Skip to content
Check my policy

tosgenerator — Privacy Policy

Version 3 · in force since 5 Oct 2026

Effective date and last updated: 5 October 2026 · Version 2026-10-05

Changes in this version: tosgenerator is a website and repository monitor. We describe scans, policy comparisons and monitoring. Hosted documents and the consent banner are not offered to new customers. References to generated documents, hosting, embeds and consent records describe existing customer use only. The vendor classifier and its AI providers are not active. We no longer use PostHog and we no longer send product events to any third party. We also name GitHub, if you connect a repository, and we correct retention periods, Cloudflare Turnstile and Global Privacy Control to match our systems.

This policy explains how Sprout LLC ("we", "us") collects and uses personal data when you visit tosgenerator.com, create an account, use the Service or contact us. It applies to our own customers, their team members and the visitors of our website.

This policy does not cover the visitors of our customers' websites. For an existing customer using our consent banner or hosted documents, the customer decides how its visitors' data is used, and we process that data only for the customer (see section 4). If you visited a website that uses our banner, read that website's privacy policy and contact that website first.

1. Who we are

The controller of your personal data is Sprout LLC, a Delaware limited liability company, 299 NW 46th St, Boca Raton, FL 33431, USA. Email: facundomartin@sproutco.io. Phone: +1 (786) 375-8064.

For privacy questions or requests, write to facundomartin@sproutco.io. This address is also our contact for data protection matters under the Brazilian LGPD (encarregado channel).

2. Personal data we collect

Category
Account data
Examples
Name, email address, password (stored only as a secure hash), language, organization name, role, team invitations, your optional answer to "How did you find us?" (for example the AI assistant and the question you asked it)
Source
You, your team
Category
Business information
Examples
The legal name, address, contact email and other answers that you give for your documents
Source
You
Category
Website and scan data
Examples
Website addresses that you submit, scan results (cookie names, script and provider addresses, page addresses, form field types). We do not store page content, cookie values or form values.
Source
The scanner, from public web pages
Category
Repository data (only if you connect GitHub)
Examples
The GitHub account and the repositories that you choose, file paths and package names found in them, and data about changes (branch, commit IDs, pull request number, the GitHub user name of the author). We read files in memory and do not keep their content.
Source
GitHub, through the GitHub App that you install
Category
Anonymous scan
Examples
Website address, the email address you give us for scan notices, your choice about optional product emails
Source
You
Category
Billing data
Examples
Billing name and address, tax ID, plan, invoices, payment status, last four digits and brand of your card
Source
You, Stripe
Category
Contract and consent records
Examples
The version of the Terms, Privacy Policy and refund policy that you accepted, your automatic-renewal and immediate-access consents, with date, time, IP address and browser user agent; Stripe customer and session IDs
Source
You, our systems
Category
Usage and security data
Examples
Sign-ins and sessions (time, IP address, user agent, device), actions in the account (for example publications, downloads, banner installation), audit records, security and error logs
Source
Your device, our systems
Category
Communications
Examples
Emails and support requests, refund, cancellation and withdrawal requests, requests to join the GitHub beta waitlist or our open source program (with the repository and website addresses and the details you give), and our answers; delivery data for our emails (for example message IDs)
Source
You, our email provider
Category
Bot protection
Examples
When you use our public scan form or policy check form: the browser and device signals that Cloudflare Turnstile checks, the check result and your IP address
Source
Your device, Cloudflare

We do not ask for sensitive personal data (for example health data). Do not put it in your answers or documents unless your document needs it.

3. Why we use your data and our legal bases

The legal bases apply if the EU or UK GDPR applies to you. The LGPD bases apply if Brazilian law applies to you.

