Terms and privacy.

This website and these services are operated by:

Matthew Toro, doing business as Sumihara Productions, a Florida sole proprietorship. 8600 NW 56th St, Doral, Florida 33166, United States. Email: hello@sumiharaproductions.dev. Website: https://sumiharaproductions.dev

Sumihara Productions is a sole proprietorship. The work is performed by one person, so you always know who is in your repository and who answers your email.

Email is how we handle custom work, scope questions, access, kickoff, delivery, and notices. There is no phone line, contact form, ticket portal, or chat widget. A fixed-scope catalog engagement may be booked directly through Stripe Checkout; its published terms and Stripe record are the agreement both sides rely on.

We work Monday through Friday, excluding United States federal holidays, on Eastern Time. Every reference to a business day in these Terms means one of those days.

We sell only to buyers with a United States billing address. Stripe Checkout collects the address but does not enforce this territory rule for us. If a completed order has a non-United States billing address, we reject it before kickoff and issue a full refund to the original payment method.

We do not direct our services to individuals or businesses located outside the United States. We do not advertise outside the United States, and we do not accept engagements that would require us to act as a data controller or processor under a non-United States privacy regime. A buyer outside the United States requires a separate tax and legal review before we would issue any payment link, and we are not obliged to conduct one.

If an engagement is paid from a non-United States billing address, we may cancel it and refund the full amount to the original payment method.

Where your systems are hosted is a different question from where you are. We can review code or a service that runs on infrastructure outside the United States, provided you have the billing address and the authority described in Sections 2, 7, and 8, and provided the engagement record says so.

Who can buy

An individual buyer must be at least 18 years old. A buyer acting for a company, nonprofit, or other organization confirms that they are authorized to accept the engagement and these Terms on that organization's behalf and to bind it. If you are not authorized, do not accept the record.

You confirm that the information you give us is accurate, that you are not on any United States sanctions or denied-party list, and that you are not acting for anyone who is.

Fixed-scope catalog engagements

A fixed-scope catalog engagement is formed when you select a published service, read its scope and exclusions, accept these Terms in Stripe Checkout, and complete payment. The published service description and the Stripe transaction identify the engagement. No work starts until the access and authorization conditions in Sections 6 through 8 are satisfied.

Custom work and dynamic testing

Custom work and dynamic penetration testing require a separate written engagement record. You email the project outline; we reply with the exact scope, exclusions, price, dates, access requirements, refund milestones, and any testing authorization; and both sides accept that record by email before payment. A public catalog purchase never authorizes dynamic testing.

Changes and refusals

A change to the record before you accept it means a new record. A change after you accept it means a new record too, signed the same way, and it may change the price and the dates. Nobody performs work on a verbal understanding.

We may decline any inquiry for any lawful reason, and we will decline work that falls outside the boundary in Section 8, work we cannot perform competently, and work we believe is unlawful. Declining costs you nothing.

Electronic records

You and we agree that an emailed acceptance is a signature, that these Terms and the engagement record may be formed and kept electronically, and that neither party will contest the validity of the agreement solely because it was made electronically. This is agreed under the federal E-SIGN Act, 15 U.S.C. 7001 and following, and Florida's Uniform Electronic Transaction Act, Chapter 668, Part I, Florida Statutes. You may ask us for a copy of your record at any time and we will send it.

We sell five engagements and one subscription. Each engagement is sold once, at a fixed price, with a fixed delivery window measured in business days from kickoff. The engagement record for your project is more specific than this section, and where the two differ, the record wins.

These exclusions apply to every offer. None of them includes ongoing hosting, operation, monitoring, on-call response, maintenance, incident response after handoff, staff training beyond the written handoff materials, or any work not named in the record. We do not hold a key to your systems after the engagement ends.

4.1 SA-2500 Secure Automation Sprint. $2,500. Five business days.

Included: one existing business workflow; at most two external systems; up to eight automated steps; input validation; failure handling; one runnable verification; a written handoff guide; and one revision within the agreed scope.

Excluded: data migration; hardware; automated decisions that are regulated or that carry high impact on a person, such as credit, employment, housing, insurance, or medical decisions; new product development; and ongoing hosting or support.

4.2 AS-2500 API Security Review. $2,500. Three business days.

Included: one repository and one API surface; review of source, configuration, dependencies, and authentication; findings backed by evidence, with severity and remediation guidance; patches for the highest-value findings that fit the agreed scope; one verification pass; and one revision within the agreed scope.

The default mode is source and configuration analysis. Dynamic testing is not included by default and is governed entirely by Section 8. Denial of service, credential attacks, persistence, social engineering, and third-party targets are excluded from every engagement, always.

4.3 CO-0850 Community Ops Bot. $850. Three business days.

You choose Discord or Telegram. One of them, not both.

Included: one community; up to three commands; up to two alert sources; one administrator role; a privacy policy for the bot; a data deletion path; deployment instructions; one verification pass; and one revision within the agreed scope.

The default data posture stores configuration and platform identifiers only. Message content is not retained unless the record specifically requires it, and if it does, the record names the safeguards. Stored platform data is encrypted and deleted when it is no longer needed.

Excluded: hosting and operation. You run the bot after handoff, and the continuing privacy duties the platform imposes on a bot operator become yours at handoff. We delete test data and credentials after verified handoff, as described in Section 12.

4.4 WA-1500 WhatsApp Cloud API Bot. $1,500. Three business days.

The window starts after you supply an active Meta business portfolio, a WhatsApp Business Account, a business phone number, the required access token, and any message templates Meta has already approved.

Included: one inbound workflow; one human handoff path; up to three message types; webhook verification; one deployment target; privacy and deletion disclosures for the data flow we implement; one verification pass; and one revision within the agreed scope.

Only the official WhatsApp Business Platform Cloud API is supported.

Excluded: hosting and operation, and everything Meta controls. Meta's review time, template approval, business verification, and phone number activation sit outside our delivery window because they sit outside our hands. Meta's own messaging charges are yours.

4.5 What we do not sell

We do not offer Signal automation, and we will decline a request for it.

4.6 FS-3500 Full-Stack Application Development. $3,500. Seven business days.

Included: one web application with a frontend, backend, and database; authentication; one deployment target; a written handoff guide; one verification pass; and one revision within the agreed scope.

The engagement record defines the application's features, data model, user roles, authentication requirements, and deployment target. The seven-business-day window starts only after the access and content needed for that scope are provided under Sections 6 and 7.

Excluded: ongoing hosting or operation; native mobile applications; more than two third-party system integrations; and any feature, integration, migration, compliance assessment, or continuing support not named in the engagement record. Third-party platform review and approval times remain outside the delivery window under Sections 6 and 14.

4.7 CW-0299 Competitor Watch. $299 per month.

Included: once a day, we collect up to twenty public https pages you list at checkout, compare the visible text with the previous day's collection, and send you a written brief. The brief lists each line that appeared or disappeared on each page, with its source URL and collection date, states which pages could not be collected and why, and adds a short plain-language summary of the day's changes. You can change the page list by email.

A qualifying page is one reachable by anyone with a browser: no login, no paywall, no form submission, no bot wall. We never contact the companies you watch, create accounts on their sites, or submit anything to them. The first collection sets a baseline, so differences begin with the second brief. If a page blocks automated collection, the brief says so and we do not attempt to evade the block.

Excluded: pages that require any of the above; strategic advice, predictions, or recommended actions; any promise that every change is caught; and analysis of images, video, or files. The brief reports observed page text. What it means for your business is your call.

