Updated 22 October 2026
Privacy
This is a portfolio. It sells nothing, runs no advertising and builds no profile of you. If you write to me, I use your details to reply — and for nothing else.
Who is responsible
Clement Chang runs this site and decides how the data described here is used. Write to me about anything on this page:yhchang.workacc@gmail.com
When you write to me
The contact form sends your name, email address and message to my inbox. Nothing is stored on this website. I keep the conversation while it is useful to answer you and for up to two years after it ends, and I never add you to a mailing list. The lawful basis is my legitimate interest in answering the people who contact me — and, where you are asking about work, taking steps at your request before any agreement.
If I send you a private delivery
A delivery link opens only with its passcode, and is never listed or indexed. When you open it, the time and the number of visits are recorded so I know it arrived. The photographs you mark are saved with the delivery so I can see your choice; nothing else about you is. Both are kept with the delivery until I close or delete it. The basis is the work you asked me to do. To stop anyone guessing the passcode, the number of wrong attempts is kept with the delivery until the right one is entered, and attempts and downloads are counted against your IP address for at most a day. The basis for that is my legitimate interest in keeping your photographs private.
Spam protection
The form checks that a person is sending it: a field people cannot see, how long the form took to fill in, and a limit on repeated submissions from one IP address. Those counters are held for at most an hour. Where the Cloudflare Turnstile check is switched on, it also runs a privacy-preserving challenge in your browser. The basis is my legitimate interest in a usable inbox.
Visits
Vercel Web Analytics and Speed Insights count page views and measure how quickly pages load. Both report in aggregate, set no cookies and do not follow you to other sites. My host also keeps ordinary server logs, which include your IP address, briefly and for security.
Who handles data for me
Each of these acts on my instructions and only for what it does here: Vercel hosts the site and provides the analytics above; Resend delivers the contact email; Sanity stores the photographs and the site’s text and serves the images; Mux streams the films; Cloudflare provides the spam check. As with any website, their servers receive your IP address and browser details in order to send you the page. Some are outside the European Economic Area, under the European Commission’s standard contractual clauses.
Cookies and storage
The public site sets no cookies and uses no tracking pixels. It remembers which collection you were looking at in your browser’s session storage, which your browser clears when you close the tab. A private delivery sets one cookie once its passcode is entered, so you are not asked again for two weeks, and remembers the background and the photograph size you chose in your browser’s local storage. Neither is used for anything else, and nothing in storage leaves your device.
What you can ask for
You can ask to see the data I hold about you, to have it corrected or deleted, to restrict how it is used, to object to that use, or to receive it in a portable form. Email me and I will answer within a month. You can also complain to the data protection authority where you live. No decision about you is made automatically here.
Changes
If what the site does with data changes, this page changes with it and the date at the top is updated.