Purpose
Create and manage your account, provide the Service (scans, policy comparisons, website and repository monitoring; existing documents, hosting and banners only)
Data
Account, business, scan, repository, usage
Legal basis (EU/UK GDPR)
Contract (Art. 6(1)(b))
LGPD basis
Contract (art. 7, V)
Purpose
Send notices about the scan you requested
Data
Anonymous scan data, email
Legal basis (EU/UK GDPR)
Contract / steps at your request (Art. 6(1)(b))
LGPD basis
Contract (art. 7, V)
Purpose
Take payments, issue invoices, keep accounting records
Data
Billing, contract records
Legal basis (EU/UK GDPR)
Contract and legal obligation (Art. 6(1)(b), (c))
LGPD basis
Contract; legal obligation (art. 7, II, V)
Purpose
Send service emails (sign-in links, receipts, renewal reminders, cancellation confirmations, scan and monitoring notices)
Data
Account, billing, usage
Legal basis (EU/UK GDPR)
Contract; legal obligation for consumer-law notices (Art. 6(1)(b), (c))
LGPD basis
Contract; legal obligation
Purpose
Keep records of your acceptance and consents, prove the contract, defend chargebacks and legal claims
Data
Contract records, usage, communications
Legal basis (EU/UK GDPR)
Legal obligation; legitimate interests in proving the contract and defending claims (Art. 6(1)(c), (f))
LGPD basis
Legal obligation; regular exercise of rights (art. 7, II, VI)
Purpose
Keep the Service secure, prevent fraud and abuse, enforce our Terms
Data
Usage and security, bot protection
Legal basis (EU/UK GDPR)
Legitimate interests in security and fraud prevention (Art. 6(1)(f))
LGPD basis
Legitimate interests (art. 7, IX)
Purpose
Answer support requests
Data
Communications, account
Legal basis (EU/UK GDPR)
Contract; legitimate interests (Art. 6(1)(b), (f))
LGPD basis
Contract; legitimate interests
Purpose
Send optional product emails (only if you opted in)
Data
Email, preferences
Legal basis (EU/UK GDPR)
Consent (Art. 6(1)(a))
LGPD basis
Consent (art. 7, I)
Purpose
Comply with the law and answer valid requests of authorities
Data
Any relevant data
Legal basis (EU/UK GDPR)
Legal obligation (Art. 6(1)(c))
LGPD basis
Legal obligation

Where we rely on legitimate interests, we have weighed them against your rights. You can object (section 9). Where we rely on consent, you can withdraw it at any time with the link in each email or by writing to us. Withdrawal does not affect use before it.

If you do not give us the data that we need for the contract (for example your email address), we cannot provide the Service.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Stripe uses automated fraud checks on payments under its own policy.

4. Data we process for our customers

Hosted documents and the consent banner are not offered to new customers. References to generated documents, hosting, embeds and consent records describe existing customer use only. When an existing customer uses the consent banner, we store consent records for that customer: a random consent ID, the visitor's choices, the date and time, the banner version, the browser family and whether a Global Privacy Control signal was present. We do not store the visitor's IP address or full user agent with these records. When a visitor views a hosted document, our servers receive normal technical data (such as the IP address) to deliver the page. For this data, the customer is the controller and we are its processor. Our Data Processing Addendum (/legal/dpa) governs it.

5. Who receives your data

We do not sell your personal data. We do not share it for cross-context behavioral advertising.

We share personal data only with:

  • Service providers (processors) that help us run the Service, under contracts that limit their use of the data. The current list is in our subprocessor list (/legal/subprocessors). The main providers are DigitalOcean (hosting and database, USA), Cloudflare (network, security, Turnstile bot protection on our public forms, email routing), Postmark (email delivery) and Stripe (payments).
  • Cloudflare, Inc. (USA) runs Turnstile, the bot check on our public scan form and policy check form. Your browser loads the check from Cloudflare, so Cloudflare receives your IP address and browser and device signals. To confirm the check, our server sends Cloudflare the check result and your IP address. We use the answer only to stop automated abuse.
  • GitHub, Inc. (USA), only if you connect a repository. We read the repositories that you choose through the GitHub App that you install. If you turn this option on, we post checks or issues to those repositories. Your agreement with GitHub governs the data in your GitHub account.
  • OpenRouter (USA), OpenAI (USA) and Cloudflare Workers AI are listed for the planned vendor classifier. They are not active and receive no scan data from us. The planned input is limited to vendor domains, cookie names and script hosts, never personal data, page content, cookie values, form values or account data. Activation requires the notice described in the DPA, section 7.2; no activation date is set.
  • Stripe also acts as an independent controller for some payment data, for example to prevent fraud and to meet its legal duties. See stripe.com/privacy.
  • Your organization. Owners and members of your organization can see the account data and the content of that organization.
  • Professional advisers (lawyers, accountants, auditors) under confidentiality duties.
  • Authorities and courts, when the law requires it, or to establish, exercise or defend legal claims, including card-network chargeback procedures (we send your bank the records listed in section 2 that are relevant to the dispute).
  • A buyer or successor of our business, if we sell or reorganize it. The successor must protect your data as described in this policy.

