Privacy Policy

1. Introduction

CSE Holdings LLC d/b/a Sproos (“Sproos,” “we,” “us,” or “our”) operates the Sproos home management application and the sproos.ai website (collectively, the “Services”). Sproos helps homeowners organize their home, upload and analyze inspection reports, and receive AI-powered maintenance recommendations.

This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our Services. It also describes the choices you have regarding your information and how to exercise those choices.

By creating an account or using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Services.

This Privacy Policy is intended for individual users of the Sproos app and website.

2. Information We Collect

2.1 Account and Authentication Information

When you create a Sproos account, we collect:

• Name
• Email address
• Password (stored in hashed form; we do not store your password in plaintext)
• Apple or Google single sign-on tokens, if you use Sign in with Apple or Sign in with Google
• A system-generated user identifier (UUID) used internally and passed to our analytics and error monitoring services

2.2 Home Profile and Property Data

The core of the Sproos experience is your home profile. We collect:

• Your home’s street address, entered manually using Google Places address autocomplete. This is your precise home address, not your device’s GPS location. We do not request device location permissions.
• Property data retrieved from ATTOM Data Solutions based on your address, including year built, square footage, lot size, and ownership records. This data is fetched when you set up your home and is linked to your account.
• Home attributes you enter manually (e.g., roof type, HVAC system details, appliance information).
• Climate zone and regional data derived from your address, used to generate seasonally appropriate maintenance recommendations.

2.3 Inspection Reports

You may upload home inspection reports in PDF format. When you do:

• The full inspection report PDF is stored in your account.
• The text content of the report is extracted using AI processing (powered by Anthropic’s Claude API) and stored as structured data in your home profile.
• Specific findings, issues, and recommendations identified in the report are extracted and used to generate maintenance priorities and project recommendations.
• Inspection metadata, including inspection date and inspector name if present in the document, is extracted and stored for indexing purposes.

Inspection report content is transmitted to Anthropic solely for the purpose of AI processing and is not used by Anthropic to train its models, pursuant to Anthropic’s API terms and Customer Data Processing Addendum. Your inspection reports are stored privately in your account and are not shared with any other third party.

2.4 Photos and Visual Content

You may upload photographs through the app, including:

• Room photos (for the design module and before/after comparisons)
• After-photos documenting completed projects
• System photos, such as images of HVAC nameplates or appliance labels, used to enrich your home profile
• Inspiration imagery (such as images shared from Pinterest or Instagram)

Photos are stored privately in your Sproos account and are not accessible to other users. When you use a feature that analyzes an image (for example, scanning a system data plate, analyzing a room for design recommendations, processing a photographed contractor quote, or importing inspiration imagery), the relevant photo is transmitted to our AI provider, Anthropic, solely to generate that result. Anthropic processes the image on a data-in, data-out basis and does not use it to train its models, pursuant to Anthropic’s API terms. Photos you upload purely for your own records are not sent for analysis. We do not otherwise share your photos with any third party, and we do not use your photos for advertising.

Photos taken with your device camera may contain EXIF metadata embedded by your device, which can include GPS coordinates, timestamp, and device information. This metadata is currently preserved with the photo file upon upload.

2.5 User-Generated Content

You may enter or generate the following content within the app:

• Planned and known projects
• Notes on projects, rooms, and home systems
• Room ratings and design preferences
• Conversations with Ask Sproos (our AI assistant), including your questions and the AI-generated responses
• Maintenance task completion records, including dates and notes
• Contractor information, cost entries, and contractor quotes

Ask Sproos conversation content (your prompts and the AI responses) is transmitted to Anthropic for AI processing and stored in your account for conversation history. Anthropic does not use this content for model training. Because your prompts may include personal or sensitive context about your home and household, we encourage you to avoid sharing information you wish to keep entirely confidential through the Ask Sproos feature.

2.6 Usage and Analytics Data

We use PostHog, a product analytics platform, to understand how users interact with the app. PostHog collects:

• In-app event data (screens viewed, features used, taps, navigation paths)
• Session and device context (device model, OS version, app version)
• Identity traits derived from your home profile, including home ID, climate zone, home age, and whether you have uploaded an inspection report, used for cohort analysis to understand how different types of homes and users use the app

This analytics data is linked to your Sproos user ID. It is used for product improvement and personalization. Sproos does not use this data for advertising or share it with advertising platforms.

2.7 Crash and Performance Data

We use Sentry for application crash reporting and performance monitoring. Sentry collects:

• Crash stack traces and error events when the app encounters a problem
• Performance metrics
• Device context (model, OS version, app version)
• Breadcrumb logs: a record of recent in-app actions preceding a crash, used to help diagnose the cause

Crash data is linked to your Sproos user ID where the Sentry SDK has been configured to do so. Sentry data is retained for 90 days by default.

2.8 Notifications and Email

If you enable push notifications, we collect your push notification token (issued by Apple APNs via Expo Push) and use it to deliver maintenance reminders and app notifications. We collect delivery status for operational purposes.

