Privacy policy

Last updated October 12, 2026

This explains what information SiteSprout collects, why, who helps us process it, and what you can do about it. We don’t sell your information and we don’t use advertising trackers.

What we collect

• Account: your email address and password. Passwords are stored as a secure hash; we can’t see them. If you sign in with Google, we get your name and email from Google, never your Google password.
• Your workspace: the leads, notes, contact history, websites, photos, prices and progress you add.
• Searches: the business type and city you search for, how many results you asked for, and when. We use this to count your plan’s searches. Your search results are saved to your account for up to 30 days so you can see them again on any device, then deleted.
• Activity: when you last opened the app, so free Google seats can go to active users.
• Visit statistics: which pages are viewed, the website that sent you (its name only), your country, and whether you use a phone or computer. We don’t use cookies for this and don’t store your IP address; visitors are counted with an anonymous code that changes every day.
• Error reports: if the app crashes, the error message, the page and your browser type are sent to us so we can fix it.
• Billing: your plan, payment status and Stripe customer ID. Card details go straight to Stripe. We never see or store your card number.
• Chat assistant: if you chat with the AI assistant on sitesprout.app, your messages and any name, email or phone you give are saved so our team can reply. Chats are counted per visitor with an anonymous daily code to prevent abuse; no cookies.
• Waitlist and contact messages: the name, email, optional phone or Instagram handle and message you send us.

Information about businesses

When you search, SiteSprout shows business details (name, address, phone, website) from Google Maps Platform or OpenStreetMap, and visits the business’s own public website to check if it works and to find a public email address or social link. This is public business information. Leads you save stay in your account only.

Tools for your clients’ websites

Websites our users build for their clients can include two optional SiteSprout tools: a visit and call counter (counts visits and taps on call, directions, email and form buttons, with no cookies and no personal data) and an AI chat assistant. When a visitor chats with an assistant, their messages and any contact details they choose to give are saved and sent to that business and to the SiteSprout user who looks after its website, so they can reply. The chat says it’s an AI assistant and that messages are shared with the business. Each business is responsible for how it uses the requests it receives. If a business uses missed-call text-back, the phone number of a caller it couldn't answer is used to send that caller one text from the business, and any reply is passed to the business. Callers who reply STOP are never texted again. Phone numbers and messages are processed by Twilio. A SiteSprout user can also share a private owner page with each client business, showing that business its own website results, chat requests and plan details, and letting it send change requests to its designer.

How we use it

• To run the service: sign-in, saving your work, searches, previews and reminders.
• To bill you and enforce plan limits.
• To send you account emails: confirmation, password reset, receipts, invites and important changes. No marketing emails without your permission.
• To keep the service secure and fix problems.

Who helps us

We use these service providers. Each only gets what it needs to do its job:

• Supabase: database and sign-in (servers in the United States).
• Cloudflare: hosting and security for sitesprout.app.
• Stripe: payments and refunds. See Stripe’s privacy policy.
• Resend: sending account emails.
• Twilio: phone calls and text messages for missed-call text-back.
• Anthropic (Claude): when you use AI design, AI drafts or a chat assistant, the business details, your instructions and chat messages are sent to Anthropic’s API to write the reply. By default, Anthropic doesn’t train its models on API data.
• Google Maps Platform: your search text is sent to Google to find businesses. Google’s use is covered by the Google Privacy Policy.
• OpenStreetMap services (Nominatim and Overpass): the city and business type of open map searches are sent to these public servers.

Cookies and storage

We store your sign-in session and a copy of your workspace in your browser so the app works offline and loads fast. We don’t use advertising or tracking cookies.

How long we keep it

• Your account and workspace: until you delete your account.
• Search records: while your account exists, so we can count usage and handle refunds.
• Billing records: as long as the law requires us to keep them (usually up to 7 years).
• Waitlist entries: until you get an invite or ask us to remove you.

Your choices

• See, correct or download your information.
• Delete your account and workspace.
• Leave the waitlist.

Send any of these requests through the contact page using the email on your account. We reply within 30 days. Depending on where you live (for example California or the EU), you may have additional rights, and we honor them.

Children

SiteSprout is for adults. We don’t knowingly collect information from anyone under 18. If you believe a child has an account, tell us and we’ll delete it.

Security

Data is encrypted in transit, each user can only read their own workspace, and payment details are handled by Stripe. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

Changes

If we change this policy in an important way, we’ll tell you by email or in the app before it takes effect.

Contact

Privacy questions or requests: use the contact page and choose “Privacy request”.