DRAFT – complete before launch. This is a template, not legal advice. Placeholders in brackets must be filled in and the text reviewed before payments go live.

Privacy Policy

Updated: 24.9.2026

How SproutMindAI processes personal data under the EU General Data Protection Regulation (GDPR).

1. Controller

[COMPANY NAME], Business ID [Y-TUNNUS], [ADDRESS]. Privacy contact: [EMAIL].

2. Data we process

Account: email and password hash. Optional profile details: name, phone number, company or farm, and municipality – the phone number is optional, used only for account-related contact, visible only to you and never sent to the AI provider; you can change or remove these on the Account page. Subscription: plan, period, status and payment-provider IDs (no card data – handled by Paddle). Usage counts per month. AI requests (questions, photos) are sent to the AI provider to generate answers and are not stored on our server. Blocks, rotation plans, diary entries and field boundaries are stored on our server, linked to your account, while you are signed in, and are deleted when you delete your account; without signing in, blocks and reminders stay in your browser only. Feedback you send (and an optional email address) is stored on our server. Country choice stays in your browser only.

3. Purposes and legal bases

Providing the service and subscription (contract, Art. 6(1)(b)); security and abuse prevention (legitimate interest, 6(1)(f)); accounting obligations (legal obligation, 6(1)(c)).

4. Recipients

Paddle (payments, invoicing, VAT); xAI (AI answers; transfers to the US under Standard Contractual Clauses or another GDPR transfer mechanism); hosting provider [HOSTING]. [CHECK DPAs.]

5. Retention

Account data until deletion; usage counts [24 months]; payment records per accounting law (Paddle). Delete your account on the Account page.

6. Cookies and storage

pc_session (essential login cookie), NEXT_LOCALE (language). No advertising or tracking cookies.

7. Your rights

Access, rectification, erasure, restriction, objection and portability. You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

8. Security

Passwords are stored as bcrypt hashes; sessions are signed; HTTPS in production.

9. Changes

This policy is updated as the service changes.