SOURCEART LTD · PRIVACY
Privacy notice
2026.10.22 · v4
How SourceArt Ltd handles information on this website: what the check and enquiry form collect, why, retention, recipients and your rights.
1. Who is responsible?
SourceArt Ltd, registration ΗΕ456555, Evagora Pallikaridi 38, 8010 Pafos, Cyprus, represented by Steve vom Wege, is the controller for this website’s check and enquiry data. Contact: info@tsumira.jp. Please use this address for privacy requests and include your enquiry reference if available.
2. Website access and hosting
Opening this website sends technical connection information such as your IP address, browser/request metadata, requested resources and timestamps to the hosting infrastructure. This is necessary to deliver the website and protect it from abuse (Art. 6(1)(f) GDPR: secure, reliable operation). This site is hosted using OpenAI Sites on Cloudflare infrastructure. Hosting providers may process security, access and authentication logs under their applicable terms. We do not maintain a separate visitor analytics database, and cannot specify a uniform retention period for provider-controlled logs. See OpenAI privacy information and Cloudflare privacy information. If access requires a ChatGPT account, the provider’s separate account/privacy rules apply; the support form does not request your ChatGPT login details.
3. The optional website check
When you request a check, we store a random check ID, the website’s HTTPS origin, execution time, outcome, public PHP version if disclosed and HTTP response status. Submitted paths and query strings are discarded; credentials and custom ports are rejected. The service makes ordinary HTTP HEAD requests and public DNS queries. The target operator and DNS provider receive the information needed for those requests. No passwords, login attempts or exploit payloads are used. Only check sites you own, manage or have permission to check. The check is provided at your request (Art. 6(1)(b) GDPR where it is a pre-contractual service; otherwise Art. 6(1)(f), our interest in providing the requested technical assessment). No contact details are required to use it.
4. Enquiries and direct contact
The form stores your name, email address, website origin, optional company and message, language, timestamp, random enquiry ID, source, status, and the privacy-notice version acknowledged. A related check ID is linked only where the submitted website matches. We use these records to respond, clarify the scope, prepare an estimate and manage your enquiry: Art. 6(1)(b) GDPR for steps requested before a contract, or Art. 6(1)(f) for other business correspondence. Your checkbox acknowledges this notice; it does not subscribe you to marketing. Name, email, website and acknowledgement are required for this form; company and message are optional. Without the required information we cannot process the form, but you can contact us by email. If you do so, the content and ordinary communication metadata are processed to handle your request; your own provider also processes the communication. A receipt confirms database storage. Where configured, Brevo receives the enquiry reference and a protected administration link to notify info@tsumira.jp; the full message and contact details are not included. We store delivery-attempt status, provider message ID and internal support notes with the enquiry. Provider acceptance does not confirm inbox delivery. No automatic LINE message is sent.
5. Abuse prevention
To limit automated submissions, the server checks request origin and body size, uses a hidden spam field, and keeps hourly counters. The application derives an hourly SHA-256 identifier from the requesting IP address and time window; it does not store the full IP in its lead/check tables. This identifier is pseudonymous, not guaranteed anonymous. Processing is based on Art. 6(1)(f) GDPR, our interest in preventing abuse and protecting service availability. The hosting provider still receives the connection IP.
6. Storage and deletion
Check records expire 30 days after execution. Enquiry records, related notes and notification records expire 365 days after submission. Hourly abuse counters expire approximately one hour after creation. Application cleanup deletes expired records on the next landing-page or API request; during a period without traffic, deletion therefore occurs later. If enquiries become contractual or legally relevant, related correspondence may be retained separately for applicable accounting, legal-obligation or legal-claim purposes (Art. 6(1)(c) or (f)); this site does not itself collect billing documents. Provider-managed logs and backups follow the providers’ retention and deletion rules. You can request earlier deletion subject to applicable legal grounds for retention.
7. Who can receive the data?
Authorised SourceArt personnel can access enquiry records for support. Hosting and technical infrastructure providers process data needed to operate the site. Brevo processes notification metadata when email notifications are configured. See Brevo privacy information. The operator signs into the restricted administration area using ChatGPT; the site checks authenticated identity and an operator email allowlist on every administrative request. Information may also be disclosed where legally required or necessary to establish, exercise or defend legal claims. We do not sell enquiry data or disclose it for third-party advertising. The website check and form do not send their contents to an AI model or use them for model training; descriptions of AI products elsewhere on the page do not change that processing flow.
8. International processing
SourceArt Ltd is established in Cyprus (EEA). OpenAI, Cloudflare, Google (when analytics is allowed) and, where enabled, Brevo operate internationally, and their infrastructure or support access may involve countries outside the EEA, including the United States. No EU-only storage location is promised for this deployment. The providers describe transfer arrangements, including adequacy mechanisms or standard contractual clauses where applicable, in their policies and contractual terms. You can ask us about the providers and safeguards applicable to your data using the contact details above.
9. LINE and other external links
LINE is optional. There is no embedded LINE widget: an external request is triggered when you choose to open its link. The configured contact is @302oamru. The website does not automatically transmit your form contents or append personal data or check results to the LINE URL. You can copy and share the receipt reference yourself. LINE and your account provider process the conversation under their own terms and privacy rules; SourceArt uses messages you send there to handle your request. A non-LINE contact path remains available. See LINE privacy policy. Portfolio links, including tsumira.jp, open separate sites with their own notices.
10. Optional analytics, cookies and fonts
We use Google Analytics 4 (measurement ID G-SPNLMCVPS3) only after you choose “Allow analytics”. Until then, the Google tag is not loaded and this integration makes no analytics requests to Google, including cookieless consent pings. The check and enquiry form work if you decline. Consent (Art. 6(1)(a) GDPR) can be withdrawn for the future using “Analytics settings” in the footer. Your choice is stored on this browser for up to 180 days; analytics cookies are configured with a maximum lifetime of 180 days without renewal. They are limited to this service hostname. Declining or withdrawing removes this integration’s accessible analytics cookies. Withdrawal does not delete data already processed by Google; contact us with any data-rights request. After consent, Google receives usage and device/browser information, page views, pseudonymous identifiers and connection information such as the IP address needed for transmission. We configure page URLs without query strings or fragments and limit referrers to the referring origin. We do not add form input values, submitted check URLs, messages, enquiry references or admin data to analytics events. No Google tag is included in the backend. Advertising storage, advertising user data, personalization and Google signals are disabled in this integration. Google’s property settings, including enhanced measurement and data retention, also affect processing and are managed in Google Analytics; their current configuration is not visible to this website. Google Ireland Limited and Google LLC may process analytics data internationally, including in the United States. See Google privacy information and Google Analytics data safeguards. Fonts and images are served from this site; Google Fonts is not loaded by visitors’ browsers. Hosting may use technically necessary authentication or security cookies.
11. Your rights
Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests, explaining grounds relating to your situation. Where processing is based on separate consent, you may withdraw it for the future. Contact us using the details above; we may need proportionate information to confirm identity, and normally respond within one month, with extensions where legally permitted. You can complain to a competent supervisory authority, including the Cyprus Commissioner for Personal Data Protection, or the authority where you live, work or believe an infringement occurred. No solely automated decision with legal or similarly significant effects is made by this website; a PHP check is only technical guidance.
12. Sensitive information and changes
Do not submit passwords, private keys, payment data or logs containing third-party personal data. Send only information needed to describe the issue. We use HTTPS, server-side validation and restricted operational access, but no online service can guarantee absolute security. This notice describes the current implementation and will be updated when its processing changes. Version: 2026-10-22-v4.