What this site collects, and what it doesn’t.

m-lon.com.au is run by Miguel Gonzalez, a visual artist working as M-LON from Brookvale, NSW, Sydney, Australia. There is no company behind it and no staff — questions about anything on this page come straight to me at art.mlon@gmail.com.

• Nothing that identifies you. There is no analytics tool, no advertising network, no tracking pixel and no fingerprinting script on any page.
• No cookies are set by this site. Your light/dark preference is stored by your browser on your own device and is never sent to the server.
• The host keeps ordinary web server logs — IP address, browser user agent, the URL requested and the time — which are used to keep the site up and to look into abuse, and are not used to build a profile of you.

• The brief form is a Notion form. What you type — your name, email, project type, location, timeline, budget range, the brief itself and any links or images you attach — lands in my Notion workspace.
• Email sent to art.mlon@gmail.com arrives in a Google Workspace mailbox.
• I use that information to reply, quote and deliver the work. I don’t sell it, share it for advertising, or add anyone to a mailing list who didn’t ask to be on one.
• Enquiries are kept while a project is live and afterwards as a record of the commission. Ask me to delete yours and I will.

Four services see data on my behalf: Vercel hosts the site and serves it through its CDN, Notion stores the project pages, blog posts and incoming briefs, Google Workspace carries my email, and Google Cloud Run hosts the separate Fees Estimator app. Each runs under its own privacy policy and stores data on servers outside Australia, mostly in the United States — so sending a brief means that information is handled overseas.

The store on /store embeds and links to kayapa.com.au, run by Kayapa Creative Studio on Wix, and any purchase, payment and shipping detail you enter there is handled by them, not by me. Blog posts link out to Medium, LinkedIn and Blogspot, and the shop row links to Etsy, Gumroad and Notion. Once you follow one of those links you are on someone else’s site, under their privacy policy and their cookies.

Automated clients are welcome: crawling is allowed under /robots.txt, every page has a Markdown twin, and /openapi.json describes a read-only JSON API. None of those endpoints expose personal data — they serve the same published artwork, writing and studio information a visitor sees. There is no API for sending a message, so nothing anyone submits can be read back out of the site.

Email me to ask what I hold about you, to have it corrected, or to have it deleted, and I’ll do it. I aim to handle personal information in line with the Australian Privacy Principles. If something here doesn’t sit right, tell me first — I would much rather fix it directly.

This site isn’t directed at children, and I don’t knowingly collect personal information from anyone under 16. If a child has sent me something through the brief form, email me and I’ll remove it.

If what the site does with data changes, this page changes with it and the date below moves. There is no archive of earlier versions — the current page is the policy.