Privacy Policy

1. Information about the operator

Privacy contact (United States): Parents may direct privacy questions and requests to CALL SNAP SYSTEMS LLC at the address and email above.

Grievance Officer (India): As required by India's Digital Personal Data Protection Act, 2023, our Grievance Officer is Babu Sri Harsha Vemulapalli, CALL SNAP SYSTEMS LLC, reachable at contact@callsnapsys.com and at the postal address above. We acknowledge grievances within 48 hours and respond within 30 days.

2. Parent account information

We collect information needed to create and operate a parent account, including the parent's name and email address. Authentication information such as passwords is handled through our authentication provider; we do not store your password in readable form.

If you subscribe to a paid plan, payment is processed by our payment provider (Stripe). We receive confirmation of payment, your plan status, and limited billing details (such as card brand and last four digits). We never receive or store your full card number.

If you contact support, we keep your message and our response so we can help you and keep a record of the request.

3. Information about children

Sprout is designed to minimize the information we collect about children. Depending on the features a family uses, Sprout may process:

• the child's display name;
• the child's current age when the profile is created;
• general interests, activities, and strengths provided by a parent;
• learning priorities and settings selected by a parent;
• choices the child makes during learning adventures;
• learning sessions, missions, progress, and structured learning evidence;
• companion information and settings;
• a short history of the child's recent companion conversations, kept so the companion can maintain continuity from one visit to the next; and
• limited safety-event metadata when our safety systems identify a concern.

Sprout does not require a child's date of birth. Parents should not enter addresses, school names, telephone numbers, diagnoses, names of other people, or other sensitive or identifying information into personalization fields.

4. Reflections, voice, and companion speech

Reflections. During an adventure, a child may type a reflection. The reflection is processed temporarily to perform safety checks, interpret the response, and create an immediate supportive companion response. Sprout does not retain the raw reflection text in its application database after this immediate processing. We may retain a record that a reflection occurred and structured learning evidence derived from the activity, but not the raw reflection text itself.

Speaking answers (microphone). Voice features are controlled by the parent in Child Settings, and microphone use is off unless a parent turns it on. When a child answers by speaking, the browser records audio and sends it to Sprout's servers, where our AI provider transcribes it into text. The audio recording is used only for that transcription and is not stored by Sprout. The transcribed text is shown in the experience and is then processed like a typed reflection, including the same rule above: the raw text is not retained after immediate processing. The browser separately requests microphone permission, and a child can always type instead.

Companion speech. When the companion speaks, the companion's message text is sent to our AI provider, which synthesizes it into audio that is played back in the experience. The generated audio is delivered for playback and is not stored as a recording of your family.

No biometric identifiers. We do not create, collect, or store voiceprints, facial templates, or any other biometric identifiers from children or parents.

5. How we use information

We use information only as reasonably necessary to operate and improve the Sprout experience, including to:

• personalize age-appropriate learning adventures;
• select appropriate skills and learning objectives;
• provide supportive companion interactions;
• create real-life practice missions;
• maintain learning continuity and progress;
• provide parents with progress information and insights, including a weekly progress report by email (parents can unsubscribe with one click, and can turn the report off in the Parent Area);
• apply child-safety protections;
• process subscriptions and provide customer support; and
• operate, secure, troubleshoot, and improve Sprout.

Our AI usage records keep counts (such as characters and tokens processed) for cost and safety management. They never contain prompts, reflections, or other child text.

Internal administration. CALL SNAP SYSTEMS LLC uses a restricted internal administrator dashboard to operate, secure, and support Sprout. Access requires a signed-in account that we have designated as an active administrator; ordinary parent accounts cannot open it. Depending on the task, an authorized administrator may review parent names and email addresses; child display names and profile status; consent and account status; support messages, internal support notes, and responses; safety-event metadata and safety-review notes; service-wide participation and learning counts; and AI usage and estimated-cost records grouped by family or child. An administrator may review consent status, respond to support requests, review safety events, and suspend or restore an account when reasonably necessary for safety, security, legal compliance, or enforcement of our Terms. Administrators may use this information only for those operating purposes — never for advertising or any unrelated purpose. The dashboard does not display raw child reflections or microphone recordings, neither of which Sprout retains.