6. International transfers

Sprout LLC is in the United States, and we host the Service in the United States (DigitalOcean, New York). Some providers process data in other countries. If you are in the EEA, the UK, Switzerland, Brazil or Argentina, your data is transferred to countries that may not have the same level of protection as yours.

For these transfers we use: the EU–US Data Privacy Framework and its UK Extension and Swiss framework, where the recipient is certified; otherwise the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and the equivalent contractual clauses for Brazil and Argentina where required. You can ask us for a copy of the relevant safeguards at facundomartin@sproutco.io.

7. How long we keep data

Data
Account data, business information, scan data and documents
Retention
While your account exists. We delete them within 30 days after you delete your account, except the records listed below.
Data
Anonymous scans, their drafts and the email address given for them
Retention
About 7 days after the scan, unless you save the scan to an account.
Data
Billing data and invoices
Retention
At least as long as tax and accounting law requires, normally 7 years after the end of the tax year (10 years where EU law requires it). Invoices and payment records stay in our Stripe account. We do not yet delete them automatically after this period.
Data
Contract and consent records, refund, cancellation and withdrawal requests
Retention
At least 3 years after your subscription ends, or until a dispute or claim is closed if that is later. Never less than 18 months after the last charge. We do not yet delete them automatically after this period.
Data
Audit records (actions in the account, sign-ups and acceptances, with the IP address)
Retention
We keep them. Our audit log does not allow changes or deletions, so we do not delete these records automatically today.
Data
Sessions (sign-in time, IP address, user agent)
Retention
Until you sign out, end the session in your account settings or delete your account. We do not yet delete expired sessions automatically.
Data
Server and error logs
Retention
Our servers keep logs in files with a size limit, and new entries replace the oldest ones. We do not yet delete logs after a fixed number of days. We do not use an outside error-reporting service.
Data
GitHub beta waitlist requests
Retention
Until you ask us to delete them. We do not delete them automatically yet.
Data
Preferences for optional emails
Retention
Until you unsubscribe or delete your account.

8. Security

We use technical and organizational measures that fit the risk. Examples: encryption in transit (HTTPS with HSTS), sign-in with single-use links or hashed passwords, encrypted session cookies, access control by role and by organization, an append-only audit log, a database that is not reachable from the internet, regular dependency and security checks, and least-privilege access for staff. No system is fully secure. If a breach affects your data, we tell you and the authorities when the law requires it.

9. Your rights

You can contact us at facundomartin@sproutco.io to use your rights. We may ask you to confirm your identity, normally by a reply from your account email. We answer without undue delay.

9.1. EEA, UK and Switzerland

You have the right to: access your data; correct it; delete it; restrict its use; receive it in a portable format; object to processing based on legitimate interests; and withdraw consent at any time.

Your right to object. You can object at any time, for reasons that relate to your situation, to our use of your data based on legitimate interests. You can object at any time to direct marketing; we then stop.

We answer within one month after we receive your request. If a request is complex or you send many, we can extend this by up to two more months. We tell you within the first month if we do this, and why.

You can complain to the data protection authority of the EU country where you live, work, or where the issue happened (list: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). UK: you can complain to us first; we acknowledge your complaint within 30 days, investigate it without undue delay and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint). Switzerland: you can complain to the FDPIC (edoeb.admin.ch).

9.2. California (notice at collection and privacy rights)

This section applies to California residents, to the extent the California Consumer Privacy Act (CCPA) applies to us.

