Privacy Policy

Early Access version of this page. The Japanese version is the authoritative text.

Early Access. SumiCAD 0.6 and SumiCAD Cloud are an Early Access release: features may change, bugs are expected, and availability is not guaranteed. We run no extra backups of our own during Early Access, so keep your own copies of important files. A qualified architect (建築士) checks every result (Terms, Article 9).

Effective date: 24 October 2026 · Business handling personal information: Mori no Takumi Co., Ltd. (株式会社森の匠), Yamada, Kutchan-cho, Abuta-gun, Hokkaido 044-0081, Japan. The name of the representative is given without delay on request.

1. Information we collect

• Account (Cloud): e-mail address, the name you give, language, the firm's name, your role, and the devices you are signed in on (device name, type, sign-in times).
• Content (Cloud): projects, versions, drawings, 3D models, comments and survey points you or your firm upload.
• Payment (Cloud): handled by Stripe. We receive the card brand, the last 4 digits, the expiry date and the payment status, never the card number.
• Technical data: IP address (to limit sign-in attempts and protect the service) and server logs.
• On your device: the website and the web app keep your language choice and your sign-in in the browser's storage; the desktop app keeps your AI keys in the operating system's key store (or in an encrypted file where there is none).
• Desktop app: the app sends no crash reports and no usage statistics, and your projects stay on your computer. It connects to the internet only in these cases:
  • Update check (when the app starts, after a project is saved and every 4 hours): it downloads the list of the latest version from GitHub (github.com/sumicad/sumicad-releases) and, if you accept, the installer. No project or account data is sent; GitHub receives your IP address, as with any download.
  • SumiCAD Cloud: only when you sign in to the Cloud or use a Cloud feature.
  • AI assistant: only when you use it with your own key. Your messages and the project data the assistant needs are sent directly to the AI company you chose (for example Anthropic, OpenAI, Google or DeepSeek), under that company's terms; web pages the assistant opens are fetched from your computer.
  • Site map and address search: only when you open the site location tool. Map tiles come from the Geospatial Information Authority of Japan (GSI) and OpenStreetMap, and the address you type is sent to their search services.
  • Offline speech model: downloaded from Hugging Face only when you press its download button. Speech is then recognised on your computer. If you choose Windows' own recogniser, Windows' online speech setting applies.
  These services receive data directly from your computer, at your request; we do not receive it. If crash reporting is ever added, it will be off unless you turn it on, and this policy will be updated first.
• Website: sumicad.com uses no analytics and no tracking or advertising cookies. It keeps only your language choice in the browser. Its fonts are loaded from Google Fonts, and one demo page loads a 3D library from jsDelivr; these services receive your IP address, as with any web request.

2. Purposes

To provide and secure SumiCAD, sign you in, send the sign-in codes and the notifications you chose, bill subscriptions, answer your questions, and improve the service.

3. Service providers (outsourcing)

We entrust data to these providers only as needed to run the service:

• Stripe — payments
• Resend — sending e-mail (sign-in codes, invitations, notifications)
• Cloudflare — hosting of the website and the Cloud, file storage
• Neon (Databricks, Inc.) — database hosting (servers in Singapore)
• ImprovMX — forwarding e-mails sent to sumicad.jp@gmail.com
• Google (Gmail) — receiving and answering support e-mails

4. Providers outside Japan

The providers below are located outside Japan. We provide personal data to them on the basis that each has a system that continuously takes measures equivalent to those required of businesses under the Act on the Protection of Personal Information, set out in a data processing agreement or equivalent contract terms (the provider handles the data only to provide its service to us, keeps it confidential and secure, and binds its sub-processors to the same duties) (Act, Article 28(1); Enforcement Rules, Article 16). We check how each provider applies these measures, and whether any law of its country could affect them, about once a year, and we stop providing data to a provider if that protection can no longer be ensured (Act, Article 28(3)). On request, we give the information listed in Article 18(3) of the Enforcement Rules without delay.

Protection systems of these countries (surveys by the Personal Information Protection Commission):

• United States: no comprehensive federal privacy law; sector-specific federal laws and state laws (for example California's CCPA) apply. APEC CBPR participant. Commission survey: United States
• Singapore: comprehensive Personal Data Protection Act (PDPA) for the private sector. APEC CBPR participant. Commission survey: Singapore
• Other countries where Stripe operates: the countries cannot be identified in advance; Stripe's written contracts for transfers from Japan apply.

5. Sharing with third parties

We do not give personal information to third parties except with your consent, through the providers above, or when required by law. Inside a firm, members see each other's names and e-mail addresses as needed to work together.

6. Retention

Deleted projects can be restored for 30 days. After a subscription ends, the firm's data stays readable for 90 days, then it is deleted, and it leaves our database provider's automatic restore window within 30 days after that. During Early Access we run no extra backups of our own: the only way to restore lost or deleted data is the automatic restore window of our database provider, up to 30 days. Keep your own copies of important files ("Download .sumi" in the web app, and your local .sumi files). Weekly backups are planned for version 1.0. Other retention periods:

• Account: as long as the account exists; deleted together with the firm's data as above, or when you ask us to delete it. The firm owner's name and e-mail address are kept with the billing records for the period the tax law requires (see above), then deleted.
• Sign-in codes and the IP addresses used to limit sign-in attempts: 1 day. Signed-in devices: until the sign-in expires or is ended.
• Notifications: 90 days.
• Server logs: up to 30 days. Records of e-mails sent: up to 1 year.
• Billing records (invoices, payments): 7 years (10 years where the tax law requires it), as required by the Corporation Tax Act and the Consumption Tax Act.
• Support e-mails: 3 years after the last exchange.

7. Security

Sign-in without passwords, encrypted connections, per-firm access rules in the database, and sealed storage of service keys. Knowledge of the foreign environment: personal data is stored and processed in the United States, Singapore, France and other countries (see section 4); we take our measures with knowledge of the protection systems of those countries.

8. Your rights

You can ask us to disclose, correct, stop using or delete your personal information. Write to the contact below; we will answer as required by the Act on the Protection of Personal Information.

9. Changes

We publish changes to this policy on this page with their effective date.

10. Contact

Personal information enquiries: Mori no Takumi Co., Ltd. · E-mail: sumicad.jp@gmail.com · see also Contact and support.