Sprout Privacy Notice.
Last updated: 10 November 2026
Sprout is a website assistant. Businesses put it on their own websites, and sometimes on their WhatsApp, text and phone numbers, to answer questions from their own content, take enquiries and pass people to their team. Sprout is provided by Fertile Frog Limited, trading as Fertile.Digital (“Fertile”, “we”, “us”), a company registered in England and Wales with company number 08292824, whose registered office is 165 Garstang Road, Fulwood, Preston, PR2 3BH.
This notice explains what personal information we handle, why, and what your rights are. It is written to be read, so it is in plain English.
1. Which part applies to you
| You are | Read |
|---|---|
| Someone who chatted with an assistant on a business's website, or messaged or called a business and an assistant replied | Section 2 |
| Someone who signs in to Sprout for an agency or a business | Section 3 |
| Someone who visited our own website, contacted us or buys Sprout from us | Section 4 |
Sections 5 to 11 apply to everyone.
2. If you used an assistant on a business's website, WhatsApp, text or phone
Whose assistant it is. The assistant belongs to the business whose website or number you used. That business decides why and how your information is used: in data protection law it is the “controller”. We run the assistant on its behalf as a “processor” (where the business bought Sprout through an agency, the agency is the processor and we are its sub-processor). The business’s own privacy notice tells you how it uses your information, and it is the right place to start with any question or request.
You are talking to an AI. The assistant is an automated AI system, not a person. It says so in the chat window and at the start of a call. It answers from the business’s own website content and can make mistakes. If you ask for a person, or it cannot help, it gives you the business’s contact routes or passes you to their team.
What is processed, and what is kept.
| Information | What happens to it | How long we keep it |
|---|---|---|
| What you type or say | Sent to our AI providers to write the answer (section 5). | Not kept. The conversation is held in your own browser while the page is open. On WhatsApp, text and phone it is held in our server's memory for up to 30 minutes so the assistant can follow the conversation, then forgotten. |
| Contact details you give when you ask to be contacted or to book (name, email, phone number, what you want) | Passed straight to the business's own systems (for example its enquiry inbox, CRM or booking diary). | Not kept, with one exception: if the business has switched on "retry", details that could not be delivered are held in encrypted form for up to 24 hours so they can be sent again, then deleted. The chat window tells you when this applies. |
| The phone number you message or call from | Used to reply to you and, if you ask for a call back, passed to the business. | Not kept by Sprout. Our phone and messaging providers keep their own records (section 5). |
| Messages in a live chat with the business's team | Shown to the team members answering you. | Deleted when the chat ends, and after 24 hours at most. |
| The questions you asked, with contact details automatically removed | Only if the business has switched this on: shown to the business so it can improve its website and answers. The chat window tells you when this applies. | 30 days. |
| Anonymous usage records (that a question was asked, whether it was answered, a topic label such as "pricing", and a random number that groups one visit's questions) | Used for the business's reports and to run and improve the service. They do not identify you. | 90 days. |
What we do not do. We do not keep transcripts or recordings. We do not record calls. We do not sell your information, use it for advertising, or use it to train AI models. We do not build a profile of you or track you across websites.
In your browser. The chat window does not set cookies. It keeps a random number and a note that the window has been opened in your browser’s session storage, which is cleared when you close the tab. It is needed for the chat to work and is not used to track you.
Lawful basis. This is for the business to state in its own privacy notice, because it is the controller.
3. If you sign in to Sprout for an agency or a business
For this information we are the controller.
| Information | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Your name, work email address, the organisation you belong to and your role | To give you access to the right clients and nothing else | Performance of our contract with your organisation; our legitimate interest in keeping the service secure | While your organisation has an account and you have access. Removed within 30 days of your access, or the account, ending |
| Sign-in records (when you signed in, security checks such as multi-factor authentication) | To keep accounts secure and investigate misuse | Legitimate interests | While you have access |
| A record of certain settings you change, with your email address and the date (for example switching on a feature that needs a client's agreement) | To keep an accurate record of who agreed what | Legitimate interests; legal obligation where we must be able to show compliance | For as long as the client's account exists |
| Messages you send us for support | To help you | Performance of contract; legitimate interests | 3 years |
Sign-in for agencies is handled by Fertile’s account service (“Fertile ID”). The Sprout dashboard uses cookies that are needed to keep you signed in and remembers your display preferences (such as light or dark theme) in your browser. It uses no advertising or analytics cookies.
