Our Privacy Policy

This website is operated by Aidan McFarlane, based in Fukuoka, Japan. This notice applies to information handled through aidanmdesign.xyz, its hosted aidan-mcfarlane-portfolio.zellibot.chatgpt.site address, and the English, Japanese and Korean pages on those domains.

A business or service address for a statutory privacy request will be provided without delay through the Contact page. Do not use that route for unsolicited marketing.

The site is a professional portfolio for project, recruitment and collaboration enquiries. It does not sell products, run a mailing list or make automated hiring decisions.

• Enquiry information: name, email address, subject and message, plus any optional organisation, website, project or role type, markets, languages, deliverables and timing you provide.
• Enquiry context: page and action that led to the form, plus a general landing-page category if analytics is allowed. New enquiries do not collect campaign query parameters or full referring URLs. Enquiry contents are not intentionally sent to analytics.
• Security information: Cloudflare Turnstile processes technical signals used to distinguish legitimate visitors from automated abuse. The site receives a short-lived verification token. The application does not store the raw IP address in the enquiry record, although service providers may keep standard technical logs under their own policies.
• Site preferences: theme, language, motion/effects and privacy choices are stored on your device so the interface can remember your choice.
• Optional measurement: if you allow analytics, Google Analytics receives public portfolio page paths and titles, referring website origins, approximate location, browser, device and named interaction information through Google Tag Manager.

Where a legal basis is required, enquiry handling is based on steps you request before a possible contract and legitimate interests in responding. Security is based on legitimate interests. Optional analytics is based on consent. The Instagram feed's automatic display and controls are described below.

• To review and reply to project, recruitment, CV and collaboration enquiries.
• To assess fit, prepare requested services and keep a useful record of the conversation for a limited period.
• To secure the form, prevent spam and diagnose technical problems.
• To remember requested interface preferences.
• With your consent, to understand which pages and interactions are useful. To display Figma when requested and the Instagram feed automatically unless you have hidden it.
• Where applicable, to meet legal obligations and establish, exercise or defend legal claims.

This site uses Cloudflare Turnstile to protect the contact form from spam and automated abuse. When Turnstile runs, Cloudflare may process technical signals including the IP address, TLS fingerprint, browser user-agent, Turnstile site key, website origin and verification interactions. This site does not intentionally send the enquiry fields to Turnstile.

Cloudflare uses these signals to provide and improve its bot-detection service. The site uses the resulting token only to decide whether the enquiry may be accepted. It is not used by Aidan McFarlane for advertising or mailing-list profiling.

Google Tag Manager and Google Analytics are disabled until you check Allow Google Analytics and save your choices. The site's custom events measure known public page paths, titles and named interactions. Referrals include only a website origin, not its path or query. Events do not intentionally send names, email addresses, enquiry text or other form-field contents. URL queries, fragments, unknown page paths and email-link destinations are excluded. You can change analytics and feed settings through Privacy choices on this page. Essential only disables both services.

The Instagram feed loads automatically through LightWidget as you approach it on the photography page, unless you have previously chosen to hide it. It may load photos from Meta. These providers receive IP address and browser information and may use cookies. No separate permission button is shown before this connection. Choose Hide feed, or clear its checkbox in Privacy choices and save, to stop future embedding; that choice is saved on your device. Essential only disables both analytics and Instagram. Hiding the feed removes the embed but cannot undo prior processing or delete provider-owned cookies. Automatic feed loading does not enable Google Analytics. The Figma prototype connects to Figma only after you choose to open it. External LinkedIn, Behance, Medium and archive links connect to their operators only when activated.

• Enquiries are marked to expire after 90 days and are removed during subsequent database cleanup. Information required for an active engagement, legal obligation or dispute may be kept longer where necessary.
• Turnstile verification tokens expire after five minutes and are single-use. Local submission rate-limit state is held for about 10 minutes. Cloudflare handles its technical verification information under its own policy.
• Theme, language, motion/effects and privacy preferences remain on your device until changed or cleared. Optional enquiry source information is removed when the session ends or analytics consent is withdrawn.
• New Google Analytics cookies are configured to expire after 90 days without renewal. Older cookies may have longer expiry. Withdrawal disables collection and clears accessible first-party Analytics cookies. Google controls its own server-side retention under the analytics property's settings.

OpenAI Sites provides the site's hosting and deployment service. Cloudflare infrastructure supports delivery, database operations and Turnstile security. Google receives analytics data only after consent. LightWidget and Meta receive connection data when the Instagram feed loads automatically or you choose to show it. If owner email alerts are enabled, Resend receives the owner's email address and an opaque enquiry reference, not the visitor's name, email address or message. Figma receives connection data only when its prototype is opened.

These providers may process information outside Japan. Contact the operator for information about providers, processing locations and safeguards relevant to your request. Provider notices do not replace this operator's legal responsibilities. Information may also be disclosed to professional advisers or authorities when legally required.

Personal information is not sold and enquiry details are not added to a mailing list.

Depending on the law that applies, you may request information about use, access, correction, deletion, restriction, portability, objection or cessation of use or third-party provision. You may also withdraw consent without affecting earlier lawful processing and may contact the relevant privacy regulator.

Use the Contact page to make a request and describe the information and action concerned. Reasonable proof of identity may be requested. A response will normally be sent by email without a fee and without undue delay; notice will be given before any exceptional permitted charge. A response may be limited where the law permits or requires it.

Reasonable technical and organisational safeguards are used, including encrypted transport, input validation, Turnstile verification, rate limiting and limited data handling. No online service can guarantee absolute security.

This notice does not control external websites. Review their notices before providing information. This policy may be updated when the site, providers or legal requirements change. The date above shows the latest revision.