Refont

GDPR overview

There is none to speak of. The words GDPR and General Data Protection Regulation appear nowhere on the site — not in the privacy policy, not in the terms, not in the page markup. The policy does address European users, but it points to Directive 95/46/EEC and the Privacy and Electronic Communications (EC Directive) Regulations 2003, both superseded in 2018. Residents of the European Union or Australia are granted two rights only: access to a copy of their data, possibly for a statutory fee, and correction of inaccurate data. Erasure, portability and objection are not mentioned. No Article 27 representative is named, no data protection officer, no data processing agreement and no subprocessor list. Requests must go to the contact details on the site, which amount to a single Gmail address.

Who owns the data?

Assets generated with purchased credits come with a full commercial licence, and logos and edited images are described as free for personal or commercial use. Responsibility, however, sits entirely with the user: the vendor requires that prompts, uploads and outputs infringe no third-party rights, and forbids commercial use of celebrities or protected characters. Purchased credits stay in the account indefinitely; free credits can be expired or cleared at the vendor's sole discretion without notice. One clause deserves attention — anything posted in the public areas of the site may be collected, used and disclosed by the vendor or by third parties without restriction.

Reuse rights

Yes, within limits. Images produced with purchased credits carry a full commercial licence and need no further permission: they can go into branding, marketing, packaging and store displays. Logos from the Calligraphy Logo Maker and images from the Edit Text in Image tool are both presented as royalty-free for personal or commercial projects, and the homepage extends commercial use of generated lettering “under fair-use terms”. Two caveats temper this. The user alone must ensure that prompts and outputs infringe no third-party trademark or intellectual property, and celebrities or protected characters are off-limits commercially. Separately, section 3 of the terms grants only a personal, non-commercial licence over the site's own materials — a different object from the assets you generate, but worth reading before building a brand on the output.

Data retention & training

Hosting summary

The privacy policy commits to one sentence on the subject: data collected will be stored on servers in the United States or in other territories. No hosting provider is named, no European region is offered, and users are given no choice of location. The same section warns that countries outside your own may not offer equivalent protection, without naming any transfer mechanism — no standard contractual clauses, no adequacy decision. On security, the policy claims firewalls and physically secure data facilities, with the usual caveat that no system is perfect. Technically, the domain resolves behind Cloudflare (anycast address 172.67.192.86, AS13335) and assets are served from cdn.refont.ai. That is an observation about the infrastructure rather than a statement by the vendor, and anycast routing says nothing about where data ultimately rests. For a European user, the practical position is that data leaves the EU by default, bound for a jurisdiction the vendor names loosely and a company it does not name at all.