DRAFT – complete before launch. This is a template, not legal advice. Placeholders in brackets must be filled in and the text reviewed before payments go live.

Privacy Policy

Updated: 15.11.2026

How SproutMindAI processes personal data under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller is Sami Uotinen (private individual), Loviisa. There is no Finnish business ID (Y-tunnus) yet; these details will be updated when a company is founded. Privacy contact: [email protected]. No phone number is published. No data protection officer has been appointed.

2. Data we process

Account: email and password hash. Optional profile details: name, phone number, company or farm, and municipality – the phone number is optional, used only for account-related contact, visible only to you and never sent to the AI provider; you can change or remove these on the Account page. Subscription: plan, period, status and payment-provider IDs (no card data – handled by Paddle). Usage counts per month. AI requests (questions, photos) are sent to xAI / SpaceX Super Intelligence LLC (United States, api.x.ai) to generate answers and are not stored on our server; Zero Data Retention is enabled (Active) as of 15 November 2026. Blocks, rotation plans, diary entries and field boundaries are stored on our server, linked to your account, while you are signed in, and are deleted when you delete your account; without signing in, blocks and reminders stay in your browser only. Feedback you send (and an optional email address) is stored on our server. Password reset: if you request a new password, we process your email address and the message content to send a transactional reset email. Country choice stays in your browser only. There is no general request log (IP address, browser). IP addresses are stored only in the admin audit log, retained for 2 years.

3. Purposes and legal bases

Providing the service and subscription (contract, Art. 6(1)(b)); security and abuse prevention (legitimate interest, 6(1)(f)); accounting obligations (legal obligation, 6(1)(c)) – bookkeeping of Pro payments is handled by Paddle as merchant of record.

4. Recipients

Hetzner Online GmbH (server in Helsinki, EU; DPA accepted in the account on 15 November 2026). Cloudflare, Inc. (DNS, tunnel, proxy and encrypted R2 backups; the R2 bucket uses the default location, not an EU jurisdiction; the customer DPA is part of the self-serve agreement and was saved on 15 November 2026). Paddle (payments, invoicing, VAT and bookkeeping of Pro payments). xAI / SpaceX Super Intelligence LLC (AI answers; transfers to the US under the DPA and Standard Contractual Clauses; Zero Data Retention enabled, status Active, on 15 November 2026). Brevo (Brevo SAS / Sendinblue SAS, France) for password-reset transactional email from [email protected] (recipient email, message content and sending metadata); DPA in the terms of service: https://www.brevo.com/legal/termsofuse/ ; GDPR: https://www.brevo.com/gdpr/ . UptimeRobot s. r. o. (Slovakia) for uptime monitoring of https://app.sproutmindai.com/api/health; it does not process end-user personal data, only the monitored URL and the controller’s alert email; DPA: https://uptimerobot.com/dpa/ . Weather data: Open-Meteo (api.open-meteo.com, geocoding-api.open-meteo.com, archive-api.open-meteo.com) and the Finnish Meteorological Institute open WFS (opendata.fmi.fi/wfs). Satellite imagery: Element 84 Earth Search (https://earth-search.aws.element84.com/v1) and public Sentinel-2 L2A files on AWS. Ecowitt: local push to our server, or Fine Offset Electronics cloud (api.ecowitt.net) only if you connect it yourself.

5. Retention

Account data until deletion; usage counts are deleted after 12 months; payment bookkeeping is handled by Paddle. Delete your account on the Account page. Encrypted backups are kept 14 days on the server and 30 days on the controller’s computer and in Cloudflare R2. The R2 bucket uses the default location, not an EU jurisdiction; copies are encrypted with an age key. The admin audit log is retained for 2 years.

6. Cookies and storage

pc_session (essential login cookie), NEXT_LOCALE (language). No advertising or tracking cookies. Analytics are not in use.

7. Your rights

Access, rectification, erasure, restriction, objection and portability. You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

8. Security

Passwords are stored as bcrypt hashes; sessions are signed; HTTPS in production. Access to the production server is limited to the controller’s computer via an SSH key. Backups are encrypted with an age key.

9. Changes

This policy is updated as the service changes.