I am required to create the design of a website for my institution. I am not a designer or webmaster, and I am very badly informed in this area. I am already a bit stuck in the font selection. 

The project budget does not allow the purchase of commercial font licences. A quick web search showed that a very convenient way to use free fonts would be to use the Google web font service. Another option would be self-hosting, but as far as I understand, it is 1) somewhat more challenging technically, and 2) more limited, as there are fonts which can be used for free through Google, but their licence does not cover that we redistribute them through hosting. (If this is not true, please correct me). 

We are an European institution with high requirements for privacy. The web site in question has an area with sensitive data (R&D know-how not yet protected by patents) and we may extend it to also save some personal data of users in the future. So we are very wary of embedding external services. 

What are the privacy risks connected to the use of the Google web font API? How much access will Google have to our data if we use their font service? Is it feasible to use their fonts if we wish to keep part of our website secured against unauthorized access? Or am I limited to self-hosting open source fonts?