tosgenerator — Data Processing Addendum

Effective date: 5 October 2026 · Version 2026-10-05

Changes in this version: Annex III adds OpenRouter, OpenAI and Cloudflare Workers AI as planned Subprocessors for the vendor classifier (not active; no activation date is set, see section 7.2) and lists providers that do not process Customer Personal Data (GitHub, Stripe, Cloudflare Turnstile). PostHog is no longer used: Sprout no longer sends product events to any third party. Annex I now describes repository data and how long server logs are kept. Section 7.2 now says who receives the notice email, and Annex II describes health checks as they work today.

This Data Processing Addendum ("DPA") is part of the tosgenerator Terms of Service (/legal/terms) (the "Terms") between Sprout LLC, 299 NW 46th St, Boca Raton, FL 33431, USA ("Sprout", "Processor") and the customer that accepts the Terms ("Customer"). It applies when Sprout processes Customer Personal Data on behalf of Customer. The Customer accepts this DPA when it accepts the Terms. No signature is needed. If the Customer wants a signed copy, it can write to facundomartin@sproutco.io.

If this DPA conflicts with the Terms, this DPA applies. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses apply.

• Data Protection Laws: all laws on personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws, the Brazilian LGPD (Lei 13.709/2018) and the Argentine Ley 25.326.
• Customer Personal Data: personal data that Sprout processes on behalf of Customer to provide the Service, as described in Annex I.
• Personal Data Breach: a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Subprocessor: a third party that Sprout engages to process Customer Personal Data.
• SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022, as amended).
• Other terms (controller, processor, data subject, processing, business, service provider) have the meaning given by the Data Protection Laws.

2.1. Customer is the controller (or, under the CCPA, the "business") of Customer Personal Data. If Customer acts as a processor for its own client (for example an agency), Customer confirms that its client has authorized Customer's instructions and the use of Sprout, and Sprout is a subprocessor of Customer.

2.2. Sprout is the processor (or "service provider") of Customer Personal Data.

2.3. This DPA does not apply to personal data that Sprout processes as a controller for its own purposes, for example account, billing, security and contract records of Customer's users. The Privacy Policy (/legal/privacy) covers that data.

3.1. Customer is responsible for the lawfulness of the processing, including having a legal basis, giving notices to its website visitors (including that it uses Sprout LLC as its consent-management provider) and configuring the consent banner correctly.

3.2. Customer must not use the Service to process special categories of personal data or data of children, except where Customer has assessed that this is lawful and the Service is suitable.

4.1. Sprout processes Customer Personal Data only on Customer's documented instructions, including for transfers to third countries, unless the law requires otherwise. In that case, Sprout tells Customer before it processes the data, unless the law forbids this.

4.2. The Terms, this DPA and Customer's use and configuration of the Service are Customer's complete instructions. Additional instructions need written agreement.

4.3. Sprout tells Customer at once if, in its opinion, an instruction breaks the Data Protection Laws.

Sprout ensures that every person authorized to process Customer Personal Data is bound by a duty of confidentiality, and accesses the data only when this is needed to provide, secure or support the Service.

Sprout implements the technical and organizational measures in Annex II. Sprout can update these measures if the overall level of security does not decrease.

7.1. Customer gives Sprout a general authorization to engage Subprocessors. The current Subprocessors are listed in Annex III and at tosgenerator.com/legal/subprocessors.

7.2. Sprout gives at least 30 days' notice before it adds or replaces a Subprocessor, by updating the subprocessor page and by email to the owners of paid accounts. Owners of other accounts can ask for these emails at facundomartin@sproutco.io.

7.3. Customer can object on reasonable data-protection grounds within that period by writing to facundomartin@sproutco.io. The parties then discuss the objection in good faith. If they cannot solve it, Customer can end the affected part of the Service before the change takes effect, and Sprout refunds any prepaid fees for the rest of the paid period.

7.4. Sprout imposes on each Subprocessor, by written contract, data-protection obligations that give at least the same level of protection as this DPA. Sprout remains liable to Customer for the performance of its Subprocessors' obligations.

8.1. Data subject requests. Sprout helps Customer, by appropriate technical and organizational measures, to answer requests from data subjects. Customer can view and export consent records in the Service. If Sprout receives a request directly, it sends it to Customer without undue delay and does not answer it, unless Customer instructs otherwise or the law requires it.

8.2. Other assistance. Taking into account the information available to it, Sprout helps Customer with its security obligations, Personal Data Breach notifications, data protection impact assessments and prior consultations (GDPR Articles 32 to 36).

9.1. Sprout notifies Customer without undue delay, and in any case within 48 hours, after it becomes aware of a Personal Data Breach that affects Customer Personal Data.

9.2. The notice includes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact person. Sprout gives further information as it becomes available.

9.3. A notice is not an admission of fault or liability.

10.1. During the term, Customer can ask facundomartin@sproutco.io for a CSV export of its consent records and a copy of its documents. Sprout sends them without undue delay.

10.2. Consent records are deleted automatically at the end of the retention period that Customer chose for its banner (from 1 to 5 years, depending on the plan).

10.3. When Customer deletes its account or the Terms end, Sprout deletes Customer Personal Data within 30 days, unless the law requires Sprout to keep it. For 30 days after the end of the Terms, Customer can ask Sprout for a copy of its data. Copies in backups are deleted when the backup cycle overwrites them, and are protected until then.

11.1. Sprout makes available to Customer the information necessary to demonstrate compliance with this DPA and GDPR Article 28.

11.2. Customer can audit Sprout's compliance once a year, or more often if a supervisory authority requires it or after a Personal Data Breach. Customer must give 30 days' written notice, use an auditor that is bound by confidentiality and not a competitor of Sprout, avoid disruption, and pay its own costs. Sprout can first answer a written questionnaire or provide reports of its providers, if they are sufficient.