Billing: $299 is charged when you subscribe and again each month on the same date until you cancel. Cancel through the Stripe billing portal linked from any receipt, or by email; cancellation stops the next charge and the briefs continue to the end of the paid month. The month you cancel is not refunded, except under Section 10.8. We may end the subscription with thirty days' notice, refunding any unused portion.

5.1 Price

Prices are in United States dollars: $2,500 for SA-2500, $2,500 for AS-2500, $850 for CO-0850, $1,500 for WA-1500, and $3,500 for FS-3500. Each is a one-time price for one engagement. The subscription is $299 per month for CW-0299.

The price in your accepted engagement record is the price. It does not move because the work turned out harder than expected. It moves only if you and we accept a new record, in writing, changing the scope. There is no hourly overage, no rush fee, and no charge for a question by email.

CW-0299 is the one subscription we sell. It renews monthly until you cancel, and Stripe stores the payment method for that renewal. Buying an engagement never signs you up for a subscription, and subscribing never commits you to an engagement.

5.2 Payment

Payment for a fixed-scope catalog engagement is through the Stripe-hosted link published with that service. Quantity is fixed at one and payment is due in full before kickoff. Custom work uses a private Stripe invoice or payment link after both sides accept its written record. We do not offer deposits, installments, checks, wire transfer, or cryptocurrency unless a custom record expressly says otherwise.

Stripe processes the payment. Stripe collects your name, email address, billing address, business or consumer status, and payment details, and it handles your card data directly. We never see or store a full card number. If your issuer declines the charge, the engagement simply does not start, and we are not liable for the delay.

The six catalog links are published only on sumiharaproductions.dev and lead to a Stripe-owned domain. A custom payment request is valid only when sent from hello@sumiharaproductions.dev in the thread containing the accepted custom engagement record. If either condition is missing, do not pay and tell us.

5.3 Sales tax

Prices are stated exclusive of tax, and we do not charge Florida sales tax on these engagements. Florida taxes retail sales of tangible personal property and a specific list of named services. Custom professional services delivered electronically are not on that list, and we deliver nothing on physical media. Automatic tax calculation is switched off on the payment link, so the amount you see is the amount you pay.

If a taxing authority later determines that a tax, levy, or duty applies to an engagement, you are responsible for it, along with any interest or penalty, except for taxes on our net income. We will invoice you for it and you will pay it. If you are exempt, send us your exemption certificate before you accept the record.

This is our position on tax treatment, not tax advice for your business. Ask your own accountant how to book it.

6.1 Every delivery window runs from kickoff

Seven, five, and three business days are counted from kickoff. They are not counted from your first email, from your acceptance of the record, or from your payment alone. This is the single most common misunderstanding in this kind of work, so it is stated here plainly.

6.2 Kickoff happens when four things are true

1. Payment has cleared. 2. Every access item listed in the engagement record has been delivered to us and works when we use it. 3. Any authorization the work requires has been signed, including the separate authorization in Section 8 if dynamic testing is in scope. 4. We have sent a written kickoff confirmation.

Direct catalog purchases may wait in a queue before kickoff. We send the access checklist and either offer a kickoff within five business days after payment or give you the choice of a later date or a full refund. Once the other conditions are satisfied, kickoff occurs on the date stated in our confirmation. The delivery date is set by counting business days forward from kickoff.

6.3 What moves a delivery date

• Access that arrives late, arrives incomplete, or does not work.
• Credentials that are rotated or revoked mid-engagement.
• A scope change we both accept in writing.
• Your review taking longer than the windows in Sections 7 and 9.
• A third party we depend on and do not control, including Meta template review, business verification, phone number activation, platform approval, and provider outages.
• A force majeure event under Section 17.

When a date moves for one of these reasons, we tell you the new date in writing as soon as we can calculate it. Delay caused by you does not entitle you to a refund and does not reduce what has been earned.

6.4 What does not move a delivery date

Our workload. If we accepted your engagement, we had the capacity for it. If we cannot meet the delivery date for a reason on our side, Section 10 gives you the choice: take a new date, or cancel and take the unearned portion back.

6.5 Capacity

Catalog booking links stay open, so an order may wait in a queue. Section 6.2 sets the limit: we confirm a kickoff date within five business days of payment or refund the order in full. If you need a specific start date, email us before you pay and we will tell you whether we can meet it.

Fixed scope and a short delivery window only work if the inputs arrive. These obligations are conditions of our performance, not suggestions.

7.1 A named point of contact

Name one person in the engagement record who can answer questions, approve decisions inside the agreed scope, and reach whoever holds the credentials. That person should respond within two business days. If they go quiet, the clock in Section 6.3 moves and the milestones in Section 10 stay where they are.

7.2 Access

Provide every access item the record lists, on or before the kickoff date, in working order. That may include repository access, environment credentials, platform administrator rights, an API token, a sandbox, or test data.

Grant the least privilege the work actually needs. If read access is enough, give read access. Provide credentials through a channel we agree on in the record, never in a plain email body. Tell us immediately if a credential you gave us is rotated, revoked, or compromised.

7.3 Authority to grant it

You confirm that you own the systems, accounts, repositories, and data you give us access to, or that you hold written authority from the owner to grant that access for this purpose. If a third party hosts, operates, or co-owns any of it, getting their permission is your job, and Section 8 tightens this requirement further for security work.

7.4 Backups are yours

Keep current, tested backups of anything we touch, and give us a non-production environment to work in wherever one exists. We are careful, and we are not your backup. We are not liable for data loss you could have prevented with a backup you were always going to need anyway.

7.5 Regulated data

Do not put regulated data in front of us unless the engagement record says so and names the safeguards. That includes protected health information, cardholder data, government identifiers, biometric data, and information about children. If regulated data is unavoidable, say so before you accept the record so it can be scoped and handled properly. Use synthetic or masked test data where you can.

We are not a HIPAA business associate and not a PCI service provider for you unless we sign a separate agreement that says we are.

7.6 Review

Review what we deliver and tell us what does not match the record, within the windows in Section 9. Timely review is the only way a three-day engagement ends on day three.

This section governs AS-2500 and any security work in any other engagement. It is the section we will not bend on.

8.1 The default is source and configuration analysis

Unless the engagement record says otherwise, an API Security Review is a static examination: source code, configuration, dependencies, and authentication logic. We read, we reason, and we document. We do not send traffic to your live systems.

8.2 Dynamic testing requires a separate signed authorization

Dynamic testing, meaning any activity that sends traffic to or interacts with a running system, does not begin until all three of the following are complete:

1. A separately signed written scope that names the exact targets, the exact dates and hours, the prohibited techniques, an emergency contact reachable during the testing window, and the process for revoking authorization. 2. Written authorization from the owner of the target system, which is you if you own it and the owner directly if you do not. 3. A check of the applicable hosting provider's testing policy, confirming the provider permits the work described.

All three, in our hands, before a single packet moves. No verbal go-ahead, no authorization by email thread, no starting early because the window is tight. If the paperwork is not done, the testing does not happen, and the schedule moves under Section 6.3.

8.3 Your warranty of ownership and authority

You represent and warrant that you own each named target or hold current written authority from its owner to authorize testing of it, and that you have the right to grant us the access described. This warranty is a condition of any dynamic testing, and Section 16 makes you responsible for a claim that arises if it turns out not to be true.

8.4 Excluded from every engagement, always

• Denial of service and any test intended or likely to degrade availability.
• Credential attacks, including brute force, password spraying, and credential stuffing.
• Persistence, including installing implants, backdoors, or any mechanism intended to maintain access.
• Social engineering of any kind, including phishing your staff, pretexting, and physical intrusion.
• Any third-party target, shared-tenant system, or asset not named in the signed scope.