6. Artificial intelligence and service providers

Sprout uses service providers, including artificial intelligence and cloud infrastructure providers, to operate features of the service. Our current providers include:

• Supabase — database and authentication;
• Vercel — application hosting;
• OpenAI — artificial intelligence features, including generating adventures and companion responses, interpreting reflections, transcribing spoken answers, and synthesizing companion speech;
• Resend — delivery of account and weekly report email;
• Stripe — payment and subscription processing.

When needed for a Sprout feature, limited relevant information may be processed by an artificial intelligence service to help generate personalized adventures, interpret reflections, generate supportive companion responses, create real-life missions, generate parent insights, transcribe speech, or synthesize companion speech. We seek to limit the information sent for each task to what is reasonably necessary for that feature. Sprout does not make child profiles publicly available.

No AI training use. Information sent to our AI provider is processed only to provide the feature you are using. It is not used to train, fine-tune, or improve the provider's AI models, and we do not permit our providers to use children's information for their own purposes.

Integral disclosures only. We disclose children's information only to providers whose processing is integral to operating Sprout, as listed above. If we ever proposed a disclosure that was not integral to the service, we would first obtain separate verifiable parental consent, as the U.S. Children's Online Privacy Protection Act (COPPA) requires. We make no such disclosures today.

7. Sharing and disclosure

We may disclose information to service providers that process information on our behalf to operate Sprout, such as hosting, database, authentication, artificial intelligence, email, and payment providers.

We do not use children's personal information for targeted advertising, and we do not sell children's personal information. Sprout contains no advertising.

We may also disclose information when reasonably necessary to comply with law, protect the security or integrity of Sprout, or protect the rights and safety of users or others.

8. Parent consent

Sprout requires parent or legal guardian authorization before a child may use Child Mode. Parents receive information about Sprout's data practices and AI-powered features as part of the consent process. Consent is given by a clear affirmative action in the parent account and is then confirmed by email: we send a confirmation link to the address on the parent account, and Child Mode unlocks only when the parent confirms through that link. We then send a further email confirming the consent is active. Consent is recorded with the version of this policy and the Terms the parent accepted, the date, and the email confirmation. No paper or signed form is required at any point. A parent may withdraw consent at any time in the Parent Area, with the same ease as giving it; withdrawal immediately ends further collection and use of the child's information for Child Mode, and the parent may also delete the child's profile and data.

9. Parent rights and controls

A parent or legal guardian may review the personal information Sprout maintains about their child, request corrections, request deletion, or refuse further collection or use of the child's information.

Parents can do most of this directly in the Parent Area: review and edit child profiles, delete a child profile, withdraw consent, and delete the entire account. A parent may also contact us at contact@callsnapsys.com for privacy requests.

Before providing child information in response to a request, we may take reasonable steps to verify that the requester is the child's parent or legal guardian.

10. Data retention and deletion

We keep children's personal information only for the specific purposes for which it is needed.

• Child profile and learning data: retained while the child profile is active because it is needed to provide personalization, continuity, progress, and parent-facing features. When a child profile is deleted, associated application data is deleted with it.
• Raw child reflections and spoken-answer text: not retained after the immediate processing needed to provide the reflection and companion experience. Microphone audio is never stored.
• Companion conversation history: only a short recent history is kept for continuity, and it is deleted with the child profile.
• Safety-event metadata and administrator review notes: retained for up to 12 months for child-safety, service-integrity, and safety-system review purposes, then deleted.
• Consent records: retained while the parent account exists and for up to three years after account deletion so we can maintain a record of the consent that was provided.
• Support messages, administrator notes, and responses: retained while the parent account exists so we can respond and keep a record of the request; deleted with the account.
• Account deletion: application data associated with a deleted account is removed from the active application systems as part of the deletion process. Temporary backup copies may remain for a limited period according to our infrastructure providers' backup and recovery lifecycle before being overwritten or deleted.

