Service records / Terms and policies
Terms, refunds, and privacy.
These policies apply to fixed-scope services sold by Matthew Toro d/b/a Sumihara Productions. Effective August 31, 2026.
Terms of service
Effective date: August 31, 2026.
Seller and eligibility
The seller is Matthew Toro d/b/a Sumihara Productions. Services are available only to buyers with a United States billing address. An individual buyer must be at least 18 years old. A buyer acting for a company or other organization confirms that they have authority to accept the engagement and these terms for that organization.
Purchase and kickoff
- The buyer sends a project outline and selects an offer.
- Sumihara and the buyer accept a written engagement record by email stating the exact scope, exclusions, price, kickoff date, delivery date, access requirements, refund milestones, legal terms, and consent to receive and retain the agreement electronically.
- Only after that record is accepted, Sumihara sends a single-use Stripe payment link for the engagement.
- Work starts at kickoff only after payment is complete and all agreed access and required authorization have been supplied.
Every stated delivery period and delivery date runs from kickoff, not from the first inquiry, acceptance, or payment alone. A delay in required access or authorization moves kickoff and the corresponding delivery date.
Deliverables and ownership
The engagement record controls the service scope, deliverables, exclusions, price, and schedule. After full payment, the buyer owns the custom deliverables created specifically for that engagement. Sumihara retains all rights in pre-existing tools, templates, methods, know-how, and reusable components. Third-party and open-source materials remain subject to their respective licenses.
Security review boundary
An API Security Review defaults to source and configuration analysis. Dynamic testing requires a separately signed written scope identifying the exact targets, dates, prohibited techniques, emergency contact, and revocation process, together with written authorization from the owner and review of the applicable hosting-provider policies. No dynamic testing begins until those conditions are complete.
No guarantees or affiliations
Sumihara promises the work and verification described in the accepted engagement record, not a particular outcome. No service guarantees complete vulnerability discovery, security, compliance, platform approval, revenue, operational performance, or any other business result.
Sumihara Productions is independent and is not affiliated with, endorsed by, or sponsored by any third-party organization or platform, including Discord, Telegram, WhatsApp, Meta, or Signal. Third-party services are governed by their own terms and availability.
Governing law and venue
These terms and each engagement are governed by Florida law, without regard to conflict-of-law rules. Any dispute must be brought in a court of competent jurisdiction in Miami-Dade County, Florida.
Refund and cancellation policy
A buyer may cancel for a full refund before kickoff. After kickoff, payment is earned only as the following deliverables are received:
- 20%: the post-kickoff baseline artifact.
- 60%: the working draft.
- 20%: the final handoff and verification.
If an engagement is cancelled after kickoff, Sumihara returns the unearned portion to the original payment method. If Sumihara cannot meet the stated delivery date, the buyer may accept a new date or cancel and receive the unearned portion. A missed outcome or business result is not a refund trigger when the agreed work was delivered.
Send cancellation and refund requests to hello@sumihara.konekurosawa.org.
Privacy policy
The public Sumihara site collects no data directly, uses no analytics or cookies, and makes no third-party request. It does not collect information across sites. Do Not Track signals have no effect because the site performs no tracking.
Information handled by service providers
Email inquiries and engagement records may contain a name, email address, company, project details, and correspondence. Resend processes business email. Stripe processes identity, billing, and payment data, including customer name, email address, billing address, business or consumer status, and payment details, as the payment processor.
Use and retention
Information is used only to respond to inquiries, form and administer contracts, deliver services, maintain accounting records, protect security, and meet legal duties. Unsuccessful inquiry records are retained for up to 12 months. Contract and transaction records are retained for up to 7 years. Client access credentials and test data are deleted within 30 days after verified handoff.
Bot-specific privacy terms are produced for each engagement because the implemented platform data flow varies by client.
Requests and changes
To request access to, correction of, or deletion of personal information, email hello@sumihara.konekurosawa.org. Records may be retained when legally required.
Material changes to this policy will update the effective date. Active clients will also receive an email when a material change affects their engagement.
Contact
Matthew Toro d/b/a Sumihara Productions
8600 NW 56th St
Doral, FL 33166