SproutPadPrivacy Policy
Effective: July 29, 2026. This describes what SproutPad collects, why, and what happens to it.
What we collect
| Data | Why | Where it lives |
|---|---|---|
| Your email address | Account identity, sign-in links, approval and billing notices | Our database (Fly.io, US) |
| Payment method | Charging for domains/hosting/email/plans | Stripe only. We store tokens (customer + payment-method ids), never card numbers. |
| Audit ledger | Every agent/human action: what, why (justification), cost, undo path | Our database; exportable by you |
| Mailbox credentials | Operating mailboxes your agents create | Encrypted (AES-256-GCM) at rest; decrypted server-side only |
| Email envelopes | Inbox listings (from/subject/date/snippet) | Our database. Message bodies are never stored. They are fetched live from the mail provider for each read. |
| Funnel events | Measure whether site and agent onboarding works (view → signup → first launch) | Our database for 30 days; bounded non-PII dimensions and a keyed hash of a random first-party correlation value |
We do not use advertising trackers, sell data, or share it beyond the processors below.
For funnel measurement we set a first-party, HttpOnly correlation cookie that expires after 30 days. It is scoped to the sproutpad.ai service domain so the brand site and API signup remain one journey; that scope technically includes our other first-party service subdomains. We do not host customer-controlled content under sproutpad.ai. We store only the cookie's keyed one-way hash, not its value. It is never an authentication or claim cookie. Funnel metadata never includes your email, agent keys, claim secrets, Stripe session ids, IP address, or browser user-agent string. Obvious crawler and internal test traffic is excluded from conversion reports.
Public website AI demonstration
The public website does not currently enable live AI model processing. Its mounted Sprout launcher sends each submitted reply over HTTPS to SproutPad's same-origin website-agent admission endpoint so the service can validate the request and return a transient typed admission or safe-stop response. In this admission-only implementation, the endpoint does not invoke an AI model, provider, or connector, and it does not retain the raw reply text. Any public-admission correlation uses only bounded request metadata and one-way digests; it is not a transcript. No account, plan, or signup is created from this chat. If the visitor chooses the signup handoff, a client-generated offer identifier derived from the selected tier is carried to the signup page; account creation occurs only if the visitor separately submits the signup form. The “Copy prompt” control writes the example prompt to the visitor's clipboard and does not send it to SproutPad.
Live model processing will remain disabled until we publish and approve the processor identity or category, processing purpose and region, retention and training-use posture, deletion path, sensitive-data warning, and moderation, refusal, and dependency-unavailable behavior. Before the first live send, the visitor-facing disclosure, this policy, processor register, retention controls, and exact runtime provider configuration must tell the same data-use story. Activation also requires recorded privacy and legal approval bound to that policy and provider configuration.
Processors
Stripe (payments), Fly.io (hosting + database), name.com (domain registration — registrant data as required by ICANN), Cloudflare (DNS), Purelymail (mailboxes), Resend (transactional email), GitHub (encrypted database backups as private artifacts).
Retention
The audit ledger is append-only by design. It is the record used to verify budgets, teardown, and billing, and we retain it for the life of the service, including after account closure, as our legitimate financial and audit record.
On account closure (or verified erasure request): your email is replaced with an irreversible hash, Stripe tokens are deleted from our systems, sessions and sign-in identities are deleted, mailbox credentials and cached envelopes are purged, and all keys are revoked. Ledger entries survive, attributed to the pseudonymized identity — the standard reconciliation of erasure rights with append-only audit records.
Funnel events are automatically deleted after 30 days. They are separate from the audit ledger, which follows the retention rule above.
Your rights
Export your ledger anytime (dashboard → audit export). Close your account from the dashboard. For access/correction/erasure requests beyond that: support@sproutpad.ai. If you are in the EU/UK, these are your GDPR rights and we honor them as described above.
Security
Secrets are hashed (keys) or encrypted (mailbox credentials) at rest; sessions are server-side and revocable; every provider call goes through our accounts, so your agents never hold provider credentials. Vulnerability reports: security.txt.