Privacy Policy

Effective date: March 18, 2026
Last updated: September 28, 2026

This Privacy Policy explains how sproutvest.com ("the Site"), operated by SproutVest, LLC, collects, uses, and protects information when you visit the Site, take the free Trellis Leadership Diagnostic, send us a form, buy from us, or book a call through our scheduling service. Every outside service that handles your information on our behalf is named in the table under Third-Party Services, with what it receives.

What We Collect

Analytics (Google Analytics 4)

The Site uses Google Analytics 4 (GA4) to understand how visitors use the Site. GA4 collects:

• Page views: which pages you visit and when
• Device and browser information: screen size, browser type, operating system
• Approximate location: country and city level, derived from IP address (your full IP address is not stored by GA4)
• Interaction events: button clicks, outbound link clicks, scroll depth, and language preference

GA4 uses first-party cookies to distinguish unique visitors. These cookies do not contain personal information, and none of them are set until you accept them.

Legal basis (GDPR): Your consent, given through the banner. You may withdraw it at any time, and withdrawing deletes the cookies as well as stopping new collection.

Visit counts (Cloudflare Web Analytics)

Our host, Cloudflare, adds a small script (beacon.min.js) to every page it serves, and that script reports to Cloudflare Web Analytics. It sets no cookies, writes nothing to your device, and does not fingerprint you or use any identifier that could follow you to another site. It reports the page address, the site that referred you, your browser, operating system and device type, the country Cloudflare's network places you in, and how long the page took to load. We see those figures only as totals.

Unlike Google Analytics, it is not governed by the cookie banner. Cloudflare adds it to the page as the page is served, outside the code our banner controls, so it loads whatever you answer. Blocking static.cloudflareinsights.com in your browser's tracking protection or an extension stops it.

Legal basis (GDPR): Legitimate interest in knowing which pages are read and whether they load quickly, pursued without cookies or any identifier.

Advertising (Google Ads)

We run paid search ads on Google. When you arrive from one of those ads, the Google Ads tag records that the visit came from a specific ad and whether it led to an action we count, such as completing the free diagnostic or booking a call. It collects:

• Click identifier: a Google-issued ID attached to the ad click, stored in a first-party cookie and, if you complete the free diagnostic in the same browsing session, saved with your submission in our own records
• Conversion events: which counted action you took, and when

We keep the click identifier so we can tell Google that an ad it served led to a completed diagnostic, and later that it led to a sale. That is the only thing we send back. Your email address, your name, your answers, and your report are never sent to Google, and Google's enhanced conversions feature is switched off.

The identifier is governed by the same consent choice as analytics, and that choice starts as "no" for everyone. Unless you have accepted, it is discarded in your browser and never reaches us, whatever country you are in. It is held only for the browsing session, so closing the tab discards it. Once saved with a diagnostic, it is deleted with the rest of that diagnostic after 45 days, or sooner on request.

A fuller description of the software behind this, what it does and what it never sends, is on our Google Ads integration page.

Legal basis (GDPR): Your consent, given through the banner.

The Trellis Leadership Diagnostic

The free diagnostic at sproutvest.com/trellis/ asks for more than any other page on the Site, so this section lists all of it. When you submit it, we store the following in a Cloudflare D1 database under our control:

• Email address: required, because the report is sent there
• First name and company: only if you enter them
• Where you came from: any campaign tags in the address you arrived on (utm_ parameters) and, only if you accepted advertising cookies, Google's ad click identifier (gclid, gbraid or wbraid)
• Your answers: all 24 ratings, and anything you write in the optional questions
• Your results: the scores computed from your answers, and the written report generated from them
• Dates: when you submitted, and when you unsubscribed, if you do

Your scores and your written answers are sent to Anthropic's Claude API, which writes the report. Nothing else goes to Anthropic: not your email address, your name, your company or where you came from. The report and your scores are then emailed to you from hello@sproutvest.com through Resend, an email delivery service. Three days and seven days after you submit, Resend delivers two short follow-up emails about your results. Each carries an unsubscribe link, and unsubscribing stops them for every diagnostic taken with that address. Nothing else is sent to the address automatically.

If you later buy the full diagnostic or a Field Notes edition through Stripe with the same email address, we link that purchase to the most recent diagnostic you took before paying, if it is still stored, so that we can tell which campaign led to a sale.

Deleted after 45 days. Forty-five days after you submit, the diagnostic is deleted from our database: your answers, your written answers, your scores, the report, and the email address, name, company and campaign details stored with them. A purchase record is kept (see Payments below), but its link to the diagnostic is removed at the same time. The copy of the report in your own inbox is not affected. You can ask us to delete the diagnostic sooner at the address below.

While you are answering, your progress is kept in your browser's session storage so that a refresh does not lose it. It never leaves your browser until you submit, closing the tab discards it, and submitting clears it.

To stop the diagnostic being abused, we count submissions from each network address and to each email address. The counts are keyed by a one-way fingerprint rather than by the address itself, and are deleted once their hour or day has passed.

Legal basis (GDPR): Your consent, given with the checkbox on the form, for the report and the two follow-up emails; and our legitimate interest in knowing which campaigns lead to a diagnostic and to a sale.