We will not perform these even if you ask, even in writing, and even if you claim to own everything involved.

8.5 Stopping

Either party may revoke authorization at any moment during dynamic testing by notifying the emergency contact named in the signed scope. We stop, we confirm in writing that we have stopped, and we document what had been done up to that point. If testing stops early at your direction, work already delivered stays earned under Section 10.

8.6 What a review is and is not

A review is a time-boxed examination of a named scope, on a named date, by one person. It is evidence that a competent look happened and a record of what was found. It is not a proof that your system is secure, not a certificate, and not a compliance attestation. Section 13 says this in the language a lawyer will look for.

9.1 What is included

Every offer includes one verification pass and one revision within the agreed scope. A revision means correcting or adjusting delivered work so that it matches the engagement record. That is a real commitment: if what we handed you does not do what the record says it does, we fix it, at no charge, and there is no argument about it.

9.2 What is not a revision

A new feature. A new integration. A different platform. A second community, repository, or API surface. A redesign of something already approved. A change to the workflow after the workflow was built. Anything the record excludes. These are new work. They need a new engagement record and they carry a new price, quoted before anything starts.

9.3 The review window

After final handoff, you have five business days to review the deliverables and tell us in writing what does not match the record. Be specific: name the item and say what the record promised and what it does instead.

We fix in-scope defects at no charge. If you say nothing within five business days, the deliverables are accepted. If you put a deliverable into production use, it is accepted at that moment.

9.4 What counts as a defect

A defect is a deliverable that does not do what the engagement record says it does. That is the whole test.

These are not defects: a change of mind about what you wanted; a third party changing its API or platform rules after handoff; your environment changing after handoff; a business outcome that did not arrive; and anything the record listed as excluded.

9.5 After acceptance

Acceptance ends the engagement. We are not on call. We delete your credentials and test data within thirty days, as Section 12 describes. If something comes up later and you want us to look at it, that is a new engagement, and we will quote it honestly.

10.1 Before kickoff: full refund

Cancel any time before kickoff and you get all of your money back, to the original payment method. No fee, no explanation required, no argument. Email hello@sumiharaproductions.dev and say you are cancelling.

10.2 After kickoff: the price is earned in three parts

After kickoff, the price is earned as the work is delivered:

• 20% when you receive the first post-kickoff baseline artifact. For SA-2500 that is the execution plan and a validated sample path. For AS-2500 it is the API attack-surface map. For CO-0850 and WA-1500 it is the bot data flow and command map. For FS-3500 it is the application architecture, data model, and implementation plan.
• 60% when you receive the working draft, the review draft, or the bot build.
• 20% on final handoff and verification.

10.3 Cancelling after kickoff

Cancel after kickoff and we refund the unearned portion to the original payment method, calculated on the milestones actually delivered. You keep what was delivered up to that point, and Section 11 gives you ownership of it once the amount earned has been paid.

10.4 If we miss the delivery date

If we cannot deliver by the stated delivery date for a reason on our side, you choose: accept a new date, or cancel and take the unearned portion back. It is your choice, not ours, and we will offer it to you in writing rather than waiting for you to ask.

10.5 What is not a refund trigger

• The agreed work was delivered and the business result you hoped for did not follow. Section 13 explains why that is not something we ever promised.
• A security review found fewer issues than you expected, or found issues you did not want to hear about.
• You stopped responding, or revoked access, and the engagement stalled. Milestones already delivered stay earned.
• A delay caused by you, or by a third party we do not control, under Section 6.3.

10.6 How refunds are paid

Refunds go back through Stripe to the original payment method. There is no store credit and no substitute. We issue an approved refund within five business days. Your bank or card issuer controls when the credit posts, which usually takes another five to ten business days and is out of our hands.

10.7 Chargebacks

If you think a charge is wrong, email us first. Most of these are a misunderstanding about kickoff dates and take ten minutes to sort out. If you file a dispute with your card issuer instead, we will respond to the processor with the accepted engagement record, the delivery evidence, and this policy. Filing a dispute does not change what has been earned.

10.8 Subscription refunds

If no brief is delivered for seven consecutive days for a reason on our side, email us and we refund that month in full. A brief that reports "no change" or "could not collect" is a delivered brief. Cancelling part way through a month does not refund that month; the briefs continue until it ends.

11.1 What you own

On receipt of full payment, you own the custom deliverables created specifically for your engagement: the code we wrote for you, the configuration we built for you, and the documents and reports we produced for you. That ownership transfers when the money clears, not before. Until then we retain all rights in it, and you may not use it. If the engagement ends early under Section 10.3 or 18.4, ownership of the work delivered up to that point transfers once the earned amount described there has been paid, in place of full payment.

A security review report belongs to you. Use it internally, show it to your auditor, show it to your board, show it to your customers if you want to.

11.2 What we keep

We keep all rights in our pre-existing tools, templates, methods, know-how, checklists, scripts, and reusable components, including anything we developed before your engagement or develop independently of it. Doing this work for you does not hand you the toolbox it was done with.

Where those retained components are embedded in your deliverables, you get a perpetual, worldwide, non-exclusive, royalty-free, transferable license to use, copy, modify, and run them as part of the deliverables. You cannot extract them and sell them on their own.

We also keep the general knowledge, skill, and experience gained from the work, including anything that is retained in memory. That is how a person gets better at a job, and it is not a licence to use your confidential information, which Section 12 forbids.

11.3 Third-party and open-source components

Third-party and open-source materials in your deliverables stay under their own licenses. We identify them at handoff, along with the license each one carries. Complying with those licenses after handoff is yours to do.

11.4 Your material

You keep everything you already own: your code, your data, your content, your trademarks. You grant us a limited license to use it only to perform the engagement, and that license ends when the engagement does.

You confirm you have the right to give us what you give us, and that our agreed use of it will not infringe anyone's rights.

11.5 Publicity

We will not name you as a client, describe your systems, publish your findings, or use your logo without your written permission. If you would like to be a reference, tell us and we will be glad. If not, your engagement stays private, and silence means no.

11.6 Trademarks

Neither party gets any right in the other's name, logo, or trademarks under these Terms.

12.1 The obligation runs both ways

Each party will keep the other's confidential information confidential, use it only to perform or receive the services, protect it with at least reasonable care, and disclose it only to a person who needs it for the engagement and is bound by a duty at least as strict as this one.

12.2 What is confidential

Non-public information that is marked confidential or that a reasonable person would understand to be confidential.

Yours includes your source code, credentials, architecture, infrastructure details, security findings, vulnerabilities, incident history, customer data, business plans, and anything we see because you gave us access. Security findings deserve particular emphasis: an unremediated vulnerability we identified for you is confidential until you tell us otherwise, and it stays that way even after the engagement ends.

Ours includes the engagement record, any pricing agreed outside the published prices, our methods, templates, checklists, and internal tooling.

12.3 What is not

Information that is public without a breach of this section, that the receiving party already knew without a duty of confidence, that it develops independently without using the other's information, or that it lawfully receives from a third party free to disclose it.

12.4 Compelled disclosure

If a law, subpoena, or court order requires disclosure, the receiving party may comply. Where the law permits, it will give prompt notice first so the other party can seek protection, and it will disclose only what is required.

12.5 Deletion

We delete your access credentials and test data within thirty days after verified handoff. Contract and transaction records are kept as the Privacy Policy describes, because tax law and dispute defense require it. If you want deletion confirmed in writing, ask and we will confirm it.

