Privacy policy

This policy covers sprowtt.com and the Sprowtt software: companies raising capital, their counsel, the investors a company admits to its deal room, people who request a demo or contact us, and the companies, law firms and insurers Sprowtt contacts about its own business.

When a company puts its investors' details into Sprowtt, or an investor signs in to a company's deal room, Sprowtt handles that information for the company, to run the company's workspace. The company's own privacy notice governs what the company does with it.

Investors in a company's offering belong to that company. They are nobody else's investors. Sprowtt handles their details only to run that company's workspace.

We use your email address to sign you in and to reach you about your account. Sign-in may use a one-time code sent to your email address, and two-factor sign-in with an authenticator app and backup codes. Sign-in, sign-up and password-reset attempts are rate-limited, and a session is kept in a secure cookie on sprowtt.com.

Access follows the role. A company sees its own workspace. Counsel sees the offerings on its own firm's seat. An investor sees only the deal rooms a company admitted them to, and only the documents the company opened to them. A Portal Admin seat for a law firm sees that firm's own client companies, including their investors. A Portal Admin seat for a city sees the companies in its city, with counts and totals of their investors but never who the investors are, unless a company grants that seat access to its investor list. Sprowtt staff may look inside a company to support it and cannot change anything there. Every privilege change is recorded with the person who made it.

The people on a company's investor list can be seen by the company; its own counsel; the people the company authorizes; Sprowtt's Super Admin, who may look inside a workspace to support and secure it and cannot change anything there; the service providers that process data for Sprowtt under confidentiality, only for their task; and anyone the law requires Sprowtt to disclose them to. A Portal Admin seat for a law firm sees the investors of that firm's own client companies. A Portal Admin seat for a city sees counts and totals only, never who the investors are, unless the company grants that seat access to its investor list. The company can revoke a grant at any time, and every grant and revocation is kept on record.

Recording what a named person did while considering a securities purchase is sensitive, and it is the part of this product that most needs saying out loud. Sprowtt may record which sections of a deal room were opened, the position reached in a video, and where a visit ended, joined to the investor's reservation so the company can see what mattered.

That capture stays switched off for an offering until the company's own privacy policy describes it. The report the company receives carries a waiver, rendered into the PDF as well as shown on screen.

A company may show Sprowtt's notice card and an investor sign-in button on its own website. When the card is shown, Sprowtt records the offering, the website it was shown on, how it was placed and the time; it does not record who looked at it. The card and the button set no cookies on the company's website.

The sign-in button opens Sprowtt in a new tab, where the sign-in cookie is Sprowtt's own, on sprowtt.com. The link back to the company's website is offered only to an address the company registered with Sprowtt, so a sign-in can never be used to send you somewhere else.

A company may send updates to the investors in its own deal room through Sprowtt. The update is the company's. Each one carries an unsubscribe link; an unsubscribe is honoured for good, and Sprowtt records when it was made so it is never overridden.

Conferences run on Daily (daily.co). Daily processes the audio, video and names of the people taking part under its own terms. Where a conference is recorded, the people taking part are told before they join, and the recording is kept in the company's workspace, where the company and the people it chooses can watch it.

In a Rule 506(c) offering an investor may verify accredited status with a third-party verification service, such as InvestReady or Verify Investor, which the investor uses directly on its own website; Sprowtt lists these as courtesy referrals and does not connect to them, so the service's data about the investor stays with the service under its own privacy policy. The investor then uploads the letter it gives them, or a letter from their own attorney or certified public accountant. An uploaded letter is kept as a private file that only the investor, the company running that offering and Sprowtt's Super Admin can open. Where the company offers the minimum-investment route, Sprowtt keeps the investor's written statements word for word, the version of that wording, the amount committed, the investor's typed name and the date, for the company running that offering.

Each verification is valid for 90 days from the day the company accepts it. The company, not Sprowtt, decides whether to accept it. No AI is used in this step.

Sprowtt's AI tools are for companies and their counsel only, and for Sprowtt's own business outreach described below. They are never used with investors. The AI providers Sprowtt uses include xAI and Perplexity, and Sprowtt may use others. What is sent to them is the text needed for the task, and we do not use your workspace content to train a third party's model.

Sprowtt contacts companies, law firms and insurers about Sprowtt's software. Never investors. We may find them from public sources, such as SEC filings and public websites, with the help of research tools we call Scouts, and we may keep a business contact's name, title, organization, business email address and the public source it came from.

We may email them, and each email carries an unsubscribe link that is honoured for good. We may also publish posts on social media about Sprowtt. We may count clicks on the links in Sprowtt's own outreach, and Sprowtt's outreach emails may record when they are opened, to see which messages are useful. Only the time and the kind of mail app are kept, never a location, a network address or browser details, and an address that unsubscribed is never tracked. That tracking never applies to sign-in codes, invitations, receipts or any other account email, or to a company's communications with its investors.

If you ask for a walkthrough, we use your details only to contact you about Sprowtt's software, as the box you ticked says, and we may email you a link to confirm your address. You can opt out any time with the unsubscribe link in any email from Sprowtt or by writing to info@sprowtt.com; your address is then never emailed again. The request itself is kept, like every record in Sprowtt, and is never sold.

Each provider receives only what it needs for its task and works under its own terms and privacy practices.

Sprowtt uses a small number of cookies it needs to work: the sign-in session, and the setting that keeps two-factor sign-in secure. The pricing page remembers, in your browser, that you confirmed your email address. On your first visit your browser also remembers that it has been here and whether it has already shown the one-time offer some pages make before you leave, so that offer never appears twice; nothing about this is sent to Sprowtt. Sprowtt does not use advertising cookies. If Sprowtt adds website analytics, this policy will say so and name the service.

Nothing in Sprowtt is ever deleted. Records are only archived, kept in folders: each company has an archive folder holding its full history, and a record that is withdrawn or entered by mistake is archived there with who changed it and when. This is for regulatory and legal record-keeping. An offering's notices, investor communications, acceptances and access logs may need to be produced to a regulator or a court years later, and a gap in them would harm the company and its investors.

You may ask to see the personal information Sprowtt holds about you, and to have anything wrong corrected. Where a company entered your details, we will pass your request to that company, because it is the company's record. A correction is recorded alongside the original, so the history stays complete.

Connections are encrypted, uploaded files are only served through an access check, bank details are stored encrypted, sign-in attempts are rate-limited, administrators must use two-factor sign-in in production, and the database refuses to delete a record. The Security page describes these controls in full.

Sprowtt's server is in a data center in the United States, and your information is held there.

Sprowtt is not for anyone under 18. We do not knowingly hold information about anyone under 18; if we learn we do, the account is suspended and the record archived.

We may update this policy. Items described as things Sprowtt may do are covered when they are switched on. If a change would use your information in a materially different way, we will tell you first.

Privacy questions and requests to see or correct your information: info@sprowtt.com, with "Privacy" in the subject line.