Legal

Sprout privacy policy

Last updated 25 October 2026

This policy explains how we handle personal information when you use Sprout, including the website at https://plan-multi-agent-usability-testing-9fecb4c.ocd.dev, the apps hosted on Sprout, Sprout's Agent, and the connection between Sprout and AI apps such as ChatGPT, Claude and Cursor. It doesn't replace the privacy notice of an app that someone else builds and runs on Sprout.

Who we are

Open Cloud Solutions Limited (company number 13400446, registered office C/O Taxevo, 1 Cedar Park, Cobham Road, Ferndown Industrial Estate, Wimborne, England, BH21 7SB) operates Sprout. In this policy, "we", "us" and "our" mean Open Cloud Solutions Limited. We are the controller of the personal information described here, except where this policy says that an app owner decides how it is used.

Scope and roles

We decide how account, plan, support, security and service-operation information is used to run Sprout.

When you build an app, you decide what it collects from the people who use it, and we host the app and its data for you. You are responsible for telling those people how your app uses their information and for getting any permission the law requires. Our terms set out what we promise when we handle that information for you.

If you use an app that someone else built, that person runs the app and decides how it uses your information, so please ask them first. You can report an app that collects information deceptively.

When you build with your own AI app, such as ChatGPT, Codex, Claude or Cursor, the company behind it processes your conversation, including what it sends to and receives from Sprout, under its own terms and privacy policy. We receive only the requests your AI app sends to Sprout, not the rest of your conversation, unless your AI app includes it in a request.

When you use Sprout's Agent, we send your messages, any files you attach and the parts of your app the Agent works on to the AI provider you connected, OpenAI or Anthropic, so it can do what you ask. The same happens when the Agent repairs your app automatically, using the app's code and logs. That provider processes them under your agreement with it and its own privacy policy. If you help run someone else's app as an invited admin, your Agent chats about that app run on the owner's plan, can use the owner's AI account if the owner allows it, and can be seen by the app's other admins, including the owner.

Information we handle

We may handle:

• Account and profile: your email address, name, profile picture link, account identifiers, plan, and whether you have confirmed your email.
• Sign-in and security: a one-way scrambled form of your password (never the password itself), sign-in sessions, the status of one-time sign-in links, the AI apps you have connected and what they are allowed to do, and security events.
• Payments: your plan, your subscription status and the order details Stripe shares with us, such as your name, billing address and what you bought. Stripe collects your card details, and we never see your full card number.
• Connected AI accounts: which provider you connected, the sign-in or API key you gave Sprout's Agent, which we store encrypted, and records of the AI work run with it.
• Agent conversations: your messages and attachments, the Agent's replies, and a protected record of each Agent run, which can include app code.
• Your apps: app names and addresses, whether each app is private or public, code, settings, the data and files your apps store, backups, and app secrets. Secret values are kept apart from everything else and are never shown back in lists.
• Invitations: the email addresses that an app's admins invite, the access each invitation gives, and whether it was accepted.
• App email: addresses, delivery status and a limited copy of each message your apps send or receive, with attachment details but not the attachment files.
• Service records: IP address and the country it comes from, request times, browser and device details, app identifiers, actions and their results, scheduled task history, limited logs, usage totals, measurements your apps record, alerts and error details.
• App visitor statistics: a one-way code that changes every day and is made from a visitor's IP address and browser details, plus the general traffic source, country, browser and operating system. These statistics never keep the raw IP address, browser details, referring page or page address.
• Requests from AI apps: the requests your AI app sends to Sprout, our replies, and the connection details needed to do what you asked.
• Error reports: when part of Sprout breaks, details of what went wrong, linked to your account, app and request: the error message, request identifiers, the page or command you were using, and your browser, Sprout command-line tool or AI app and its version. Sprout's pages, its command-line tool and our servers send these automatically so we can fix problems. If you ask your AI app to report a problem, the report also includes what you describe and which Sprout actions ran just before. Error reports never include your command options, files, app code, Agent conversations or passwords and keys. You can turn off error reports from the command-line tool with sprout telemetry disable or OPENCLOUD_TELEMETRY=0.
• Notifications: if you turn on notifications, the address your browser gives us to deliver them, and the notifications we send.
• Support and reports: the messages and attachments you send us, including abuse and security reports.

