Last updated: February 4, 2026
Plain English Summary: We collect only what we need to run the service. Your API keys are encrypted. We don't sell your data. You can delete your account anytime.
When you create an account, we collect:
If you sign in with Google or GitHub, we receive:
We do not receive or store your OAuth provider password.
If you link your Telegram account to Sprout, we store:
Payments are processed by Stripe. We do not store your full credit card number. We receive and store:
When you deploy instances and configure channels, we store:
Encryption: All sensitive credentials (API keys, bot tokens) are encrypted at rest using AES-256-GCM encryption. Only authorized systems can decrypt this data when needed for channel configuration.
We automatically collect:
We use collected information to:
We do not sell your personal information. We share data only in these circumstances:
We use third-party services that may process your data:
| Provider | Purpose | Data Shared |
|---|---|---|
| Stripe | Payments | Email, billing info |
| Resend | Email delivery | Email address |
| Neon | Database | Account data |
| Vercel | Hosting | Technical data |
| RentAMac | Hardware provisioning | Instance config |
We may disclose information if required by law, court order, or government request, or to protect our rights, property, or safety.
We implement industry-standard security measures:
No system is 100% secure. If you discover a security vulnerability, please report it to security@sprout.bot.
You have the right to:
Request a copy of all data we have about you. Contact support or use the dashboard export feature.
Update your account information through the dashboard or contact support.
Request account deletion. All personal data will be removed within 30 days, except records required for legal compliance.
Request your data in a machine-readable format (JSON).
Unsubscribe from marketing emails (transactional emails cannot be disabled while your account is active).
We use cookies for:
We do not use advertising or tracking cookies. You can disable cookies in your browser, but this may affect Service functionality.
Our servers are located in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer.
The Service is not intended for users under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.
We may update this Privacy Policy periodically. We will notify you of material changes via email or dashboard notification. Your continued use after changes constitutes acceptance.
For privacy-related questions or to exercise your rights:
Email: privacy@sprout.bot
Contact Form: sprout.bot/contact
Under GDPR, we process data based on: (a) contract performance (providing the Service), (b) legitimate interests (improving the Service), and (c) your consent (optional features).
You have additional rights including the right to lodge a complaint with your local data protection authority.
Under CCPA, you have the right to know what personal information we collect and request deletion. We do not sell personal information.
To exercise your CCPA rights, email privacy@sprout.bot with "CCPA Request" in the subject line.