Privacy Policy

1. Introduction

This Privacy Policy explains how ConvertSprout collects, uses, shares, and protects information about you when you interact with our marketing site (convertsprout.com), submit our contact form, or become a customer.

[CONFIRM: ConvertSprout is operated by Thrive Unlimited — confirm whether the legal entity name should appear as 'ConvertSprout', 'Thrive Unlimited LLC', 'Thrive Unlimited, Inc.', or another exact form.] We are based in [CONFIRM: state of incorporation — probably Massachusetts].

2. Who we are

ConvertSprout provides custom website design, development, hosting, and maintenance services for home services businesses (HVAC, plumbing, electrical, roofing, and adjacent trades).

The business is owned and operated by Matt [CONFIRM: last name]. You can reach us about privacy-related questions at hello@convertsprout.com.

3. What we collect

We collect information directly from you when you fill out our contact form or become a customer. The information we collect depends on what you provide.

4. How we use information

We use the information you provide to respond to your inquiries, prepare proposals and personalized walkthrough videos, deliver our services, and maintain your website on an ongoing basis. We use aggregate site analytics to understand which pages are useful and which need improvement.

• Contact-form submissions are used to respond to your inquiry — typically within a couple business days — with a personalized video walkthrough and a proposal.
• Customer business information is used to build, maintain, and improve your website.
• Aggregate analytics are used to refine the marketing site itself.
• We do not use your information to sell you additional products you didn't ask about, and we do not share it with third parties for marketing purposes.

5. Third-party services we use

To operate ConvertSprout, we share specific information with the following third-party services. Each is bound by its own privacy policy and applicable data-processing terms.

• Vercel — hosting infrastructure and privacy-first analytics. Vercel's privacy policy: vercel.com/legal/privacy-policy
• Cloudflare — DNS and security services for our customers' domains. Cloudflare's privacy policy: cloudflare.com/privacypolicy
• Stripe — payment processing for customers paying recurring or build fees. We do not store full credit card numbers ourselves; Stripe handles cardholder data per PCI-DSS. Stripe's privacy policy: stripe.com/privacy
• Resend — outbound transactional email (notifications, proposals, account communications). Resend's privacy policy: resend.com/legal/privacy-policy
• CoveApp — internal customer-support ticketing. Your support inquiries and the team's responses are stored within CoveApp.
• ClientBoard — internal client-relationship management. Customer status, project notes, and account history are stored within ClientBoard.

6. Cookies and tracking

We do not use cookies for advertising, marketing, or cross-site tracking. Vercel Analytics — our only analytics tool — operates without cookies.

We may set strictly necessary session cookies if and when we add customer-facing dashboard features (login state, etc.); none are currently in place.

7. Data retention

Customer records (contracts, communications, billing history) are retained for seven (7) years from the end of our service relationship. This satisfies typical record-keeping obligations for tax, accounting, and contractual purposes.

Aggregate analytics data — which contains no personally identifiable information — is retained indefinitely so we can study long-term trends.

Contact-form submissions from prospects who do not become customers are retained for two (2) years and then deleted, unless you ask us to delete them sooner.

8. Your rights

You have the right to request access to the personal information we hold about you, request correction of inaccurate information, request deletion (subject to legal retention obligations), and request that we stop processing your information.

To exercise any of these rights, contact us at hello@convertsprout.com with the request and the email address associated with your records. We respond within thirty (30) days.

[TEMPLATE: GDPR/CCPA-style rights language] Depending on your jurisdiction, you may have additional rights under laws such as the GDPR (European Union) or CCPA (California). If you are a resident of one of these jurisdictions and have specific concerns, contact us and we will work to honor them.

9. Children's privacy

[TEMPLATE: standard COPPA-style language] ConvertSprout's services are intended for businesses and adult business owners. We do not knowingly collect information from children under 13. If you believe a child has submitted information to us, contact hello@convertsprout.com and we will delete it.

10. International data transfers

[TEMPLATE: standard international-transfer disclosure] Our infrastructure providers (Vercel, Cloudflare, Stripe, Resend) operate globally. By using our services or submitting the contact form, you acknowledge that your information may be processed in countries other than your country of residence, including the United States.

11. Security

We use industry-standard technical and organizational measures to protect the information we collect — encryption in transit (TLS 1.3) for all site traffic and form submissions, encryption at rest on the third-party services we use, and limited internal access to customer information on a need-to-know basis.

[TEMPLATE: standard security disclaimer] No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we work to protect your information using reasonable means.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the 'Last updated' date at the top of this page. For substantive changes that affect existing customers, we will notify the email address on your customer record.

13. Contact us

For privacy questions, requests, or concerns, email hello@convertsprout.com. We respond within four business hours during business days; formal privacy requests are processed within thirty (30) days.