How we use information

We use information to:

• create and manage your account, your apps and your sign-in sessions
• build, check, preview, publish, back up and run apps when you or your AI ask
• run Sprout's Agent with the AI account you connected
• send sign-in, confirmation and account emails, and invitations to apps
• manage your plan and payments with Stripe, and show prices in your local currency
• keep Sprout secure, keep each person's apps and data separate, investigate abuse and fix failures
• answer support requests and tell you about important changes to Sprout or this policy
• meet our legal obligations, and establish, exercise or defend legal claims

Our legal reasons for using information are:

• Contract: to provide Sprout and your plan, as you ask.
• Legitimate interests: to keep Sprout secure, prevent abuse, fix failures and improve the service, in ways that respect your rights.
• Legal obligation: to meet tax, accounting and other legal duties, and to respond to lawful requests.
• Consent: where we ask for it. You can withdraw your consent at any time.

You need to give us your email address to have a Sprout account, and payment details to buy a paid plan. Without them, we can't provide those parts of Sprout.

Some things happen automatically under our terms, such as pausing apps that are over your plan's limits once the grace period ends, or pausing a password sign-up that isn't confirmed within 24 hours. If you think one of these decisions is wrong, email us and a person will look at it.

We don't sell personal information, and we don't use it for targeted advertising.

Who we share information with

We share information only when it is needed to run Sprout, or in the situations below:

• Service providers that process it for us: Hostinger, which provides the servers in the United Kingdom that Sprout runs on; Amazon Web Services, which sends and receives email for Sprout and its apps through Amazon SES in London; Cloudflare, which carries web traffic to Sprout and its apps, provides security and DNS services and forwards messages sent to our support address; and the email service that hosts our support mailbox.
• Stripe, which sells paid plans through its Onelink service as the merchant of record. Stripe uses your payment information as a separate controller, under its own privacy policy.
• The AI provider you connect, OpenAI or Anthropic, when you use Sprout's Agent or AI features in your apps, so it can do the work you ask.
• The AI app you use, such as ChatGPT, Claude or Cursor, when you ask it to work with Sprout. It processes your conversation under its own terms.
• Your browser's push service, such as Google, Apple, Microsoft or Mozilla, when you or people using your apps turn on notifications. Notifications are encrypted, so the push service can't read them.
• People using apps, according to who the app's owner lets use it and the app's own data rules. People invited as an app's admins can also change the app and see its Agent conversations and logs.
• Sprout administrators, in the limited ways described below.
• Authorities and others, when the law requires it or when it is reasonably necessary to protect people who use Sprout, the public or us.
• A buyer or investor, as part of a merger, financing, reorganisation or sale of Sprout or our business, with appropriate confidentiality protections.

Review by Sprout administrators

People at Open Cloud Solutions Limited who run Sprout may open any live app, including private apps, with their own administrator account. They may look at an app's limited logs and read a Sprout Agent conversation in a read-only view. They may also download the protected record of a single Agent run, which can contain conversation text and app code, and each download is recorded. They do this for safety, abuse and security reviews, and to work out why something failed.

This access doesn't let them act as you, send messages, use your AI account, edit your app, see secret values or get round your app's own data rules.

To protect people, or to help you, for example when you lose access to an app, administrators can also take an app offline, make it private, suspend an account, or change who can use or manage an app. We record each of these actions.

International transfers

Sprout's servers are in the United Kingdom. Some of our service providers, Stripe and the AI companies you choose to use process information in other countries, including the United States. Where the law requires it, we protect these transfers with safeguards such as UK adequacy regulations or approved contract terms for data transfers. You can ask us for details of these safeguards.

How long we keep information

We keep account and app information while your account or app is active and for as long as we need it to provide Sprout. We keep other information for as long as we need it for security, backups, resolving disputes and meeting legal duties.