Payments (Stripe)

The full diagnostic and paid Field Notes editions are sold through Stripe payment links. You enter your payment details on Stripe's own pages, not on the Site, and we never see or store your card number. When a payment succeeds, Stripe notifies us, and we record the email address you paid with, which product you bought, the amount and currency, the time of the payment, and Stripe's reference numbers for it, together with the link to your diagnostic described above. We keep this as our record of the sale.

Stripe processes your payment under its own Privacy Policy.

Legal basis (GDPR): Performance of a contract (you are buying something from us).

Contact Form (Formspree)

The contact form is delivered by Formspree, a form-processing service, which passes what you submit to us by email. It sends your name, email address, company if you give one, the kind of engagement you selected, and your message. We use what you send to reply to you. Until September 28, 2026 a worksheet request form on the coaching page sent an email address the same way; the worksheet is now an ordinary link and asks for nothing.

Formspree processes these submissions under its own Privacy Policy.

Legal basis (GDPR): Steps you ask us to take before any engagement, and our legitimate interest in answering you.

Scheduling (Cal.com)

When you book a call through our "Book a Discovery Call" button, you are directed to Cal.com, a third-party scheduling platform. Cal.com may collect:

• Name and email address: required to confirm your booking
• Phone number: if you choose to provide it
• Any notes you include in the booking form

This data is processed by Cal.com under their own Privacy Policy. We receive the information you submit in order to prepare for and conduct the scheduled call.

Legal basis (GDPR): Performance of a contract (you are requesting a meeting) and your explicit consent when submitting the booking form.

Report Downloads (SproutVest Field Notes)

Free Field Notes reports are downloaded directly from the Site, and we do not ask for your email address to get one; paid editions are sold through Stripe, as described above. Until September 28, 2026 some reports were offered in exchange for an email address, through a form on the report's page. For each address given that way we stored:

• Email address: the address submitted in the download form
• Request details: which report was most recently requested, and when the form was first submitted

This data is stored in a Cloudflare D1 database under our control. We used it to deliver the download where the form offered one, and for nothing else: we never use a Field Notes address to send you email. We never sell it or share it with third parties. Each address is deleted 45 days after it was first given; to have yours removed sooner, contact us at the email address below.

Legal basis (GDPR): Your explicit consent when you submitted the download form.

Hosting (Cloudflare)

The Site is hosted on Cloudflare Pages. The diagnostic, and until September 28, 2026 the Field Notes download form, are handled by a Cloudflare Worker, a small program we run on Cloudflare's network, which stores what they collect in the Cloudflare D1 database named above. The Worker keeps no log of your visits: its logs hold only the error and status messages our own code writes, never your IP address or what you submitted, and are deleted after at most seven days. Separately, Cloudflare may automatically collect:

• IP address: in server access logs, retained temporarily for security purposes
• Request metadata: pages requested, timestamps, HTTP headers

This data is processed by Cloudflare under their own Privacy Policy.

Legal basis (GDPR): Legitimate interest in maintaining Site security and availability.

What We Do Not Collect

• We do not build user profiles for ad targeting, and we run no remarketing or audience lists
• We do not sell, rent, or share personal data with third parties for marketing
• We do not require account creation or store passwords
• We never see or store your card details: Stripe takes payments on its own pages

Cookies

The Site uses the following cookies:

None of these are set until you accept them. That is true wherever you are visiting from: we do not treat visitors outside Europe as having agreed by default. Until you answer the banner, analytics and advertising storage are switched off, and if you decline they stay off.

Cloudflare Web Analytics sets no cookies, which is why it is not in the table, and it loads whether or not you accept, as described above.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a decision and do not ask again.

You may change your mind at any time, in either direction:

Cookie Settings

Declining after having accepted does more than stop new collection: we delete the cookies listed above from your browser at that point. Your choice is remembered for twelve months, after which we ask again rather than assume it still holds.

You can also control cookies through your browser settings. Disabling cookies will not prevent you from using the Site but will limit analytics data collection.

Your Rights

If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data protection laws, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your personal data
• Object to processing based on legitimate interest
• Withdraw consent where processing is based on consent
• Data portability: receive your data in a structured format

To exercise any of these rights, contact us at the email address below.

Data Retention

• Diagnostic submissions are deleted 45 days after you submit, including your email address and everything stored with it
• Purchase records are kept as our record of the sale; the link to a diagnostic is removed when the diagnostic is deleted
• Field Notes addresses, given before September 28, 2026, are deleted 45 days after they were first submitted, and are never used to email you
• Abuse-prevention counts are deleted once their hour or day has passed
• Our Worker's logs, which hold only our code's error and status messages, are deleted after at most seven days
• Contact form submissions, and worksheet requests made before September 28, 2026, are held by Formspree according to its retention policy, and by us in our email for as long as the conversation needs
• Analytics data is retained by Google Analytics for 14 months, after which it is automatically deleted
• Booking data is retained by Cal.com according to their retention policy and by us for as long as necessary to fulfill the purpose of the scheduled meeting
• Server logs are retained by Cloudflare for a limited period as described in their privacy policy

Third-Party Services

Every outside service that receives information about you through the Site, what it receives, and why.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Site after changes constitutes acceptance of the updated policy.

Contact

For privacy-related questions or to exercise your data rights, contact:

SproutVest, LLC
Website: sproutvest.com
Email: hello@sproutvest.com