Privacy and Cookies

Information we collect

Information you give us. When you send an enquiry, we collect your name, email address and the services you are interested in. You may also choose to provide your Telegram username, project description, links, a project file and preferred call date, time and time zone. We also keep relevant correspondence when we respond.

The form marks required fields. Without them, we may be unable to receive or respond to your enquiry. Optional information helps us understand your project; you do not have to provide it. A requested call time is a preference, not a confirmed booking.

Please send only information needed to discuss the project. Avoid passwords, payment-card details, identity documents, health information and other sensitive personal information. If a file contains another person's information, make sure you are entitled to share it with us and provide any required notice to that person. Contact us before sending material that requires special confidentiality arrangements.

Where we receive information about someone else through an enquiry, we assess whether we may use it and whether we must inform that person directly. The sender's responsibilities do not replace our own duties. If we receive information we do not need, including sensitive information or details about other people, we delete it and do not use it.

Technical and security information. Our hosting and security services process information such as IP address, browser and device details, request times and security signals to deliver the website, troubleshoot problems and help prevent abuse. Our form uses Cloudflare Turnstile to help distinguish legitimate requests from automated traffic.

Optional analytics information. If you allow analytics, Google Analytics 4 collects browser identifiers and information about visits and interactions, such as pages viewed, referral or campaign information, approximate location, device category, clicks, scroll depth and form steps or errors. We use this to understand which work interests visitors and where the website is difficult to use.

We do not send the names, email addresses, Telegram usernames, project descriptions, submitted links, attachment names or file contents from the form to Analytics. We measure interaction with form controls, not what you type into them. Analytics information can still be personal information even when it does not contain your name.

Why we use information

We use enquiry information to assess your request, reply, prepare a proposal and discuss a possible project. We use technical information to run and protect the website, and optional analytics to improve it. We may also keep limited records to comply with legal duties, respond to privacy requests and establish or defend legal claims.

Sending an enquiry does not subscribe you to a newsletter or authorise unrelated promotional messages.

The legal bases we rely on for these activities are:

Where another applicable law requires consent for a particular activity, we will obtain it before that activity. We do not treat consent to analytics as a condition of contacting us.

Who receives information

Only authorised team members and providers involved in the relevant activity should receive your information. Our enquiry workflow uses:

Enquiry information is distributed to the four team members' designated email accounts and our internal Telegram group. This internal distribution can happen even if you do not provide a Telegram username. A private attachment link does not make the enquiry text in those notifications disappear or restrict it to Drive.

Providers may also process some information for their own purposes under their applicable terms. For example, Cloudflare describes its separate use of Turnstile security signals to improve bot detection. Each provider publishes its own privacy policy.

We may disclose relevant information to professional advisers or public authorities where necessary and lawful. We do not sell personal information or use it for advertising.

International processing and transfers

Our team works from Peru and the United States. Our team and service providers may access or process your information in other countries, whose privacy laws may differ from those where you live.

Destinations: our team accesses information from Peru and the United States. Cloudflare delivers the website through its global network. Google (Gmail, Sheets, Drive and Analytics) primarily stores data in the United States. Make processes data in the European Union or the United States. Telegram stores messages in data centres in several countries. We rely on the contractual and technical safeguards these providers offer for international transfers, described in their own privacy policies (see Who receives information).

Where applicable law requires a transfer safeguard, the relevant arrangement must be in place for that transfer. Depending on the route and law, this may involve an applicable adequacy decision or approved contractual safeguards with any necessary additional measures. Contact [email protected] for information about the arrangements relevant to your data.

Using this website is not, by itself, consent to an international transfer that would otherwise be unlawful.

How long we keep information

We keep personal information for the relevant purpose and applicable legal obligations, then delete it or irreversibly anonymise it. We keep information for these periods:

If an enquiry becomes a project, we explain the relevant client-record retention in the project documentation. Limited information may need to be retained longer for a legal obligation or dispute. Deleted items can remain in our providers' trash or backup systems for a short time, usually up to 30 days, before they are permanently removed.

GA4's user/event retention setting does not set the lifetime of its cookies and does not automatically delete standard aggregated reports or separately exported data.

Security and incident handling

We use technical and organisational safeguards appropriate to the information and risks, including restricted access for authorised team members. If a personal-data breach occurs, we assess it, take appropriate steps to address it and notify affected people and authorities where the law requires. No internet service can guarantee absolute security; this does not limit your legal rights or our responsibilities.

Your choices and rights

Email [email protected] to ask about your information or make a privacy request. Explain what you would like us to do. We may ask for proportionate information to verify your identity; please do not send identity documents unless we explain why they are needed.

Depending on the law that applies, you may be entitled to obtain access or a copy, correct information, request deletion, restrict or object to certain uses, receive portable data, and withdraw consent. Withdrawal does not invalidate processing carried out lawfully before it. Some rights have exceptions, which we will explain where relevant. We will respond within 30 days.

• You can ask someone to act for you; we may check that they are authorised.
• If we decline a request, we will explain why, and you can ask us to review that decision.
• We will not treat you differently for exercising your privacy rights.
• You can complain to the data protection authority where you live, work or think a problem occurred. You do not have to contact us first.

We do not use enquiry or analytics data to make solely automated decisions with legal or similarly significant effects. Automated anti-spam checks can reject a form submission; you can contact us by email if you cannot submit it.

Cookies and your analytics choice

Cookies and similar storage help websites remember information in your browser. Necessary storage supports the website, the contact form and your cookie choice. Optional analytics helps us understand how the website is used.

Google Analytics only runs after you press Accept cookies in the cookie message. If you do not press it, or you close the message with the ×, analytics stays off and the message appears again on your next visit. You can always browse the website and send an enquiry without accepting.

Your acceptance is saved in this browser only. It does not follow you to other browsers or devices. To withdraw it, clear this site's cookies and storage in your browser settings; analytics stops and the cookie message appears again. Withdrawing does not erase records already collected. You can ask us to delete them as explained under Your choices and rights.

Cookies and storage we use:

You can also delete or block cookies and storage in your browser settings. This can remove your saved choices or affect some features.

Children, external links and updates

This website presents professional creative services and is not directed to children. We do not knowingly seek children's personal information. Please contact us if you believe a child has supplied it so we can assess and address it under applicable law.

If you follow a link to another website or contact us through an external platform, that service's own privacy practices also apply.

We will update this notice when our practices change and show the latest date above. Where required, we will provide additional notice or obtain permission before a new use. Contact [email protected] with any privacy question.

Who is responsible for your information?

mono.creative is not a separate company. It is a trading name that a small group of independent designers use together when they work with clients as one studio, and it is the name you see on this website, in our emails and in our proposals. For the purposes of this notice, the people who use that name, and who are therefore responsible for the personal information it describes, are Gabriel Luyo, Alessandra Serruto, Romina Veliz and David Chang. They work remotely from Lima, Peru and Los Angeles, United States, and follow the same practices for handling enquiries, project files and website data.

• Privacy contact: [email protected].

Together, these four people decide why and how the information covered by this notice is used. You can contact any of us through the address above.