11. Security

We maintain a written information security program with administrative, technical, and organizational safeguards appropriate to the sensitivity of children's information — including role-based access controls for internal administration, encryption in transit, per-family data isolation in our database, and requiring the providers that process information for us to protect it. We review the program periodically. No online service can guarantee absolute security. If a data breach affects your family's information, we will notify affected parents and the relevant authorities as required by applicable law.

12. Changes to this policy

If we make a material change to how we collect, use, or share children's personal information, we will provide notice to parents and obtain any required consent before applying the new practice to children's personal information.

13. United States — children's privacy and state rights

COPPA. Sprout is designed to comply with the U.S. Children's Online Privacy Protection Act (COPPA) and the FTC's COPPA Rule for children under 13. In accordance with the Rule:

• we give parents direct notice of our practices in this policy and in the consent flow, and we obtain verifiable parental consent before collecting, using, or disclosing personal information from a child;
• we collect only the information reasonably necessary for a child to participate, as listed in Section 3;
• parents may review their child's personal information, direct us to delete it, and refuse to permit further collection or use — see Section 9 — and we honor those directions;
• we keep children's information only as long as reasonably necessary for the purpose it was collected, under the written retention schedule in Section 10. Indefinite retention is prohibited; and
• we maintain the written information security program described in Section 11.

State privacy rights (all U.S. states). Whatever state you live in, parents may ask us to confirm and provide a copy of the personal information we hold about your family, correct inaccuracies, delete it, and obtain it in a portable format — in most cases you can do this yourself in the Parent Area. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising, so there is no sale or sharing to opt out of. We will not discriminate against you for exercising any right. Residents of states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, and Texas) have at least these rights under those laws, including any right to appeal a denied request — contact us and we will explain the outcome and the reasons. We do not knowingly collect information from children 13 or older as child users; Sprout child profiles are for children ages 5 through 12, created and controlled by a parent.

14. India — Digital Personal Data Protection Act, 2023

If your family uses Sprout in India, this section applies in addition to the rest of this policy. Words in this section have the meanings given in India's Digital Personal Data Protection Act, 2023 ("DPDP Act"): CALL SNAP SYSTEMS LLC is the Data Fiduciary; a parent is a Data Principal in their own right and acts on behalf of their child.

• Child means under 18. The DPDP Act treats everyone under 18 as a child. Sprout's own service is for children ages 5 through 12, always through a parent's account.
• Verifiable parental consent. Before we process any personal data of a child, we obtain verifiable consent from the child's parent or lawful guardian, given by clear affirmative action after notice of what is collected and why. We take reasonable steps to confirm the consenting person is an adult parent or guardian.
• No tracking, monitoring, or targeted advertising. As Section 9 of the DPDP Act requires, we do not track or behaviorally monitor children, we do not direct targeted advertising at children, and we do not process children's data in any way likely to cause a detrimental effect on a child's well-being.
• Notice and languages. Our consent notice describes the personal data collected, the purposes, how to exercise rights, and how to complain to the Data Protection Board of India. This policy is published in English; a parent may request the notice in any language listed in the Eighth Schedule to the Constitution of India and we will provide it or a faithful summary.
• Parent rights under the DPDP Act. A parent may obtain a summary of the child's personal data and the processing activities; seek correction and erasure; withdraw consent at any time with comparable ease (withdrawal stops further processing and, on request, we erase the data unless retention is required by law); raise a grievance under Section 15 below; and nominate another individual to exercise these rights on the parent's behalf in the event of death or incapacity.
• Data location and transfer. Sprout is operated from the United States and personal data is stored and processed there and in other countries where our providers operate. We do not transfer personal data to any country restricted by notification of the Government of India under the DPDP Act.
• Breach notification. In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal as the DPDP Act requires, without undue delay.
• Retention and erasure. We erase personal data when consent is withdrawn or the purpose is no longer served, except where retention is required by law — the retention schedule in Section 10 applies, including the three-year retention of consent records for legal proof of consent.

15. Contact us and grievances

Questions or requests concerning this Privacy Policy or a child's information may be directed to:

India grievances: contact the Grievance Officer named in Section 1. We acknowledge grievances within 48 hours and respond within 30 days. If a grievance is not resolved, a Data Principal in India may approach the Data Protection Board of India in accordance with the DPDP Act.