You should rotate every credential you gave us once the engagement ends. Do that whoever your contractor was.

12.6 Duration

This section survives the engagement and continues for three years after it ends, except for credentials, security findings, and anything that qualifies as a trade secret, which stay protected for as long as the law protects them.

13.1 What we do promise

We promise to perform the work described in your engagement record with reasonable professional care and skill, and to deliver the artifacts the record names, on the schedule Section 6 sets. That promise is real, and Section 9 backs it with a free fix for anything that does not match the record.

13.2 What we do not promise

We promise the work. We do not promise a result. Specifically, nothing we deliver is a guarantee:

• That every vulnerability in your system has been found. No review, by anyone, at any price, can promise that.
• That your systems, accounts, or data are secure, or will remain secure after we hand off.
• That you will pass a SOC 2 audit, or satisfy HIPAA, PCI DSS, GDPR, or any other framework, or that any auditor, assessor, regulator, or certifying body will agree with anything in a report we wrote.
• That you will not suffer a breach, an intrusion, data loss, or downtime.
• That Meta, Discord, Telegram, or any other platform will approve your application, template, phone number, or bot, or will keep approving it.
• That an automation, bot, or integration will produce revenue, cost savings, message deliverability, engagement, uptime, or any other business outcome.
• That a third-party API will keep behaving the way it behaved on the day we built against it.

A finding of no issues in a named scope means we found no issues in that named scope on that date, with the access we had, in the time the engagement bought. It does not mean there is nothing there.

13.3 Disclaimer

EXCEPT FOR THE EXPRESS COMMITMENT IN SECTION 13.1 AND THE REMEDIES IN SECTIONS 9 AND 10, AND TO THE FULLEST EXTENT PERMITTED BY LAW, THE SERVICES AND DELIVERABLES ARE PROVIDED ON AN AS IS AND AS AVAILABLE BASIS, AND WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY, AND NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

SOME STATES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO PART OF THE ABOVE MAY NOT APPLY TO YOU.

13.4 Not legal or compliance advice

We are not your lawyer and not your auditor. A privacy policy or deletion path we draft for a bot is a technical artifact reflecting the data flow we built. Have your own counsel review it before you publish it.

14.1 No affiliation

Sumihara Productions is independent. We are not affiliated with, endorsed by, sponsored by, certified by, or a partner of Discord, Telegram, WhatsApp, Meta Platforms, Signal, Stripe, or any other third party. We name these platforms only to describe what our services work with, and every trademark belongs to its owner.

14.2 Their rules apply to you

You need your own accounts on these platforms, and your use of them is governed by their terms, policies, developer agreements, and privacy notices, not by ours. Read them. A platform may change its API, change its pricing, impose rate limits, suspend your account, reject your application, or discontinue a product, on its own schedule and without asking either of us.

We build to a platform as it exists on the day we build. We are not responsible for a platform's decisions, outages, policy changes, or fees, and none of those is a defect under Section 9 or a refund trigger under Section 10.

14.3 Approval timelines are theirs

Meta template review, business verification, phone number activation, app review, and any equivalent process at another platform sit outside our delivery window because they sit outside our control. Section 6.3 covers what happens to your dates when one of them runs long.

14.4 You operate the bot

After handoff you operate the bot. The duties a platform places on a bot operator, including its privacy, data retention, disclosure, and user-consent requirements, become yours at handoff. We give you the disclosures and the deletion path; keeping them accurate as you change the bot is your responsibility.

14.5 Signal

Signal automation is not offered. We will decline the request.

14.6 Stripe

Stripe processes payments as an independent processor under its own terms. If a payment fails, is held, or is reversed by Stripe or your card issuer, that is between you, your issuer, and Stripe, and Section 18 says what happens to the engagement.

READ THIS SECTION. IT LIMITS WHAT YOU CAN RECOVER FROM US.

15.1 Excluded damages

TO THE FULLEST EXTENT PERMITTED BY LAW, MATTHEW TORO D/B/A SUMIHARA PRODUCTIONS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST BUSINESS, LOST OR CORRUPTED DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, REGULATORY FINES, THE COST OF SUBSTITUTE SERVICES, OR THE COST OF SECURITY INCIDENT RESPONSE, ARISING OUT OF OR RELATING TO THE SERVICES, THE DELIVERABLES, THE WEBSITE, OR THESE TERMS, WHETHER THE CLAIM IS BROUGHT IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, WARRANTY, STATUTE, OR ANY OTHER THEORY, AND EVEN IF WE WERE ADVISED THAT SUCH DAMAGES WERE POSSIBLE.

15.2 The cap

OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO AN ENGAGEMENT WILL NOT EXCEED THE AMOUNT YOU ACTUALLY PAID US FOR THAT ENGAGEMENT. FOR ENGAGEMENTS SOLD UNDER THESE TERMS THAT CEILING IS $3,500 OR LESS. THIS CAP APPLIES TO ALL CLAIMS IN THE AGGREGATE, NOT TO EACH CLAIM SEPARATELY, AND IT APPLIES EVEN IF A REMEDY IN THESE TERMS FAILS OF ITS ESSENTIAL PURPOSE.

15.3 Why the cap is here

This is a one-person business selling engagements between $850 and $3,500. The prices are what they are because liability is allocated this way. Without this section the work could not be offered at these prices, and both parties accept that trade as the basis of the bargain. If your risk exposure is larger than the price of the engagement, and for security work it very often is, insure it, or scope and price the work with a firm that carries the coverage you need. We would rather say that plainly than pretend otherwise in the sales conversation.

15.4 What is not limited

Nothing in these Terms limits or excludes liability for gross negligence, willful misconduct, fraud or fraudulent misrepresentation, personal injury or death, or any liability that cannot be limited or excluded under applicable law.

Your obligation to pay the fees, and your indemnity obligations under Section 16, are not subject to the cap in Section 15.2.

SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES, SO PART OF THIS SECTION MAY NOT APPLY TO YOU.

15.5 Time limit on claims

Any claim arising out of or relating to an engagement must be brought within one year after the claim arises, or it is permanently barred, unless applicable law forbids shortening the period.

16.1 What you cover

You will defend, indemnify, and hold harmless Matthew Toro d/b/a Sumihara Productions against any third-party claim, and any loss, damage, liability, penalty, or reasonable legal cost arising out of it, that comes from:

• The systems, accounts, repositories, credentials, content, or data you gave us access to, including a claim that you did not have the right to grant that access.
• Your representation under Section 8.3 that you owned or were authorized over a target, and any consequence of that representation being wrong, including a claim by a system owner, a hosting provider, a co-tenant, or a law enforcement authority.
• Regulated data you placed in front of us without disclosing it under Section 7.5.
• Your use, modification, deployment, or resale of the deliverables after handoff.
• Your operation of a bot after handoff, including the platform, privacy, retention, and user-consent duties that transfer to you under Section 14.4.
• Your breach of these Terms or of any third-party platform's terms.

16.2 What we cover

We will defend, indemnify, and hold you harmless against a third-party claim that the custom deliverables we created for you, used as delivered and as the engagement record describes, infringe a United States copyright or misappropriate a trade secret.

This does not cover a claim arising from material you supplied; from third-party or open-source components, which are governed by their own licenses under Section 11.3; from any modification made after handoff; from use combined with anything we did not supply; or from use outside the engagement record.

If such a claim is made, we may at our option modify the deliverable, replace it, obtain a license for it, or refund the fees you paid for it. That is your sole and exclusive remedy for an infringement claim, and it remains subject to the cap in Section 15.2.

