What this site knows about you.

MONISM Studio is an independent design practice based in Phnom Penh, Cambodia, operated by Khobi Tang as an individual rather than as a registered company. For the purposes of the General Data Protection Regulation, that individual is the data controller for anything described on this page.

Every request below — access, correction, deletion, or a complaint — goes to the same place: info@monism.studio. There is no department to be passed between. If you need the operator's full legal name for a formal request, ask and it will be given.

The brief form on the contact page asks for your name, your email address, your company or project name, a description of what you are building, which practice you think you need, a budget bracket, and how far along you are. The shorter signal form asks only for what you are working on and an email address.

None of it is required by us for any reason other than answering you. We do not buy, sell, rent or share enquiry data, and you will not be added to a mailing list you did not ask for — there isn't one.

This is the part most sites leave out, so it is stated plainly.

If you begin the brief form, type a valid email address, and then close the page without pressing send, what you had filled in at that point is emailed to us anyway, marked as incomplete. It does not happen if you never enter an address, if you leave within a few seconds, or if you only read the page.

It exists so that an enquiry interrupted halfway is not simply lost. But it does mean that abandoning the form is not the same as withdrawing it. If you would rather we did not keep something you started and left, write to us and it will be deleted — we will not ask why.

Microsoft Clarity runs on every page of this site. It records how the page is used: mouse movement, scrolling, clicks and taps, the pages visited and in what order, plus your approximate location, device, browser and referring site. Those recordings can be replayed as a session — a silent screen recording of your visit, with what you type in form fields masked. Microsoft is a separate company and processes this on its own servers.

We also record a small number of anonymous events about the brief form: that it was started, how many fields were filled, which field was reached last, and how many seconds were spent. These carry no content from the fields themselves.

Cloudflare serves this website and, like any web host, sees the IP address and request details of everyone who loads a page.

This site sets no cookies of its own. Every cookie below comes from Microsoft Clarity. There is no advertising pixel, no Google Analytics, no social media tracker, and the fonts are served from this domain rather than from Google.

Note the fourth row. Microsoft's own documentation describes MUID as identifying your browser across Microsoft sites and being used for advertising as well as analytics. We get no advertising data and run no ads, but the cookie is set all the same, and you should know that.

Blocking cookies in your browser stops Clarity from setting them, and nothing on this site breaks as a result. Microsoft explains the service at their Clarity documentation.

Four companies process data on our behalf, and all four are outside Cambodia.

Microsoft Clarity — analytics and session recording, as described above. Microsoft privacy statement.

Web3Forms — receives the contents of the brief and signal forms and relays them to our inbox. Web3Forms privacy policy.

Cal.com — the booking tool. Worth knowing: its script is loaded as soon as you start typing into the brief form, so that the booking step is instant if you reach it. It receives your name, email and chosen time only if you actually book. Cal.com privacy policy.

Cloudflare — hosting and content delivery. Cloudflare privacy policy.

Under the GDPR, every use of personal data needs a lawful basis. Ours are these.

Steps taken at your request before a contract. When you send a brief or book a call, handling your details is simply how we answer you.

Legitimate interests. Understanding how the site is used, keeping it working, preventing spam submissions, and following up an enquiry that was started and left. We have weighed this against your privacy; where you disagree with that balance, you can object — see section 09.

Consent, where the law requires it for analytics cookies, and which you may withdraw at any time.

Enquiries stay in our email for as long as the conversation is alive and for two years afterwards, because a project discussed once often returns. After that they are deleted. Records tied to paid work are kept longer where accounting or contract law requires it.

Analytics data is held by Microsoft under their own retention schedule, which we do not control.

Because we are in Cambodia and our processors are in the United States and Europe, your data crosses borders. Cambodia has not been assessed by the European Commission as providing adequate protection. Where personal data of people in the EEA or UK is transferred, it is handled under the processors' own transfer mechanisms — standard contractual clauses, in each case set out in the policies linked in section 06. If this concerns you, write to us before sending anything you would not want leaving the region.

If you are in the EEA or the UK, the GDPR gives you the right to ask for a copy of what we hold, to have it corrected, to have it deleted, to restrict how it is used, to receive it in a portable format, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting anything done beforehand.

We will answer within one month, and we will not charge you or ask you to justify the request. We extend the same treatment to everyone who writes to us, wherever they live, because operating two standards would be harder than operating one.

If you are unhappy with how we respond, you can complain to the data protection authority in your country. We would rather you told us first.

This site is for people commissioning design work. It is not directed at children, and we do not knowingly collect anything from anyone under 16. If you believe a child has sent us something, tell us and it will be deleted.

This policy describes a system, and systems change. If we add a tool that collects something new, this page is updated and the date at the top moves. There is no version history yet; if the change is material, anyone with an open enquiry will be told directly rather than left to notice a date.