12.1. Sprout is in the United States and processes Customer Personal Data in the United States and in the other locations in Annex III.

12.2. EEA. For transfers of Customer Personal Data from the EEA to Sprout, the SCCs are incorporated into this DPA by reference: Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor. The parties make these choices: Clause 7 (docking clause) applies; Clause 9(a) Option 2 (general written authorization) with the notice period in section 7.2; the option in Clause 11(a) does not apply; Clause 13: the supervisory authority determined under Clause 13(a); Clause 17 Option 1: the law of Ireland; Clause 18(b): the courts of Ireland. Annex I and Annex II of this DPA complete Annexes I and II of the SCCs, and Annex III of this DPA completes Annex III of the SCCs.

12.3. United Kingdom. For transfers from the UK, the UK Addendum is incorporated by reference. Table 1: the parties' details are in Annex I. Table 2: the SCCs as incorporated in section 12.2. Table 3: Annexes I to III of this DPA. Table 4: both parties may end the UK Addendum as allowed by its Section 19.

12.4. Switzerland. For transfers from Switzerland, the SCCs apply with these changes: the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; references to the GDPR include the Swiss FADP; and the term "member state" does not exclude data subjects in Switzerland from suing in their place of habitual residence.

12.5. Brazil and Argentina. Where the LGPD or Ley 25.326 requires a specific transfer mechanism, the parties agree to the standard contractual clauses approved by the ANPD (Resolução CD/ANPD 19/2024) or by the Argentine authority (Disposición 60-E/2016), as applicable, which are incorporated by reference, with the details of the Annexes to this DPA.

12.6. If Sprout certifies under the EU–US Data Privacy Framework (or its UK or Swiss parts), Sprout can rely on that certification instead, and tells Customer.

13.1. Sprout is Customer's service provider (and processor) and processes Customer Personal Data only for the business purposes in Annex I.

13.2. Sprout does not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes in Annex I, including for any commercial purpose other than providing the Service; (c) retain, use or disclose it outside the direct business relationship between Sprout and Customer; or (d) combine it with personal data that Sprout receives from or on behalf of another person, or collects from its own interaction with the consumer, except as the CCPA allows for service providers.

13.3. Sprout complies with the CCPA and gives the same level of protection that the CCPA requires of Customer. Sprout tells Customer if it can no longer meet its obligations. Customer can take reasonable steps to stop and fix unauthorized use, including by the audit in section 11. Sprout certifies that it understands and will comply with the restrictions in this section.

The liability of each party under this DPA is subject to the limitations in the Terms, except where the Data Protection Laws or the SCCs do not allow such a limitation towards data subjects.

This DPA applies as long as Sprout processes Customer Personal Data. Sections 10 and 12 continue after the end of the Terms until Sprout has deleted all Customer Personal Data.

---

A. Parties

• Data exporter: Customer, as identified in its account. Contact: the account owner's email. Role: controller (or processor for its client). Activities: use of the tosgenerator Service.
• Data importer: Sprout LLC, 299 NW 46th St, Boca Raton, FL 33431, USA. Contact: facundomartin@sproutco.io. Role: processor (or subprocessor). Activities: providing the tosgenerator Service.

B. Description of the processing

Hosted documents and the consent banner are not offered to new customers. References to generated documents, hosting, embeds and consent records describe existing customer use only.

C. Competent supervisory authority: as determined by Clause 13 of the SCCs.

• Encryption in transit: HTTPS/TLS for all public endpoints, HSTS in production.
• Data minimization: consent records do not store the visitor's IP address or full user agent; the scanner does not store page content, cookie values or form values.
• Access control: deny-by-default authorization for every action; strict tenant isolation in the database layer with automated isolation tests; roles inside each organization; administrator access limited to named staff, with a reason, a visible banner and an audit record for impersonation.
• Authentication: single-use sign-in links that expire in 15 minutes, bcrypt password hashes with a 12-character minimum, rate limits, session list with revoke, re-authentication for sensitive changes, signed and encrypted session cookies.
• Audit: append-only audit log (the database rejects changes and deletions).
• Network and infrastructure: application and database on a private network; the database port is not exposed to the internet; Cloudflare network protection; bot protection on public forms; origin checks and rate limits on the public consent endpoints.
• Application security: content security policy with per-request nonces, CSRF protection, secure headers, input validation, upload checks; automated dependency audits and static security analysis in every release.
• Secrets: credentials kept only in the deployment environment, never in source code.
• Resilience: immutable published editions; health checks that a new release must pass before it receives traffic.
• Personnel: confidentiality duties; access only when needed.
• Incident response: documented process to assess, contain and notify Personal Data Breaches (section 9).
• Deletion: automatic deletion of consent records at the end of the retention period; deletion of tenant data after account deletion (section 10).

Hosted documents and the consent banner are not offered to new customers. References to generated documents, hosting, embeds and consent records describe existing customer use only.

The list of providers that do not process Customer Personal Data is new; Cloudflare Turnstile moves to that list.

Providers that do not process Customer Personal Data (listed for transparency; they are not Subprocessors under this DPA):

Sprout does not send Customer Personal Data to AI providers. The planned vendor classifier would send only the data in the OpenRouter, OpenAI and Cloudflare Workers AI rows, and Sprout turns it on only after the notice period in section 7.2.

Status on 5 October 2026: OpenRouter, OpenAI and Cloudflare Workers AI remain not active. No activation date is set. Any activation requires the notice in section 7.2, and Customer can object under section 7.3 by writing to facundomartin@sproutco.io.