16.3 How an indemnity claim works

The party seeking indemnity gives prompt written notice of the claim, gives the indemnifying party sole control of the defense and settlement, and cooperates at the indemnifying party's expense. Late notice reduces the obligation only to the extent it caused prejudice. No settlement that admits fault, imposes an obligation, or requires a payment by the other party may be made without that party's written consent, which will not be unreasonably withheld. The indemnified party may participate with its own counsel at its own cost.

Neither party is liable for a failure or delay in performance caused by an event beyond its reasonable control. That includes natural disaster, hurricane, tropical storm, fire, flood, earthquake, epidemic or public health emergency, war, terrorism, civil disturbance, government action or order, strike or labor dispute, failure of a utility, telecommunications, internet, cloud, or hosting provider, a third-party platform outage or unannounced API change, and a cyberattack on infrastructure either party depends on.

Because this is a sole proprietorship, it also includes serious illness or injury of the individual performing the work. If that happens we will tell you promptly, tell you honestly what the delay looks like, and give you the choice in the next paragraph rather than leaving you waiting.

Workload is not a force majeure event.

The affected party gives notice as soon as it reasonably can and resumes performance when it can. Dates extend by the length of the event. If the event continues for more than thirty days, either party may cancel the engagement in writing, and the unearned portion is refunded under Section 10. Payment obligations for work already earned are not excused by this section.

18.1 When we may suspend or terminate immediately

We may suspend work or terminate an engagement at once, on written notice, if:

• Payment fails, is reversed, or is disputed.
• Access is not provided by the kickoff date, or is revoked or broken during the engagement.
• You cannot establish ownership of or authority over a target under Section 8.3.
• You ask for work that falls outside the boundary in Section 8, or for anything we reasonably believe is unlawful.
• You or your organization appear on a United States sanctions or denied-party list.
• You use a deliverable to attack, surveil, or harm another party.
• You materially breach these Terms and do not fix it within five business days of written notice.

We will decline an unlawful request, and doing so is not a breach by us. It does not refund amounts already earned.

18.2 When you may terminate

You may terminate for convenience at any time by emailing hello@sumiharaproductions.dev. Section 10 governs the money, and nothing else needs to be negotiated.

18.3 Termination for material breach

Either party may terminate for the other's material breach if the breach is not cured within ten business days of written notice describing it.

18.4 What happens on termination

• Fees earned under Section 10 remain payable. The unearned portion is refunded to the original payment method.
• We deliver the work in progress as it exists at that moment, to the extent the earned amount covers it, and Section 11 transfers ownership of it once the earned amount is paid.
• Access you granted us is revoked by you, and you should rotate the credentials.
• We delete your credentials and test data within thirty days, under Section 12.5.
• The sections listed in Section 21 survive.

READ THIS SECTION. IT SAYS WHERE A DISPUTE IS DECIDED AND WAIVES A JURY TRIAL AND CLASS ACTIONS. IT DOES NOT FORCE YOU INTO ARBITRATION.

19.1 Governing law

These Terms and every engagement under them are governed by the laws of the State of Florida, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

19.2 Talk to us first

Before either party files anything, it will send the other written notice describing the dispute and the relief it wants. Send yours to hello@sumiharaproductions.dev or to the address in Section 22. Both parties will then try in good faith to resolve it for thirty days. This step is a condition of filing suit, and any applicable limitations period is paused while it runs. Most disputes at this size are a disagreement about a date or a scope line, and thirty days and a phone call resolve them for a fraction of what a filing fee costs.

19.3 No mandatory arbitration

We do not require arbitration and there is no arbitration clause in these Terms. You keep your right to go to court. We think that is the fairer arrangement for engagements of this size: administered arbitration of a $2,500 dispute usually costs both sides more than the dispute is worth.

19.4 Forum

For any claim not brought in small claims court, the state and federal courts located in Miami-Dade County, Florida have exclusive jurisdiction and venue. Both parties consent to personal jurisdiction there and waive any objection based on inconvenient forum.

19.5 Small claims preserved

Either party may bring an individual claim in small claims court instead. Florida small claims court hears claims up to $8,000, which is more than the price of any engagement we sell, so it is a genuine option for essentially any dispute about one of these engagements, not a technicality.

19.6 Jury trial waiver

EACH PARTY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATING TO THESE TERMS, AN ENGAGEMENT, OR THE SERVICES. THIS WAIVER IS MUTUAL AND APPLIES EQUALLY TO BOTH PARTIES.

19.7 Class action waiver

EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF, CLASS MEMBER, OR REPRESENTATIVE IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, PRIVATE ATTORNEY GENERAL, OR REPRESENTATIVE PROCEEDING.

If this Section 19.7 is found unenforceable as to a particular claim or request for relief, that claim or request is severed and decided in the courts named in Section 19.4, and the rest of this section stays in effect.

19.8 Injunctive relief

Either party may ask a court in the forum named in Section 19.4 for injunctive or equitable relief to protect its confidential information or intellectual property, without first completing Section 19.2.

19.9 Attorney fees

In any action arising out of these Terms, the prevailing party is entitled to recover its reasonable attorney fees and costs from the other party. This runs both ways.

19.10 Government agencies

Nothing in these Terms prevents either party from reporting a concern to, cooperating with, or seeking relief from any federal, state, or local government agency or regulator.

19.11 Survival

This section survives the completion or termination of an engagement.

We may revise these Terms by posting a new version at sumiharaproductions.dev/legal#terms with a new effective date and a new last-updated date.

The version in effect on the date your engagement record was accepted governs that engagement, for its whole life. Nothing we post afterward changes a contract you already accepted. If we ever need to change the terms of an engagement that is already running, we will ask you and it will take a new record signed by both of us.

A revised version applies only to engagements accepted after it is posted. If you are considering an engagement, read the version on the site the day you accept the record, and keep a copy. We keep one too, along with the version number and the date and time of your acceptance.

21.1 Entire agreement and order of precedence

Your accepted engagement record, these Terms, and the Privacy Policy are the entire agreement between you and us about your engagement. They supersede every prior proposal, email, quote, call, and discussion on the same subject. Where they conflict, the engagement record controls the scope, exclusions, price, dates, and access requirements; the Privacy Policy controls the handling of personal information; and these Terms control everything else.

21.2 No conflicting purchase terms

Your purchase order, vendor portal, supplier agreement, procurement click-through, or standard terms do not apply and do not modify this agreement, even if we are asked to acknowledge one to release payment, and even if we do. Only a document we sign that says it amends these Terms amends them.

21.3 Severability

If any provision is found unenforceable, it is limited or severed to the minimum extent needed, and the rest stays in effect.

21.4 No waiver

Not enforcing a provision on one occasion does not waive it. A waiver counts only if it is in writing.

21.5 Assignment

You may not assign this agreement without our written consent, except to a successor in a merger or a sale of substantially all of your assets, with written notice to us. We may assign it to a successor entity if the business is incorporated, sold, or reorganized, and we will tell you if that happens. Any other attempted assignment is void.

21.6 Relationship of the parties

We are an independent contractor. Nothing here creates a partnership, joint venture, employment, franchise, or agency relationship, and neither party may bind the other. We are not a HIPAA business associate, a PCI DSS service provider, a data processor under any privacy statute, or a fiduciary for you unless a separate signed agreement says so. There are no third-party beneficiaries other than the parties indemnified under Section 16.

21.7 Notices

Notices to us go to hello@sumiharaproductions.dev, with a copy to the postal address in Section 22 for anything formal. Notices to you go to the email address on your engagement record. An emailed notice is deemed received on the next business day after it is sent, unless it bounces. Keep your contact email current.