Categories collected in the past 12 months (with the categories of Cal. Civ. Code §1798.140): identifiers (name, email, IP address, account and customer IDs); customer records (billing name and address, tax ID; Cal. Civ. Code §1798.80(e)); commercial information (plans, purchases, invoices); internet or other electronic network activity (sign-ins, use of the Service, security logs); geolocation data (approximate location derived from your IP address only); professional information (organization and role); sensitive personal information (account login: email and password). We do not collect other categories.

Sources: you, your devices, your organization, Stripe, GitHub (if you connect a repository) and our scanner (from public web pages).

Purposes: the purposes in section 3.

Disclosures for a business purpose: we disclose identifiers, customer records, commercial information, network activity and geolocation data to service providers (hosting, network and security, email, payments, product analytics) and to professional advisers, for the purposes in section 3.

Sale and sharing: we do not sell or share personal information, and we did not do so in the past 12 months. We have no actual knowledge that we sell or share personal information of consumers under 16. We use sensitive personal information only for the purposes allowed by Cal. Code Regs. tit. 11, §7027(m), so the right to limit does not apply.

Retention: see section 7.

Your rights: to know what personal information we collected about you, including specific pieces; to delete it; to correct it; to opt out of sale or sharing (we do not sell or share); and not to be discriminated against for using these rights.

How to make a request: email facundomartin@sproutco.io. We operate only online and have a direct relationship with our users, so email is our request method. We verify requests to know, delete and correct by matching the information you give us with the information we hold, normally by asking you to reply from your account email. An authorized agent can make a request for you with your signed permission; we may ask you to confirm your identity directly.

Global Privacy Control (GPC): our site does not read GPC signals. We do not sell or share personal information, we do not show advertising, and we send no product events to any third party. So a GPC signal has nothing to opt out of on tosgenerator.com.

Shine the Light: we do not disclose personal information to third parties for their direct marketing.

9.3. Other US states

If you live in a US state with a consumer privacy law (for example Virginia, Colorado, Connecticut, Texas or Oregon), you can have the rights to access, correct, delete and port your data, and to opt out of targeted advertising, sale and certain profiling. We do not sell personal data, do targeted advertising or do such profiling. To use your rights, email us. If we decline your request, you can appeal by replying to our answer with the word "Appeal". We answer the appeal within the time the law requires. If the appeal is denied, you can contact your state Attorney General.

9.4. Brazil (LGPD)

You have the rights in article 18 of the LGPD: confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary or unlawful data, portability, deletion of data processed with consent, information about who we share data with, information about the possibility of not giving consent and its consequences, and withdrawal of consent. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD, gov.br/anpd).

9.5. Argentina

You can access your data free of charge at intervals of not less than six months, unless you show a legitimate interest to do so earlier. We answer access requests within 10 calendar days, and correction, update or deletion requests within 5 business days (Ley 25.326, arts. 14 and 16).

"La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales."

10. Cookies

We use only cookies and similar storage that are strictly necessary or that remember a choice you make. We do not use advertising or analytics cookies, and we send no product events to any third party. See our Cookie Policy (/legal/cookies).

Do Not Track and online tracking. No third party collects information about your online activities over time and across different websites through tosgenerator.com. Our site does not respond differently to browser "Do Not Track" signals, because we do not track you across sites.

11. Emails

We send service emails that you need to use the Service (for example sign-in links, receipts, renewal reminders and cancellation confirmations). You cannot unsubscribe from them while you have an account. Some notices about scans and monitoring are optional; you can turn them off with the link in each message. Optional product emails are sent only with your consent, and each one has an unsubscribe link. We honour unsubscribe requests within 10 business days.

12. Children

The Service is for adults and businesses. It is not directed to children under 16, and we do not knowingly collect their personal data. If you think that a child gave us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We show the date of the last update at the top. If we make a material change, we post a notice on tosgenerator.com and email account holders before the change takes effect, and we ask for your consent where the law requires it.

14. Contact

Sprout LLC · 299 NW 46th St, Boca Raton, FL 33431, USA · facundomartin@sproutco.io · +1 (786) 375-8064 · Product support: hola@tosgenerator.com