Privacy Policy

01The short version#

• Your content is yours.We process it to run SproutSage for your organization. We do not sell it or use it for advertising.
• No model training.We do not use your content — or any data from Google or Microsoft — to train generalized AI models.
• Private stays private.Your personal Space is sealed from your organization’s administrators, and every organization is isolated from every other.
• Meeting audio stays on your Mac.The Mac app transcribes on the device. Raw audio is never uploaded.
• We read what you connect.Sources are opt-in, and mail is saved one thread at a time or from a mailbox you connect yourself.
• You can delete it.Remove your email, delete a personal Space, or ask us to delete your whole workspace.

02Who we are and what this covers#

SproutSage is a knowledge engine for teams: it reads the sources an organization connects, describes each document, and answers questions with citations back to those documents. It is provided by SproutSage LLC, of San Jose, California (“SproutSage”, “we”).

This policy covers the web app at app.sproutsage.com, the API and MCP endpoint at api.sproutsage.com, the SproutSage Mac and iPhone apps, the browser clipper, and the Gmail and Outlook add-ons.

Two roles. For the content an organization brings into SproutSage, we act on that organization’s behalf and under its instructions (as a “processor” or “service provider”); the organization decides what is connected and who can see it. For account details, the waitlist and the security of the service, we decide how the data is used (as a “controller”). If your employer gave you access, questions about your organization’s content are best sent to your administrator first.

03What we collect#

When you sign in

You sign in with Google or Microsoft. SproutSage asks only for the basic sign-in scopes (openid, email, profile) and keeps your email address, your name and the provider’s account identifier. We have no passwords: we never see or store one.

When you join the waitlist

Your name, email address and, if you give them, your company and what you would use SproutSage for.

What your organization connects

Sources are connected deliberately, by a person, and each reads only what that connection allows:

• Google Drive — the files and file details inside the one folder chosen when connecting, kept up to date as they change.
• Slack — messages in the public channels the SproutSage bot has been invited to, and workspace member profiles (including email addresses, so a person in Slack can be matched to the same person elsewhere). It cannot read private channels or direct messages, cannot join channels by itself, and cannot post.
• An Outlook mailbox — only your own, only if you connect it: recent mail is read so that customer conversations can be saved (see Email).
• Email threads you save from the Gmail or Outlook add-on, or forward to your personal capture address, and mail you send to your personal notes address.
• What you create — notes, files and images attached to them, pages you clip with the browser clipper, documents pushed through the API, and meeting transcripts from the Mac app.

What SproutSage derives from it

To make your content answerable, SproutSage writes a short summary of each document (an “index card”), computes a numeric representation of its meaning (an “embedding”), extracts the people, companies and records it mentions, and composes answers with citations when someone asks a question.

Accounts built from engagement (optional)

An organization without a CRM can turn on Build accounts from engagement. It is off unless an administrator turns it on. While it is on, SproutSage notes which external companies each member exchanges email, meetings, meeting transcripts and tickets with — the company’s email domain, the names and addresses of the people there, how many conversations and when — and suggests them to that member as possible customer accounts. Personal email providers, the organization’s own domains and automated senders are never counted, and no message content is kept for a suggestion.

A member’s suggestions are visible to that member only: not to colleagues and not to administrators, who see totals. Nothing is shared until the member adds a company as an account; then the company and the people they dealt with become shared records in the organization’s customer Space, and their recent and future customer mail and meetings are filed there through the same screening as any other. A company marked “not a customer” is never suggested to that member again and its details are deleted. Unreviewed evidence older than 90 days is deleted.

When you ask questions

Each question, its answer and the documents it cited are logged so that your administrators can review answer quality. The log records who asked as a pseudonymous hash, not as an email address, and expires after 90 days.

Technical data

Like any web service, our servers see the IP address and request details of each connection, which appear in short-lived operational logs. We use no analytics, advertising or tracking tools, in the web app or the Mac and iPhone apps.

04How we use it#

We use the information above only to:

• provide SproutSage to your organization: sign you in, sync your sources, summarize and index your content, and answer your questions;
• enforce who can see what, keep the service secure and prevent abuse;
• support you and fix problems you report;
• decide on and reply to waitlist requests;
• meet legal obligations.

We do not sell personal information, we do not share it for advertising, and we do not use your content to train or fine-tune any AI model.

05AI processing#

SproutSage uses two AI providers. Each receives content only to return a result to us:

• Anthropic (Claude models) receives document text to write summaries and extract people, companies and records; the question and the relevant passages to compose an answer; and the minimized email content described below to classify mail.
• Voyage AI receives document text (title, summary and content, truncated) and each question, to compute embeddings for search.

