Sprout - AI Agents on Dedicated Mac Hardware

We collect only what we need to run the service. Your bot tokens are encrypted. We don't sell your data. You can delete your account anytime.

1. INFORMATION WE COLLECT

1.1 Account Information

When you create an account, we collect:

Email address - For account access and support
Name (optional) - For personalization
Password - Hashed using bcrypt, never stored in plain text

1.2 Telegram Information

If you link your Telegram account to Sprout, we store:

Telegram User ID - Numeric identifier for sending messages
Telegram Username - For display purposes

1.3 Instance and Channel Data

When you deploy instances and configure channels, we store:

Instance configuration - Name, hardware selection, channel types
API credentials - Bot tokens for channels (encrypted) and API keys for integrations
Usage data - Credit consumption, uptime metrics

Encryption: Channel credentials (bot tokens) you add on an instance's page are encrypted at rest using AES-256-GCM. API keys for integrations are stored with your instance's configuration and are used only to set up your agent.

1.4 Technical Data

We automatically collect:

IP address
Browser type and version
Device information
Pages visited and actions taken
Timestamps

2. HOW WE USE YOUR INFORMATION

We use collected information to:

Provide and maintain the Service
Process payments and manage credits
Reply to your support requests
Configure and manage your channel integrations
Provide customer support
Detect and prevent fraud or abuse
Improve the Service based on usage patterns
Comply with legal obligations

3. INFORMATION SHARING

We do not sell your personal information. We share data only in these circumstances:

3.1 Service Providers

We use third-party services that may process your data:

Provider	Purpose	Data Shared
PostHog	Product analytics, only if you opt in	Pages visited, actions taken, account ID and email when signed in
Resend	Email delivery	Email address
Neon	Database	Account data
Vercel	Hosting	Technical data
RentAMac	Hardware provisioning	Instance config

3.2 Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect our rights, property, or safety.

4. DATA RETENTION

Active accounts: Data retained while account is active
Deleted accounts: Data deleted within 30 days of account deletion
Stopped instances: When your balance can't cover the next hour, the instance is stopped and its Mac is released; the Mac's data is deleted at once and cannot be recovered
Billing records: Retained 7 years for accounting and legal compliance
Server logs: Automatically deleted after 90 days

5. DATA SECURITY

We implement industry-standard security measures:

HTTPS encryption for all connections
AES-256-GCM encryption for stored channel credentials (bot tokens)
bcrypt password hashing with salt
Limited access to personal data (need-to-know basis)
Secure cloud infrastructure with Vercel and Neon

No system is 100% secure. If you discover a security vulnerability, please report it to security@sprout.boutique.

6. YOUR RIGHTS

You have the right to:

Access Your Data

Request a copy of all data we have about you by contacting support.

Correct Your Data

Update your account information through the dashboard or contact support.

Delete Your Data

Request account deletion. All personal data will be removed within 30 days, except records required for legal compliance.

Data Portability

Request your data in a machine-readable format (JSON).

Opt-Out

We don't send marketing emails. You can refuse or withdraw analytics consent at any time through "Manage Cookies" in the footer.

7. COOKIES

We use cookies for:

Essential cookies: Session management, authentication
Preference cookies: Remember your settings, only if you opt in
Analytics: Product analytics (PostHog), only if you opt in

We do not use advertising cookies. You can disable cookies in your browser, but this may affect Service functionality. See our full Cookie Policy for details.

8. INTERNATIONAL TRANSFERS

Sprout is operated by a company established in Poland, and your data is processed within the European Union on infrastructure hosted in EU regions. Where any provider processes data outside the EU, we rely on appropriate safeguards (such as Standard Contractual Clauses) consistent with the GDPR section below.

9. CHILDREN'S PRIVACY

The Service is not intended for users under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. We will publish material changes on this page with a new "Last updated" date. Your continued use after changes constitutes acceptance.

11. CONTACT US

For privacy-related questions or to exercise your rights:

Email: privacy@sprout.boutique

Contact Form: sprout.boutique/contact

FOR EU/UK RESIDENTS (GDPR)

Under GDPR, we process data based on: (a) contract performance (providing the Service), (b) legitimate interests (improving the Service), and (c) your consent (optional features).

You have additional rights including the right to lodge a complaint with your local data protection authority.

PRIVACY POLICY