Cloudflare for CDN and network protection, all described as certified under the EU-US Data Privacy Framework. Glyph generation and retouching run through third-party AI image providers, which are never named; they receive the prompt and the reference image for the sole purpose of producing the result, without account identifiers. In the Figma plugin the reference image is sent only on an explicit action, and a reference image passed to the API by URL is not stored. Technical logs (endpoint, plugin version, timestamp, account ID, IP) serve rate limiting, abuse prevention and support, and are stated never to be used for advertising or profiling. On reuse: the user may only use generated fonts within the scope of the active plan, commercial use starting at Pro or through a one-off licence at 5 USD per year per font, and sharing, reselling or redistributing is prohibited. The policy never says whether prompts or fonts train YoFont's own models, and no opt-out is documented.

Data retention & training

Hosting summary

All data is hosted in the United States. The privacy policy states plainly that data is hosted on compliant infrastructure in the United States (section 7), and section 9 adds that information may be transferred to and processed in the United States, use of the service constituting acceptance of that transfer. Cloudflare provides the CDN and network protection; the resolved IP address, 104.21.64.219, is a Cloudflare anycast node located in the United States. Transactional email runs through SendGrid and payments through Stripe, both described, along with Cloudflare, as certified under the EU-US Data Privacy Framework. No European region is offered and there is no data residency option of any kind. The hosting country of the third-party AI image generation providers used for glyph creation is never stated, and those providers are never named. For a European buyer this means US jurisdiction, US infrastructure, no Article 27 representative and no data processing agreement on offer.