Privacy Policy

Intro — A Promise to The Families Who Trust Us

At Sproutsi, we believe childhood should be a time of wonder, possibility, and feeling safe enough to be yourself. The stories we create are deeply personal, and the information families share with us deserves that same care.

Your family's privacy is not an afterthought. It is one of our highest priorities.

When you share your child's name, photo, or personal story with us, you are trusting us with something precious. We take that responsibility seriously. We believe you should always understand what information we collect, why we need it, how it is used, and what happens to it afterward.

That is why we are intentional about the technology we use, the information we retain, and the ways we share our work with the world.

• We don't keep your child's photos longer than we need them. We delete uploaded photos within 30 days after upload, in accordance with our data-retention practices, so we can create your book and run re-generations, while limiting how long we retain these personal images.
• We build with children's privacy in mind. We are committed to the implementation of best practices relating to children's online privacy. We never knowingly allow a child to share their personal information directly. The platform is designed for responsible use by parents and adult caregivers. We have reviewed related children's privacy laws, including the Children's Online Privacy Protection Act (COPPA), giving parents clear information and meaningful control over their children's personal information. You can learn more about COPPA through the Federal Trade Commission's children's privacy guidance.
• We choose AI technology thoughtfully. We use AI systems designed to process information without retaining persistent conversational memory. We carefully evaluate how these systems handle information, including their data-retention and training practices, because the information you share with us should be used to create your child's story—not treated casually.
• Your child's story is not ours to share without permission. We will never use identifiable photos, videos, or other marketing materials featuring a child without the express written consent of their parent or legal guardian.

Overview — Who We Are and What We Do

Sproutsi is a personalised children's storybook service operated by Seven Pines Collective, LLC ("Sproutsi," "we," "us," or "our"). We create custom illustrated eBooks and Hardcovers for children that are grounded in developmental principles and aim to create personalized stories that support each child on their unique journey. To create a personalised story, we collect information provided by parents and guardians about their children. This information includes the child's name, age, photograph, and details about challenges the child is experiencing. Because this information relates to children, we treat it with the highest standard of care and protection.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have as a parent or guardian. Please read it carefully before using our service.

1. Children's Privacy — Our Core Commitment

Sproutsi's service is directed at parents and guardians, not at children directly. We do not knowingly permit children under 18 to create accounts or interact with our platform independently. All data about children is provided by, and with the consent of, a parent or guardian.

1.1 COPPA Compliance

The Children's Online Privacy Protection Act (COPPA) imposes specific requirements on operators of websites and online services directed to children under 13, or that knowingly collect personal information from children under 13.

Sproutsi is directed to parents and guardians, not children. Because we handle information about children, we have designed our practices with reference to the principles of the Children's Online Privacy Protection Act, including data minimization, parental access and deletion rights, restricted third-party sharing, and defined retention periods.

1.2 Verifiable Adult Caregiver Consent

Before we collect any information about a child, we require the parent or guardian, or authorized adult to:

1. Create an account and confirm they are at least 18 years of age
2. Read and actively accept this Privacy Policy
3. Confirm that they are the parent or legal guardian of the child whose information they are providing
4. Confirm that they have the authority to consent on behalf of the child

2. Information We Collect

We collect two categories of information: information about the parent or guardian (the account holder) and information about the child (the story subject).

2.1 Parent / Guardian Account Information

2.2 Child Information (Story Subject)

This is the most sensitive category of data we process. All child information is provided by the parent or guardian. We collect only what is necessary to create the personalised story.

3. How We Use the Information We Collect

We use the information we collect for one primary purpose: creating your child's personalised developmentally informed storybook. Specifically:

3.1 Story Generation

The information we collect is used in story generation:

• The child's photograph is stylized into an avatar by an AI vision model. The avatar, not the photo, is used in story illustration prompts
• Age, developmental situation, challenge response, and outcome goal are processed by a story engine to frame the story context.
• Creation of a developmentally informed story prose
• Child's avatar and story content drive generation of custom illustrations

3.2 Service Delivery

• Sending you a notification when your book is ready
• Delivering the completed eBook to you
• Storing your order history and allowing reordering

3.3 Service Improvement

• Analysing aggregated, de-identified usage patterns to improve our story generation pipeline
• Identifying categories of challenges and stories that work well or need improvement

3.4 Legal and Safety

• Complying with applicable laws and regulations
• Responding to lawful requests from law enforcement or courts
• Protecting the safety of children, our users, and our platform

What we do NOT do with your child's information

• We do not sell child data to any third party
• We do not use child data for advertising or behavioural profiling
• We do not share challenge or response data with schools, insurers, employers, or government agencies (except as required by law)
• We do not use child photographs for any purpose other than generating the child's avatar used in illustration generation for your book
• We do not use child data to train commercial AI models without explicit consent

4. Who We Share Information With

We share child information only as strictly necessary to deliver our service. We do not sell personal information.