21.8 Survival

Sections 8.3, 10, 11, 12, 13, 14, 15, 16, 19, and 21 survive the completion or termination of an engagement.

21.9 Interpretation

Headings are for convenience and do not affect meaning. Including and includes mean including without limitation. These Terms will not be construed against either party as the drafter.

Matthew Toro d/b/a Sumihara Productions 8600 NW 56th St Doral, Florida 33166 United States

Email: hello@sumiharaproductions.dev Website: https://sumiharaproductions.dev

Email is the only channel. Send a scope, a question, a cancellation, a refund request, a privacy request, or a dispute notice to the same address, and say in the first line which one it is.

Related documents:

• Privacy Policy: sumiharaproductions.dev/legal#privacy
• These Terms: sumiharaproductions.dev/legal#terms

Sumihara Productions is the trade name of Matthew Toro, a sole proprietorship registered in Florida. There is no staff, no call center and no parent company. When this policy says we, us or our, it means that one business.

Contact:

• Sumihara Productions
• 8600 NW 56th St, Doral, Florida 33166, United States
• Email: hello@sumiharaproductions.dev
• Website: https://sumiharaproductions.dev

This policy applies to the public website, to email you send us or we send you, to the written engagement record and your acceptance of it, to payment through Stripe, and to the systems, credentials and material a client gives us so we can perform a fixed-scope engagement.

It does not apply to other companies' websites and services, including Stripe's payment page, which run under their own privacy notices. Your purchase itself is governed by our Terms of Service at /legal#terms, which include Florida law and venue in Miami-Dade County.

We sell only to buyers with a United States billing address, and an individual buyer must be at least 18 years old. The site can be read from anywhere, and Section 16 explains the limited rights that may apply to readers outside the United States.

This is the shortest true description of the site: static public pages, self-hosted homepage scripts for the startup and terminal, and links to Stripe-hosted Checkout for the fixed-scope catalog. This legal page loads neither homepage script.

Specifically, on sumiharaproductions.dev:

• No cookies. Not one, of any category, first party or third party. There is no consent banner because there is nothing to consent to.
• No localStorage. The terminal keeps its temporary state only in memory. The homepage startup uses sessionStorage under sp.boot.seen with the value 1 to remember that it has played or been dismissed in the current tab. This flag normally lasts until the tab closes and is not transmitted to us. If browser storage is unavailable, the startup runs without saving the flag.
• Self-hosted scripts. terminal.js makes no background network requests: no fetch, XMLHttpRequest, or WebSocket. boot.js loads a same-origin image for the homepage startup. It skips playback and that image request on narrow screens, when reduced motion is requested, when the URL has a fragment, or when the tab already has the seen flag. If you choose to open another site, your browser connects directly to the address you provide. That address is not stored by these scripts or sent to this website.
• No analytics of any kind. No Google Analytics, no privacy-friendly alternative, no server-side page counter of our own.
• No advertising script, advertising pixel, conversion tag, retargeting tool, or audience tracker.
• No third-party scripts or background requests. The Latin typeface, Archivo, is self-hosted here under the SIL Open Font License. Scripts, images, stylesheets, and icons come from this domain. A booking link leaves this site for Stripe only after you activate it.
• No contact or signup forms. The easter egg has a local command input that is never submitted or transmitted. Contact otherwise happens through a mailto link, which opens your email program and sends nothing until you press send.
• No accounts, logins, shopping cart, or payment form on this domain. The catalog links to Stripe-hosted Checkout, described in Section 2.1.

2.1 The checkout path

Each fixed-scope service has one public link to a Stripe-hosted Checkout page. Stripe controls the product, quantity, and price. The link does not contain the price and there is no client-supplied amount for this site to trust.

Activating the link sends your browser directly to Stripe. Card details are entered on Stripe's page, never on ours, and we never see or store a card number. Stripe sends the receipt and invoice. The static return page does not look up, store, or claim a payment status.

Custom work uses a private Stripe invoice or link only after both sides accept its written engagement record by email.

Server logs

The site is hosted by Vercel. Like any web host, Vercel's servers record ordinary request data in order to deliver the page and protect the service, which can include the requesting IP address, the date and time, the path requested, the response status, and the browser's user agent string. That is a normal part of how the internet works, and no website can avoid it.

We do not keep our own log of visitors, we do not receive an identified visitor report, and we make no attempt to connect log entries to a person. Vercel holds those records under its own privacy notice and retention schedule, which we do not control.

Everything we hold arrives through one of four channels, plus the records we create ourselves.

Email correspondence

When you write to hello@sumiharaproductions.dev, we receive whatever your message contains: your name, your email address, your signature block, any phone number or company detail you choose to include, the body of the message, attachments, and the technical headers every email carries. The same applies to our replies and to the whole thread that follows.

The engagement record

For a fixed-scope catalog booking, the published service description, these Terms, your Stripe acceptance, and the Stripe transaction form the engagement record. For custom work or dynamic testing, we send a separate written record covering scope, exclusions, price, dates, access requirements, refund milestones, and authorization. We keep the applicable record because it is the contract.

Stripe checkout

Payment happens on Stripe's page, not on ours. Stripe collects the card or wallet details, billing name and address, and an email address for the receipt. We never see a full card number and we do not store payment credentials.

What we see afterward is Stripe's summary of the transaction: payment status, amount, currency, card brand, the last four digits, the billing name, address and country, the receipt email, and Stripe's transaction identifiers. We use the billing country and address to confirm the United States requirement in our terms.

Material you give us to do the work

This is the part that deserves care from both of us. Depending on the offer, an engagement may involve source code, configuration files, infrastructure diagrams, API keys, tokens, service credentials, staging or read-only access to systems, bot platform credentials, Meta business assets and approved templates, sample or test data, screenshots, exported logs, and your notes about how something is supposed to work.

Some of that material can contain personal information about your own users, employees or customers, especially inside logs, database exports and test fixtures. When it does, we are handling it on your behalf and under your instructions, and Section 6 sets out the rules we apply to it. Send us the least you can. A redacted sample is almost always enough.

Records we create

In the course of an engagement we produce our own records: findings and their evidence, drafts, the deliverables themselves, handoff and verification notes, invoices, and refund milestone calculations. These reference you and your systems, so they are covered by this policy too.

We use the information described in Section 3 for these purposes and no others:

• Answering your inquiry and working out whether the job is a fit.
• Preparing and keeping the applicable catalog or custom engagement record.
• Confirming that payment cleared and that the billing country is eligible.
• Performing the engagement, which is the entire point: reading the code and configuration, building the automation or the bot, writing the findings, producing the deliverable.
• Delivering the work, completing verification at handoff, and answering questions about what we handed over.
• Applying the refund milestones in our terms and returning any unearned portion to the original payment method.
• Keeping accounting, tax and business records, and producing them if a tax authority or auditor asks.
• Establishing, exercising or defending a legal claim, and handling a chargeback or dispute.
• Preventing fraud, protecting our own systems, and enforcing our terms.

We do not use any of it to advertise to you, to build a profile, to score you, to enrich a third-party dataset, or to train a model. We hold less rather than more, because it is cheaper, it is safer, and it means fewer things can go wrong.

Three companies touch personal information connected to this business. That is the whole list.

Stripe, payment processing

Stripe runs the checkout page, takes the card or wallet details, performs its own fraud and identity checks, moves the money, and issues refunds when we send them. Stripe sees the payment data in full. We see the summary described in Section 3. Stripe processes that information as a payment processor under its own privacy policy and its agreement with us.

Resend, business email

Mail to and from hello@sumiharaproductions.dev is delivered and received through Resend. That means message content, attachments, addresses and headers pass through and are stored on Resend's systems while in transit and in our mailbox. Resend acts as our service provider and processes that mail under contract, on our instructions.

Vercel, hosting

Vercel serves the static files and holds the request logs described in Section 2. It does not receive card details, create Checkout Sessions, process Stripe webhooks, or look up payment status for this site. The terminal sends no input to Vercel. Provider log retention follows Vercel's schedule; our contract and transaction records follow Section 10.

Additions and independence

If we ever add a provider that handles personal information, we will update this policy before that provider goes live, and we will say what it does and what it sees.

We are an independent business. We are not affiliated with, endorsed by, sponsored by or acting on behalf of Stripe, Resend, Vercel, Discord, Telegram, WhatsApp, Meta, Signal or any other company named anywhere on this site. Naming a platform describes work we can do on it, nothing more.

Clients hand us keys to real systems. These are the rules we hold ourselves to, and you should hold us to them as well.

• Least access that works. We ask for the narrowest permission the scope requires, read-only wherever the work allows, scoped to the systems named in the engagement record. If you offer us more access than the job needs, we will ask you to reduce it.
• Credentials live only as long as the engagement. Keys, tokens, passwords, connection strings, VPN and SSH access, platform logins and any exported material sit in a password manager or an encrypted store used for the job, never in a public repository, a shared drive or a plain text file lying around.
• Deletion within 30 days after verified handoff. Once handoff is complete and verified, we delete client credentials and client test data within 30 days. That covers keys and tokens, copies of exported data, screenshots that show credentials, staging fixtures and sample datasets.
• Rotate anyway. When handoff is verified, rotate every credential you shared with us. This is good practice with any outside party, including one that says it deleted the copy. We will remind you in the handoff message.
• Send redacted data when you can. If a synthetic or masked dataset will exercise the code path, use it. Do not send a production database dump because it was the quickest export.

Scope discipline in a security review

Our security work is source and configuration analysis by default. We read what you give us. Dynamic testing against live systems requires a separately signed scope naming exact targets, dates, prohibited techniques, an emergency contact and a revocation process, together with written authorization from the system owner and a check of the hosting provider's policy. Denial of service, credential attacks, persistence, social engineering and third-party targets are excluded in every case.

The practical privacy consequence is that we do not go rummaging through your production data looking for personal information. If we come across personal information in the course of a review, we note that it exists and where, and we do not copy it out.

We do not show your work to anyone

We do not use client names, logos, code, findings or screenshots in marketing, a portfolio, a case study or a social post without your separate written permission. Silence is not permission.

We disclose personal information only in these situations:

• To the three service providers in Section 5, for the functions described there.
• To professional advisers, such as an accountant, attorney, insurer or auditor, when they need it to advise us, and under a duty of confidence.
• To a government authority, regulator, court or law enforcement agency when disclosure is required by law, a valid subpoena or a lawful order. Where we are legally allowed to tell you first, we will.
• To a buyer, successor or lender in connection with a sale, merger, financing or transfer of the business, subject to the same commitments in this policy.
• To anyone you direct us to, in writing, such as a colleague you ask us to copy or a system owner you ask us to notify.

That is the complete list. We do not hand your information to data brokers, advertising networks, lead generators, marketing platforms or anyone offering to enrich it.

We do not sell personal information for money or for any other valuable consideration. We do not share it for cross-context behavioral advertising or targeted advertising as those terms are defined under United States state privacy laws. We run no advertising technology, so there is no identifier to pass to an ad partner even if we wanted to.

We also keep no marketing list. There is no newsletter, no drip sequence, no promotional email and no reactivation campaign. Email from us is either a reply to something you wrote or a message about an engagement that already exists. If we ever start a marketing list, it will be opt-in, it will have an unsubscribe link, and this policy will be updated before the first message goes out.

Because nothing is being sold or shared, there is nothing to opt out of. Section 12 still explains how to make the request, and we will confirm it in writing.

No decision about you is made automatically. A person reads your inquiry, a person writes the engagement record and sets the price, a person reviews every finding before it goes into a deliverable, and a person decides whether to take the job. Nothing here produces a legal or similarly significant effect through automated processing alone.

We use general software development tooling to do our work, and some of that tooling is AI-assisted. Our rule is that client credentials, client source code, client system data and the contents of client systems are not sent to a third-party artificial intelligence service unless the engagement record says so in writing and you have agreed to it. If a particular engagement calls for it, we will name the provider and the material involved in the engagement record before work starts, and you can say no.

Stripe may run its own automated fraud and risk checks on a payment. That processing happens under Stripe's own notice and is outside our control.

We keep information only as long as there is a reason to, then we delete it. The reason is usually a legal one, a tax one, or an open dispute.

• Inquiries that did not become an engagement: up to 12 months after the last message, then deleted. If you ask us to delete an inquiry thread sooner, we will.
• Contract and transaction records, meaning the engagement record, your acceptance email, invoices, payment and refund records, and the correspondence that establishes what was agreed: up to 7 years after the transaction, and longer only if a dispute, claim or legal obligation is still open. Tax and limitation periods drive this number.
• Client credentials, access tokens and client test data: deleted within 30 days after verified handoff, as set out in Section 6.
• Working files and our copy of the deliverables: kept alongside the engagement record for the same period, so that we can answer a question or defend a claim about what was delivered. If you would rather we did not keep a copy, tell us after handoff and we will delete it, retaining only what the tax and legal records above require.
• Privacy request records: kept as long as needed to show that we received the request, verified it and handled it properly.

When a period ends, we delete the material or reduce it to a record that no longer identifies anyone. Copies held inside our providers' backup systems age out on those providers' schedules, which we do not control.

Here is an honest account rather than a set of adjectives.

What works in your favor structurally: the public pages have no user accounts, contact forms, analytics, advertising scripts, or trackers. The terminal keeps input in memory and sends no background requests. The homepage startup uses only the sessionStorage flag and same-origin image described in Section 2. This site runs no server-side payment code; booking links open Stripe-hosted Checkout, and card details stay on Stripe's page. Business information also passes through email, Stripe's dashboard, and working files, as described in Section 5.

What we actually do:

• Multi-factor authentication on every business account that supports it, including the hosting, email and payment accounts.
• Unique, generated credentials held in a password manager, never reused between clients.
• Full-disk encryption on the machines used for client work.
• HTTPS with modern TLS for the website, and enforced TLS for business email.
• Access to client systems scoped to the engagement and revoked at handoff, with credentials and test data deleted within 30 days as described in Section 6.
• Client material kept separated by engagement, not pooled into one general archive.

What you should know about email: ordinary email is not a secure channel, whatever the sending provider does in transit. Do not send a password, private key or production credential in the body of a message. Ask us and we will arrange a better method before you send anything sensitive.

And the honest caveat: no system, no provider and no person is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects your personal information, we will tell you without undue delay, describe what happened and what was involved, say what we are doing about it, and meet whatever notification duties the law imposes.

Depending on where you live and which law applies, you may have the right to:

• Confirm whether we hold personal information about you, and get a copy of it.
• Know the categories we collected, the sources, the purposes and the recipients.
• Correct information that is wrong.
• Have information deleted, subject to the exceptions the law allows, such as records we must keep for tax or an open claim.
• Receive a portable copy in a usable format.
• Object to or restrict certain processing.
• Withdraw consent where consent is what we relied on, without affecting what was lawful before.
• Opt out of sale, sharing, targeted advertising or profiling. As Section 8 explains, none of those happen here, and we will confirm that in writing if you ask.
• Limit the use of sensitive personal information, where that right applies.
• Appeal a decision we make on your request.
• Receive the same service and price whether or not you exercise a privacy right. We will not treat you differently for asking.
• Complain to a privacy regulator or data protection authority.

We apply these rights to anyone who asks, whether or not the law in question technically reaches a business our size.

Email hello@sumiharaproductions.dev with the subject line Privacy Request.

Tell us:

• What you want us to do, in plain words. You do not need to cite a statute.
• Where you live, so we can apply the right law.
• The email address you used with us, or the engagement it relates to, so we can find the records.

Please do not send a copy of a government identification document. If we genuinely cannot identify your records without more proof, we will ask for something specific through a secure method.

Verification

Because our records are organized by email thread, we usually verify a request by confirming that you control the email address in our records. We may ask you to reply from that address or to name a detail only the correspondent would know. If we cannot verify the request, we will say so and explain what would let us proceed, rather than silently denying it.

Timing

We answer as quickly as we can, and always within the period the law allows. Under the California Consumer Privacy Act and most other United States state privacy laws, that is generally 45 days, with one extension of up to 45 more days where reasonably necessary and with notice to you. Where the GDPR or UK GDPR applies, it is generally one month, extendable by up to two further months for complex requests, with notice to you. Requests are free unless one is manifestly unfounded or repetitive, in which case we will tell you before doing anything.

Authorized agents

Someone may make a request on your behalf where the law allows it. We may ask for proof of their authority and may ask you to confirm the request directly, unless the agent holds a valid power of attorney.

Appeals

If we deny a request and your state gives you a right to appeal, reply to our decision or write again with the subject line Privacy Appeal. We will review it, tell you the outcome and our reasons within the time the law allows, and give you the contact details for the relevant regulator, whether or not the appeal succeeds.

This section supplements the rest of the policy for California residents and uses the meanings given in the California Consumer Privacy Act as amended. It describes the preceding 12 months, or the period since this business began operating if that is shorter.

Categories collected

• Identifiers: name, email address, business name, billing address, and IP addresses present in our hosting provider's server logs.
• Customer records: billing contact and address, and payment-related information limited to what Stripe reports back to us. We never hold a full card number.
• Commercial information: the service purchased, the price, the dates, refund milestone status, and the correspondence about the engagement.
• Professional or employment information: your role or company, if you tell us.
• Internet or electronic network activity: only the ordinary server log entries described in Section 2. We run no cookies, analytics or advertising identifiers.
• Other content you send us: the text of your email, attachments, and the material you provide so we can do the work.

Sources, purposes and recipients

Sources are you, directly; Stripe, for transaction summaries; and our hosting provider's server logs. The business purposes are the ones in Section 4: performing the contract, taking payment, delivering and supporting the work, security, and legal and accounting compliance. The recipients are the ones in Sections 5 and 7.

Sensitive personal information

We do not seek sensitive personal information and we ask clients not to send it. Where an engagement requires credentials to a client's own systems, we use them only to perform the service you asked for, retain them only for the engagement, and delete them within 30 days after verified handoff. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit under the CCPA, and we do not collect or use biometric identifiers.

Sale, sharing and incentives

We do not sell personal information. We do not share it for cross-context behavioral advertising. We run no financial incentive program, no loyalty scheme and no discount in exchange for personal information. Under California's Shine the Light law, we do not disclose personal information to third parties for those parties' own direct marketing purposes.

Retention

Each category is retained according to Section 10.

A note on thresholds

A business this small may fall below the CCPA's applicability thresholds. We do not intend to argue the point with anyone. Send the request and we will handle it as though the law applies.

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, have rights that closely track those in Section 12: to confirm and access, to correct, to delete, to obtain a portable copy, to opt out of targeted advertising, sale and certain profiling, and in most of those states to appeal a denial.

We honor those rights through the process in Section 13, regardless of whether the particular law reaches a business our size.

Several of these laws require us to honor a universal opt-out preference signal such as Global Privacy Control. We do. The homepage scripts do not read or transmit that signal, and there is no advertising, tracking, profiling, or sale of personal information for the signal to switch off.

We do not process personal information for profiling that produces legal or similarly significant effects, and we do not knowingly process sensitive data as defined in these laws without consent.

We sell only to buyers with a United States billing address. We do not market to, solicit or accept engagements from individuals or businesses in the European Economic Area, the United Kingdom or Switzerland, and our terms make a United States billing address a condition of purchase. In the normal case the GDPR and UK GDPR therefore do not apply to us, and we have not appointed a representative under Article 27. If we ever offer services in those territories, we will appoint one and publish the contact details here before the offering begins.

The site is nevertheless readable from anywhere. If you are in one of those territories and the GDPR or UK GDPR does apply to a particular piece of processing, then:

• Our legal bases are contract, for preparing and performing an engagement; legal obligation, for tax, accounting and record-keeping duties; legitimate interests, for securing our systems, preventing fraud, keeping records of what was agreed, and establishing or defending legal claims; and consent, where we ask for it, which you can withdraw at any time.
• You may have rights of access, rectification, erasure, restriction, portability and objection, exercised through Section 13.
• Information will be processed in the United States, where our providers and our records are located, and privacy law there differs from the law where you live. Where a transfer safeguard is required, we rely on the mechanisms our providers offer, which for Stripe, Resend and Vercel include the European Commission's Standard Contractual Clauses and the UK Addendum. Ask us and we will point you to the applicable terms.
• You may complain to your national supervisory authority. In the United Kingdom that is the Information Commissioner's Office. We would rather you wrote to us first so we can try to fix it.

If you live in Canada, Brazil, Australia or another country with an applicable privacy law and you have dealt with us, write to us and we will handle your request under the law that applies to it.

This business is for adults and for organizations. Our terms require an individual buyer to be at least 18 years old. We do not direct the website, the services or any communication to children, and we do not knowingly collect personal information from anyone under 18.

We do not knowingly collect personal information from children under 13 within the meaning of the Children's Online Privacy Protection Act. Since we do not sell or share personal information at all, we do not sell or share the personal information of anyone under 16.

If you believe a minor has sent us personal information, write to hello@sumiharaproductions.dev and we will look for it and delete it.

This website does not embed anything from another company. No third-party font, image, script, video, map or social widget loads when you read these pages, which is why reading them is invisible to everyone but your own network provider and our host.

The catalog's booking links and any custom payment link sent by email take you to Stripe's hosted checkout. That is Stripe's service, running Stripe's cookies under Stripe's privacy notice. Any other external link leads to that company's site under its own terms.

We are not responsible for the privacy or security practices of other companies, and naming one on this site does not mean we are connected to it.

We will update this policy when our practices change, when we add or replace a provider, or when the law requires it. The updated version goes up on this page with a revised Last updated date, and we will describe what changed in plain words rather than quietly editing a sentence.

If a change materially affects an engagement that is already under way, we will tell the client by email. The version of this policy referenced in a signed engagement record continues to govern that engagement unless you agree to the new one.

Questions, complaints and privacy requests all go to the same place, and a person reads them.

• Sumihara Productions
• Matthew Toro, sole proprietor
• 8600 NW 56th St, Doral, Florida 33166, United States
• Email: hello@sumiharaproductions.dev
• Website: https://sumiharaproductions.dev

If you simply want to know what we hold about you, ask. It is usually a short list, and we would rather tell you than have you wonder.