Email sent for classification is minimized first: senders and recipients are described by role rather than by address, people by first name, and only the new text of a message is sent — no attachments, quoted history or signatures.

Neither SproutSage nor these providers use your content to train generalized AI models. Answers are generated, and can be wrong; each one cites the documents it relied on so you can check it (see our Terms).

06Data from Google#

Google user data is used only to provide the features described below to the person who granted access. It is not sold, not used for advertising, not used to train generalized AI models, and not read by people at SproutSage except with your permission, for security, or where the law requires it.

The Gmail add-on does not read your mailbox in the background, apply labels or send mail. You can remove SproutSage’s access at any time from your Google Account’s third-party connections page.

07Data from Microsoft#

Every Microsoft permission SproutSage uses is delegated: it acts only as the person who signed in, only on that person’s own data, and only after that person consents. SproutSage requests no application permissions, so it cannot read anyone’s mailbox on an administrator’s say-so. Microsoft data is not sold, not used for advertising and not used to train generalized AI models.

You can disconnect your mailbox in SproutSage at any time, and remove SproutSage’s access from your Microsoft account’s apps page.

08Email#

Email is the most personal thing SproutSage can read, so it has the narrowest rules:

• Opt-in, per person. Only you can connect your mailbox; an administrator cannot connect someone else’s.
• Saved, not swept up. Customer threads go to your organization’s customer Space, where the people with access to it can read them. Anything else you save stays in your private Space.
• Administrators see less, not more. Mail waiting for your review is visible only to you. Mail SproutSage does not save is not stored — only a hashed record that it was handled, so it is not read twice.
• Inbox Labels keeps no mail. It records which label was applied to which message by a one-way hash of the message ID, for 90 days. It never stores the bodies, subjects or addresses of the mail it labels. Feedback you give is kept as features without text for one year; a message is kept as an example only when you choose “Use as example”.
• Your capture address. Where enabled, you can forward or Bcc mail to a personal address. We accept only mail from an authenticated sender who is a member of your organization. Raw mail is deleted as soon as it is processed; mail held for your review is deleted when you decide, or after 30 days if you do not.
• Ticket addresses. Where your organization turns them on, mail sent to its ticket address (for example a forwarded support@) or to one ticket’s address opens or updates a ticket. Such mail may come from your customers. Mail from an authenticated member of your organization, or from an authenticated sender your CRM already lists as a customer, is saved as an email thread in the Space the address files into — its sender, recipients, subject, date and text, readable by everyone with access to that Space — and linked to the ticket. Mail from anybody else, and bulk or automated mail, is not filed: bulk and automated mail is dropped unread, and other mail waits, raw copy included, in an “Unsorted” list that the Space’s readers can see until one of them accepts it into a ticket or discards it (deleting it), or for 30 days.
• Your notes address. Where enabled, mail you send to your personal notes address becomes a note, with its attachments, in your personal Space — which only you can read — and nowhere else. We accept it only from your own authenticated address. It is not sorted or classified; the raw mail is deleted as soon as the note is written, and the note is kept until you delete it.
• Deletions follow you. A message deleted in a connected mailbox is withdrawn from SproutSage. “Remove my email” deletes every message that only you contributed, along with your waiting reviews; messages a colleague also saved stay with them.

09The Mac and iPhone apps, and the clipper#

Meetings (Mac)

The Mac app can record a meeting you are in. Transcription happens on your Mac, and raw audio is never uploaded. The audio lives in a temporary file until the transcript is ready, then is deleted; if you choose “keep audio locally”, it stays on your Mac and is deleted after 30 days. Before each recording you confirm that you have told the other people in the meeting.

When you are signed in, the reviewed transcript is sent to your workspace together with the meeting’s title, time, duration and attendees (names and, where your calendar has them, email addresses), and the join link without its passcode. Live captions are never stored. The iPhone app does not record meetings.

What stays on the device

Both apps keep your notes, a cache of recently opened documents and a queue of changes waiting to sync in a local database, and your sign-in tokens in the device’s Keychain, never synced through iCloud. Signing out erases the document cache. On iPhone the local database is protected by iOS data protection and is included in your device backups; on the Mac it is protected by the app sandbox and by FileVault if you use it.

Signed out, the apps send nothing to SproutSage. The one other network request the Mac app makes is downloading its speech model from Hugging Face, when you ask it to; that download carries none of your content.

What syncs

Signed in, the apps send your notes, their attachments, meeting transcripts, shared items and the files in folders you choose to sync, to your workspace — into your private Space unless you choose another.