4. If you visit our website, contact us or buy Sprout from us
Our own website is fertile.digital. Its privacy policy, at fertile.digital/privacy-policy, covers visiting that site, its cookies, enquiries and marketing. In summary, for people who contact us about Sprout or buy it:
| Information | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Your name, email address and what you tell us when you get in touch | To reply and, if you ask, to tell you about Sprout | Legitimate interests; consent where the law requires it for marketing | 3 years. Marketing contacts: until you unsubscribe, plus 1 year |
| Billing contacts and invoices (held in our accounting and payment systems: QuickBooks, GoCardless and PayPal) | To take payment and keep accounts | Performance of contract; legal obligation (tax and accounting records) | 7 years |
5. Who we share information with
We use the companies below to run Sprout. Each acts only on our instructions, under a written agreement. None may use your information for its own purposes.
| Company | What for | Where | When |
|---|---|---|---|
| Supabase | Database | United Kingdom (London) | Always |
| Vultr | The servers Sprout runs on | United Kingdom (London) | Always |
| Anthropic | Writing the assistant's answers. Does not train its models on this data. | United States | Always |
| Voyage AI | Searching the business's content for the answer. Does not train its models on this data. | United States | Always |
| Twilio, including Amazon Polly for the spoken voice | Phone calls, texts and speech recognition | United States | Only where the business uses phone or text |
| Meta Platforms | WhatsApp messages | United States | Only where the business uses WhatsApp |
Twilio and Meta keep their own records of calls and messages under their own retention settings.
Services that a business connects to its own assistant, such as its CRM or booking diary, belong to that business. Sprout sends your details to them because the business has asked it to, and the business’s privacy notice covers them.
We may also share information where the law requires it, or with a buyer or successor if the Sprout business is sold or reorganised, under the same protections.
6. Information sent outside the United Kingdom
Our database is in London. Some of the companies in section 5 process information in the United States. Where they do, the transfer is covered by a recognised safeguard: the UK Extension to the EU-US Data Privacy Framework where the company is certified, otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for a copy.
7. How we protect information
Information is encrypted when it is sent. Each business’s data is kept separate in the database, enforced by the database itself and tested automatically before every change to the service. Access is limited to named people, with multi-factor authentication. Passwords and access keys for a business’s connected services are encrypted with a key held separately from the database. We keep as little about visitors as we can, and what we do keep is deleted automatically (section 2).
8. Automated decisions
The assistant’s answers are produced automatically. Sprout does not make decisions about you that have legal or similarly significant effects: it answers questions, takes your details when you offer them, and passes you to a person.
9. Children
Sprout is a business service and is not aimed at children. Businesses decide which websites the assistant appears on.
10. Your rights
You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to its use, to move it elsewhere, and to withdraw consent where we rely on it. These rights are not absolute; we will tell you if one does not apply.
- If you used an assistant (section 2): contact the business whose assistant it was. It is the controller, and Sprout keeps very little about you. If you contact us instead, we will pass your request to that business.
- If sections 3 or 4 apply: contact us at hello@fertile.digital, or write to Fertile.Digital, Office 1, Strawberry Fields Digital Hub, Euxton Lane, Chorley, PR7 1PS. We will reply within one month.
You can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We would welcome the chance to put things right first.
Our ICO registration number is 00045894328. We have not appointed a data protection officer; privacy questions go to the address above.
11. Changes to this notice
We will update this notice when Sprout changes how it handles information, and change the date at the top. If a change is significant we will tell the agencies and businesses that use Sprout before it takes effect.