• One-time sign-in and confirmation links expire.
• Measurements your apps record (custom metrics) are kept for up to 14 days.
• The history of email your apps send and receive is kept for 30 days. Incoming email is also held in its original form, with attachments, for up to 7 days while we deliver it to the app.
• App visitor statistics are kept for up to 366 days.
• Error report details are kept for up to 30 days. A summary of each grouped problem is kept while we work on it and for up to 180 days after it was last seen once fixed.
• When you delete an app, its data and files are deleted straight away. Its backups, Agent conversations and run records are kept until you delete your account, and you can ask us to delete them sooner.
• Before each update to Sprout, we take a full copy of our databases so that we can recover if the update fails. We keep these copies only for as long as we need them for that.
• Backups, audit records and security records can outlast the data they came from until their own retention period ends. Protection against early deletion can delay final removal from backup storage.

When you delete your account from your preferences, we take your apps offline and then delete your account, your apps with their data and backups, your Agent conversations and your connected AI accounts, and we email your old address to confirm. Backups that are protected against early deletion are erased as soon as that protection ends, within 30 days. We keep a limited set of records, such as security and audit records with your email address removed, where the law or security requires it, and Stripe keeps its own payment records.

Security

We protect information with encrypted connections, credentials that can do only what they need to, separate data for each app, checks on who can open private apps, data rules inside each app, limited and redacted logs and results, and a separate way to enter secrets. No system is completely secure, so we can't promise that information will never be accessed or lost without permission.

Cookies

Sprout uses a small number of cookies and similar storage in your browser. We don't use them for advertising, and Sprout's own pages don't load tracking or analytics tools from other companies.

• Needed to run Sprout: these keep you signed in for up to 30 days, link a sign-in or confirmation email to the browser that asked for it, protect forms against forgery, sign visitors in to apps on custom domains, and keep track of unfinished steps, such as a sign-in link you are waiting for or a file you haven't sent yet. Most last only a few minutes.
• Your preferences: these remember whether you last signed in with an email link or a password (for up to 400 days), your light or dark setting, your place in the guide to connecting your AI, and notices you have already seen.
• Notifications: if you turn on notifications, your browser stores a small background script that shows them to you.

You can delete or block cookies and stored data for Sprout in your browser settings at any time. If you remove the sign-in cookies, you'll need to sign in again; if you remove the others, Sprout just forgets your preferences. App visitor statistics don't use cookies. Apps built on Sprout may use their own cookies, which their owners are responsible for, and Stripe's checkout pages use Stripe's cookies.

Your choices and rights

You can update your name and profile picture, change your email address and delete your account from your preferences. You can manage your apps through Sprout or your AI.

Under UK data protection law, you have the right to:

• ask for a copy of your personal information
• have inaccurate information corrected
• have your information deleted
• receive your information in a format you can take elsewhere
• ask us to restrict how we use it
• object to how we use it
• withdraw your consent, where we rely on it

You may have similar rights under the law where you live.

Your right to object. Where we rely on our legitimate interests, you can object at any time to how we use your information. We will then stop, unless we have strong legitimate reasons to continue or need the information for legal claims.

To make a request, email support@sprout.is with Privacy request in the subject. We may need to check that you control the account before we respond. We will reply within one month, or longer where the law allows. Some information may be kept when we need it for security, fraud prevention, legal duties or to protect other people's rights.

If you're unhappy with how we handle your information, please tell us: email support@sprout.is with Privacy complaint in the subject. We'll confirm that we've received it within 30 days, look into it, keep you updated and tell you the outcome. You can also complain to the Information Commissioner's Office, the UK data protection regulator, or to the regulator where you live.

Children

You must be 18 or over to have a Sprout account (see our terms), and we don't knowingly create accounts for children. If we learn that a child has an account, we'll close it. Please don't create an account for a child, or give us a child's personal information, unless you have the legal right to do so and any consent the law requires.

Families can still use Sprout together. A parent or guardian holds the account, decides who can use the apps they build and is responsible for those apps, including apps that children use. If children will use your app, collect as little information about them as you can, and think carefully about whether the app suits them. When anyone opens an app on Sprout, including a child, we handle the service records described above, such as their IP address, to run and protect Sprout.

Changes to this policy

We may update this policy as Sprout changes. We'll show the new date at the top of this page and, where the law requires, tell you in another way too, such as by email.

Contact

Questions and privacy requests: support@sprout.is

Post: Open Cloud Solutions Limited, C/O Taxevo, 1 Cedar Park, Cobham Road, Ferndown Industrial Estate, Wimborne, England, BH21 7SB

Help with Sprout: Sprout support