When you sign in, we store your email address and basic account details (your plan, and a payment reference if you upgrade). We use Stripe for payments — we never see or store your card details. When you build with Websprout, we store the sites you create on our servers so your work is saved to your account and your published sites stay live: this includes your drafts and published pages, any products you add, customer reviews, the contact-form messages (leads) your visitors send you, and basic usage counts.
To operate, secure and improve the service, we also keep a short activity log of visits and key actions (such as signing in, generating a site, and publishing). Each entry includes an approximate location (country, region and city) derived from your IP address, a one-way hashed form of your IP address (we do not store your raw IP address in this log), your browser and device type, and the referring link that brought you to the site. We use this only for our own product analytics, security and understanding how Websprout is used. We do not sell it or share it for advertising.
We do not track you across other websites. We do not sell your data. We use only the cookies necessary for the service to work, including a sign-in cookie to keep you logged in.
The prompts you type to generate websites are sent to Google's Gemini API for processing. Please see Google's privacy policy for how they handle this data.
While you are building, a working copy of your site is kept in your browser. Once you sign in or publish, your site (drafts and published pages) is also stored on our servers so it stays saved to your account and stays live on the web. You can remove any site at any time, or delete everything at once from your account settings (see below).
We rely on a small number of trusted providers to run the Service. Each processes data only to provide its part of the Service:
We keep your account and the sites you build for as long as your account is active. Contact-form submissions (leads) and customer reviews are kept for a limited period and then expire automatically. Activity-log entries (visits and actions) are automatically deleted after 60 days. We may also send you an occasional service email about your own account or sites (for example, a one-time reminder that an unpublished site is saved); every such email includes an unsubscribe link, and we honor opt-outs. When you delete a site or your account, the associated data is removed from our systems, except payment records that Stripe is required to retain by law. You can delete everything at any time (see below).
Websprout is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
You are in control of your data. From Settings in the Websprout studio you can, at any time:
Depending on where you live, laws such as the EU and UK GDPR and the California CCPA give you these rights to access, export and delete your personal data. The tools above let you exercise them yourself, instantly — or you can email us and we will help.
Two things to note. First, payment records held by our payment processor (Stripe) may be kept as required by law even after you delete your account, so we can meet tax and accounting obligations; this data lives with Stripe, not in your Websprout account. Second, if you connected a custom domain, that domain mapping may need to be removed separately — email us and we will clear it for you.
Questions? Email us at support@websprout.app