Privacy Policy

1. Who this notice applies to

This notice explains how Sprig handles personal information when you visit getsprig.co.uk, create an account, manage a nursery profile, generate or save content, contact us, or ask to receive updates.

Sprig is currently operated under the Sprig trading name and has not yet been incorporated as a company. For data protection questions or requests, email hello@getsprig.co.uk.

2. Information we collect

Account information: your name, email address, encrypted authentication credentials, account identifiers, and the membership plan you select.

Nursery information: your nursery name, contact details, town or area, specialist provision, preferred tone of voice, and other details you choose to add to your profile.

Content information: answers you enter into template forms, drafts generated for you, content you save, and the date and type of each saved item.

Support and contact information: the contents of messages you send us and the contact details needed to reply.

Technical information: essential session and security data used to keep you signed in and protect the service. Sprig does not currently use advertising or behavioural-tracking cookies.

3. How and why we use information

We use account and nursery information to create and secure your account, provide the member portal, personalise approved templates, save your work, and deliver the features you request. This processing is necessary to provide the service you ask us for.

We use contact information to answer enquiries and provide support. We use limited technical information to prevent misuse, diagnose faults, and keep Sprig reliable and secure. These uses support our legitimate interests in operating and improving the service.

We only send promotional email where we have the permission required by UK data protection and electronic-marketing rules. You can withdraw that permission or unsubscribe at any time.

Where the law requires us to retain or disclose information, we process it to comply with that legal obligation.

4. AI-assisted personalisation

When you ask Sprig to personalise a template, the approved draft and the details needed to personalise it are sent securely to Anthropic's API. Anthropic returns a suggested version, which Sprig checks against protected wording and facts before showing it to you.

AI output can be incomplete or inaccurate. You must review every draft before using it. Sprig does not use AI to make legal or similarly significant decisions about you, your staff, children, or families.

Do not enter children's names, health information, safeguarding information, or other unnecessary sensitive personal data into a template. Use roles or general descriptions wherever possible.

5. Who processes information for us

We use carefully selected providers to operate Sprig. Supabase provides account authentication and database storage. Anthropic provides AI-assisted text generation. Sanity hosts content managed through Sprig's content management system. Our deployment and hosting provider serves the website and application.

These providers process information only to supply their services to us and are subject to their own security and data protection commitments. We do not sell personal information.

Some providers may process information outside the United Kingdom. Where this happens, we rely on an approved transfer safeguard or another lawful transfer mechanism and assess the protection applied to the information.

6. How long we keep information

We keep account, nursery-profile, and saved-content information while your account is active so that the service works as expected.

After an account is closed, we delete or anonymise information when it is no longer needed, subject to limited retention for security, dispute resolution, accounting, or other legal obligations. Support correspondence is kept only for as long as needed to resolve the enquiry and maintain an appropriate record.

Back-up copies may remain for a limited period before being overwritten through routine system processes.

7. Cookies and local storage

Sprig uses strictly necessary browser storage and cookies to authenticate members, maintain secure sessions, and provide requested features. These technologies are essential to the service and do not require consent under the usual UK cookie exemption.

If we introduce analytics, advertising, or other non-essential technologies, we will explain them and request consent before using them where required.

8. Security

We use access controls, encrypted connections, server-side credentials, and database row-level security to reduce the risk of unauthorised access. Members can access only their own profile and saved content through the normal service.

No internet service can guarantee absolute security. Please use a strong, unique password and tell us promptly if you believe your account has been compromised.

9. Your data protection rights

Depending on the circumstances, you may ask for a copy of your personal information, ask us to correct or delete it, restrict or object to its use, or request information in a portable format. Where processing relies on consent, you may withdraw consent at any time.

To exercise a right, email hello@getsprig.co.uk. We may need to verify your identity before acting on a request.

You can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would appreciate the opportunity to address your concern first.

10. Changes to this notice

We will update this notice when the service, our providers, or the law changes. Material changes will be highlighted on the website or communicated to members where appropriate.