The browser clipper

The clipper reads a page only when you click it, use its shortcut or its menu item. It then sends that page’s address, title, readable text and your note to your workspace. It has no access to other tabs and runs nothing on pages in the background.

10Who can see your content#

• Spaces decide access. Content lives in Spaces. A person sees a Space’s content only if they have been given access to it; being an administrator does not, by itself, grant access.
• Personal Spaces are sealed. Your personal Space is readable only by you. Administrators can see that it exists (its owner, how many documents it holds and when it was created) and can delete it when someone leaves, but cannot open it, search it or change anything inside it.
• Organizations are isolated. Every request is scoped to one organization in our code, and the database enforces the same boundary underneath with row-level security on every organization-owned table.
• Apps act as you. An API key or an app you approve can read exactly what you can read, and stops when your access does.

Outside your organization, we share data only with the subprocessors below, when the law requires it, or with a successor if SproutSage is sold or merged — in which case this policy continues to apply and we will tell you.

11Subprocessors#

These companies process data on our behalf to run SproutSage today:

Google, Microsoft and Slack are where your sources live and how you sign in: SproutSage reads from them when you connect them, under their own privacy terms. Apple distributes the Mac and iPhone apps through TestFlight. Our web pages load fonts from Google Fonts, which sees your browser’s IP address.

Before we add a subprocessor — for example a provider to receive mail for capture addresses, or another AI model provider — we will update this list and announce the change before it processes any customer data.

12Retention and deletion#

Your content is kept while your organization uses SproutSage, unless it is deleted sooner. Some things expire on their own:

Deleting things

• Remove my email (in SproutSage’s mail settings) deletes every message only you contributed, your waiting reviews and your counts of unrecognized sender domains, at once.
• Disconnecting your Outlook mailbox deletes its stored credential, sync state and label records at once. Threads already saved to a shared Space stay there for your colleagues.
• Deleting a personal Space — what an administrator does when someone leaves — deletes everything in it at once and permanently; its files are removed by a background job moments later.
• Deleting a document at its source (a Drive file, a message in a connected mailbox) takes it out of SproutSage’s search and answers on the next sync. The stored copy is kept, marked deleted, so earlier citations still resolve, until its Space or workspace is deleted.
• Your whole workspace, or your account: write to privacy@sproutsage.com from an administrator’s address. We delete the workspace’s content, credentials and accounts and confirm when it is done. To disconnect Google Drive or Slack, ask us, or revoke SproutSage’s access in your Google account or Slack workspace.

Deleted data can remain in our hosting provider’s database backups for up to about four weeks before those backups expire.

13Security#

• In transit. Connections to SproutSage use HTTPS (TLS), and SproutSage’s own connections to its providers and database are encrypted too.
• Credentials are encrypted by us. The tokens that let SproutSage read your sources are envelope-encrypted (XChaCha20-Poly1305, with a per-credential key wrapped under a master key that is never written to disk) and bound to your organization, so one cannot be decrypted as another’s.
• Secrets are never stored in readable form. API keys, access and refresh tokens and capture addresses are stored only as keyed hashes.
• Isolation. Organizations are separated both in our code and by database row-level security, and personal Spaces are sealed from administrators by the database itself.
• Sessions. Your session cookie is HTTP-only, secure and same-site, and holds only a random identifier.

No system is perfectly secure. SproutSage does not currently hold a SOC 2 report or other third-party security certification. If we learn of a breach affecting your data, we will tell you without undue delay and as the law requires. Report a vulnerability to privacy@sproutsage.com.

14International transfers#

SproutSage stores data in the United States. Our subprocessors may process it in other countries where they operate. Where the law requires a transfer mechanism — for example for data from the European Economic Area, the United Kingdom or Switzerland — we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

15Your choices and rights#

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how it is used, and to complain to a data-protection authority. We do not sell or “share” personal information for cross-context advertising, and we do not use it for automated decisions with legal or similarly significant effects.

To use a right, write to privacy@sproutsage.com. If your organization gave you access, we may pass your request to it, because it decides what happens to its content; we will help it respond. We will not treat you differently for using a right.

16Children#

SproutSage is a tool for work and is not for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, write to privacy@sproutsage.com and we will delete it.

17Cookies#

SproutSage sets one cookie: a session cookie, when you start to sign in, that keeps you signed in. It is strictly necessary, so there is no banner asking about it. We use no analytics, advertising or tracking cookies, and the homepage and these legal pages set no cookies at all.

18Changes to this policy#

When this policy changes, the date at the top changes with it. If a change is material — a new subprocessor, a new use of your data, a longer retention period — we will tell workspace administrators before it takes effect.

19Contact#

SproutSage LLC · San Jose, California · postal address on request at legal@sproutsage.com