4.1 AI Provider — Special Notice

Regarding Anthropic's data handling: When we submit child information to Anthropic's API for story generation, that data is transmitted to Anthropic's servers for processing. Anthropic's current API terms specify that API inputs and outputs are not used to train their models by default. However, you should review Anthropic's current Privacy Policy and API terms for the most up-to-date information. We recommend you review: https://www.anthropic.com/privacy

Regarding OpenAI's data handling: When we submit child information to OpenAI's API for illustration generation, that data is transmitted to OpenAI's servers for processing. OpenAI deletes inputs and outputs to and from their servers within 30 days. We recommend you review: https://openai.com/policies/privacy-policy/

5. Children's Photographs — Special Handling

Photographs of children are among the most sensitive data we process. We apply the following specific safeguards:

5.1 Purpose Limitation

Photographs are used exclusively to create their avatar for use in illustration prompts. The photograph is never:

• Embedded in the finished eBook
• Displayed publicly or shared with any third party beyond our AI processing pipeline
• Used for facial recognition, identity verification, or biometric profiling
• Used in any marketing, advertising, or promotional material

5.2 Retention of Photographs

Original uploaded photographs are processed at story generation time.

• The original photograph is deleted from our servers 30 days from the date of upload.
• No facial geometry, biometric identifiers, or machine-learning embeddings derived from the photograph are retained

6. Data Security

We implement security measures appropriate to the sensitivity of the data we process, with particular attention to the protection of children's information.

6.1 Technical Safeguards

• All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 or equivalent
• Access to child data is restricted to personnel and systems that require it to deliver the service
• API calls to third-party AI providers are transmitted over encrypted connections
• Completed eBooks are stored in access-controlled cloud storage

6.2 Organisational Safeguards

• Access to production systems containing child data is limited to authorised personnel
• We conduct periodic reviews of our security practices
• Third-party service providers are assessed for their security practices before onboarding

6.3 Breach Notification

In the event of a data breach affecting children's personal information, we will notify affected parents or guardians as required by applicable law. We will notify you at the email address associated with your account.

7. Data Retention

8. Your Rights as a Parent or Guardian

As the parent or guardian who provided your child's information, you have the following rights. These rights are in addition to any rights you may have under state law (see Section 9).

8.1 Right to Access. You may request a copy of all personal information we hold about you and your child. We will respond within 30 days of a verified request.

8.2 Right to Correct. You may request that we correct inaccurate information about you or your child. You can update most information directly in your account settings.

8.3 Right to Delete. You may request deletion of your child's personal information at any time. We will delete the information within 30 days of a verified request, subject to retention required by law. Note that deletion of child information will make it impossible for us to reorder or modify an existing book.

8.4 Right to Refuse or Withdraw Consent. You may refuse to provide any information. However, certain information is required to generate a personalised story — if you do not provide it, we may not be able to create the book. You may withdraw consent at any time by deleting your account, which will trigger deletion of your child's data as described in Section 7.

8.5 How to Exercise These Rights. To exercise any of these rights, please contact us at:

• Email: support@sevenpinescollective.com

9. State-Specific Privacy Rights

9.1 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, disclosed, or sold
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information (we do not sell personal information)
• Right to non-discrimination for exercising privacy rights
• Right to limit the use of sensitive personal information

9.2 Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws have rights that may be similar to those described above. We honour rights requests from residents of all states to the extent required by applicable law. Contact support@sevenpinescollective.com to submit a request.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our website and service. We do not use third-party advertising cookies or tracking pixels.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes — particularly changes that affect how we handle children's data — we will:

• Notify you by email at least 30 days before the changes take effect
• Post a prominent notice on our website
• For changes that affect children's data in a material way, obtain fresh parental consent before the changes apply to any existing child profiles

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your child's data, please contact us: