App privacy.
Your account and records.

App privacy notice · Updated 23 October 2026

Who is responsible

Lewis Danks, trading as Sproutlet, runs the app and online service. Email hello@sprout-let.co.uk for privacy questions or requests. This notice covers the app; the website privacy notice covers website comments and the interest list.

Information we process

Account details. Your email, display name and account identifiers, plus basic profile information from Google, Apple or Facebook when you choose that sign-in. Apple's Hide My Email supplies a relay address instead of your own. We keep sign-in sessions securely on your device.

Rental records. Property addresses, tenancies, rent, expenses, repairs, notes, photos and documents entered by you or someone you authorise. These may include tenant or contractor names and contact details.

What you give Sprout. Messages you type to Sprout, and photos, PDFs and other documents you snap, share or upload so Sprout can suggest what to save.

Forwarded emails and quotes. Certificate emails you forward to your own Sproutlet address, and the quote requests and replies exchanged with firms you choose to contact.

Phone permissions. The camera and photo library are used only for pictures and documents you choose. Contacts are used only when you pick a person to import; we receive only the details you save, never your address book.

Service and support records. Technical and security events, timestamps, support messages and the minimum records needed for privacy requests and to prevent deleted accounts returning after recovery.

Record only what you need to manage the property. Add identity documents, health information or other sensitive details only where genuinely necessary.

Our responsibilities and the landlord's

Sproutlet is the controller for accounts, operation of the service, support and privacy-request records. A landlord decides which tenant or contractor details to record and why, making the landlord the controller of those records. We store and display them for the landlord's work, acting as a processor on their behalf.

How we use information and our legal basis

Providing the service. We use information for your account, sign-in and service emails such as confirmations and password resets. This is necessary to perform the contract for the service you requested.

Sprout's reading. When you tell Sprout something or give it a document, an AI model reads it and suggests records for you to confirm. Nothing is saved until you do. This is part of the service you asked for.

Quotes from local firms. When you ask for quotes, we search for local firms by trade and area, find each firm's public enquiry email on its website, and email the firms you choose with the repair details, the property address and your first name. Replies come back into the repair. This is part of the service you asked for.

Reminders and lookups. We email due-date reminders for your checks unless you turn them off in the Account sheet. We use a property's postcode to look up which UK nation it is in and its energy certificate on the government register.

Security and repairs to the service. Preventing abuse and fixing problems is in our legitimate interest in operating a safe, reliable service. We keep this processing proportionate.

Privacy requests and erasure safeguards. We process requests and keep the records needed to prevent deleted accounts returning, to meet UK data protection obligations.

Improving the app. We count which part of the app a save came from, without your account or the record's contents, to see which features help. This is in our legitimate interest in improving Sproutlet.

We do not sell information, display adverts, track you across other apps or websites, or use rental records for marketing. The optional website interest list is separate and uses consent.

Our service providers

The following providers process information for us under their data processing terms:

• Supabase: sign-in, app database and private file storage in London.
• DigitalOcean: the app server in London.
• Cloudflare: secure service connections, receiving forwarded certificate emails and firm replies, and encrypted backup storage, with a Western Europe location hint.
• Resend: service emails, reminders and quote requests to firms, using Ireland.
• OpenAI: reads what you give Sprout, and public firm websites when finding an enquiry email. Before a message or document's text is sent, we replace tenants' names with placeholders. A photographed document is sent as the image. We ask OpenAI not to store requests. Under its API terms it does not train models on them, and it may keep them for up to 30 days to check for abuse.
• Google Maps Platform (Places): finds local firms from the trade and the property's area.
• Google Workspace: our business correspondence mailbox.

Firms you ask for quotes receive the details above and handle them under their own privacy notices. Postcodes.io and the government energy performance register receive a property's postcode or address for lookups.

Google, Apple and Facebook handle the sign-in options under their own terms and privacy notices. Private files open through short-lived links for people with access. Authorised operators can inspect relevant records only to handle support or a privacy request.

Processing outside the UK

Our main services are configured in London. The providers operate internationally and may process information or provide support outside the UK. We rely on UK-approved transfer safeguards in their data processing terms. Email hello@sprout-let.co.uk to ask about those safeguards.

Retention periods

• Account and profile details stay while the account is open. Following a verified deletion request, we delete them within one month, except for the limited records below.
• Rental, tenancy, money and document records stay while the owning account is open. The landlord decides what to retain. Export anything needed for tax records before requesting account deletion; we do not retain those records for you afterwards. Tax records are usually needed for several years.
• Technical and security logs normally expire within 30 days.
• Encrypted daily backup snapshots expire after about 90 days.
• Privacy-request records remain for two years after the request closes.
• A minimal erasure safeguard, without names or contact details, stays while a backup could restore deleted data.
• Support correspondence stays for two years after the last message.

Making a privacy request

Your circumstances may give you rights to access, correct, delete or restrict information, object to its use or receive a portable copy. Email hello@sprout-let.co.uk; an account and legal wording are not required. We acknowledge requests within five working days and respond within one month. For genuinely complex requests, the law permits up to two further months. We will explain any extension.

Writing from your account email is normally enough to confirm identity. Otherwise, we may ask for proportionate evidence, but not identity documents by default. If the information is in landlord-controlled records, we explain that and help the landlord respond. To remove an account, follow the account deletion steps or the data-deletion instructions.

You can complain to the Information Commissioner’s Office. Sproutlet keeps records and reminders; it does not decide tenancy or legal rights.