We use Resend to deliver transactional email, including account verification emails, password reset emails, and notifications. Resend receives your email address and the content of these messages. We collect email delivery status (sent, bounced, opened) for operational purposes.

2.9 Website and Cookie Data

When you visit sproos.ai, we may collect information through cookies and similar tracking technologies as described in our Cookie Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Operating the Services

• Creating and managing your account
• Building and maintaining your home profile
• Processing uploaded inspection reports and generating AI-powered maintenance recommendations
• Delivering AI assistant responses through Ask Sproos
• Sending push notifications and transactional emails
• Enabling photo storage and retrieval within your account

3.2 Personalization

• Tailoring maintenance recommendations to your home’s specific attributes, age, climate zone, and inspection findings
• Generating design recommendations based on your preferences and room ratings
• Providing regionally appropriate, seasonally timed maintenance reminders

3.3 Analytics and Product Improvement

• Understanding how users interact with the app to improve features and usability
• Identifying bugs, crashes, and performance issues
• Measuring feature adoption across different user cohorts

3.4 Safety and Security

• Detecting and preventing fraudulent, unauthorized, or illegal activity
• Maintaining the integrity and security of our systems and user data
• Responding to safety-related triggers in Ask Sproos conversations (such as emergency protocol detection)

3.5 Legal Compliance

• Complying with applicable federal, state, and local laws and regulations
• Responding to valid legal process, regulatory inquiries, and governmental requests
• Enforcing our Terms of Service

4. How We Share Your Information

We do not sell your personal information. We do not share your personal information with advertisers or data brokers. We share information only in the following circumstances:

4.1 Service Providers and Subprocessors

We share information with third-party service providers who process data on our behalf in order to operate the Services. These providers are contractually bound to use your data only for the purposes we specify. Our current subprocessors are listed in the table below.

We update this list as our subprocessor relationships change. Material changes will be reflected in an updated Privacy Policy.

4.2 Legal Requirements and Protection of Rights

We may disclose your information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law or respond to valid legal process; (b) protect the rights, property, or safety of Sproos, our users, or the public; or (c) detect, prevent, or address fraud, security, or technical issues.

4.3 Business Transfers

If Sproos is involved in a merger, acquisition, financing, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you of any such change by posting a notice on sproos.ai or by email, and will describe your choices at that time.

4.4 With Your Consent

We may share your information for any other purpose with your explicit consent at the time of collection or sharing.

5. Data Retention

We retain your personal information for as long as your account is active. When you delete your account, we may delete or anonymize your personal information within 365 days, except as required by applicable law, legal process, or legitimate business purposes (such as fraud prevention or dispute resolution).

Certain subprocessors maintain their own retention periods: Sentry retains crash data for 90 days by default; PostHog retains analytics data per its configurable retention settings (default 7 years); Resend retains email delivery data per its published retention policy.

6. Data Security

We implement physical, electronic, and procedural safeguards designed to protect your personal information. Specific measures include:

• All user data is stored in Supabase with row-level security policies that restrict each user’s access to their own data
• Data is encrypted in transit (TLS) and at rest
• Authentication is handled through Supabase Auth, with hashed password storage and support for Sign in with Apple and Sign in with Google
• Access to production systems is restricted to authorized personnel

No method of electronic transmission or storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security.

7. Children’s Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe that a child under 13 has provided us with personal information, please contact us using the information in Section 11 and we will take steps to delete that information.

8. Your Rights and Choices

8.1 Account Information

You may update or correct your account information at any time through the app’s account settings. You may delete your account through the app’s account settings.

8.2 Push Notifications

You may opt out of push notifications by adjusting your device notification settings for the Sproos app at any time.

8.3 Analytics Opt-Out

PostHog supports opt-out of analytics tracking.

8.4 California Residents: CCPA Rights

California residents have additional rights as described in the California Supplement below.

8.5 Other State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive consumer privacy laws may have rights to access, correct, delete, and port their personal information, and to opt out of certain processing. To exercise these rights, please contact us using the information in Section 11. We will respond in accordance with applicable law.

9. International Data Transfers

Sproos is based in the United States. Our Services are operated from the United States, and your information is stored and processed in the United States. If you are accessing the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have data protection laws that differ from those in your country.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the effective date at the top of this policy and, where appropriate, by providing notice through the app or by email. We encourage you to review this Privacy Policy periodically. Your continued use of the Services after any update constitutes your acceptance of the revised policy to the extent permitted by applicable law.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about our data practices, please contact legal@sproos.ai.

Privacy Policy Supplement for California Residents

Sproos: California Consumer Privacy Act (CCPA)

Effective Date: June 18, 2026 | Last Updated: June 20, 2026

This supplement applies to natural person residents of California and provides information required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”). It supplements and should be read together with the Sproos Privacy Policy above. To the extent of any conflict, this supplement controls with respect to California residents.

Categories of Personal Information We Collect

We have collected some or all of the following categories of personal information from California residents within the last twelve (12) months. The “Examples as Applied to Sproos” column reflects the actual data flows described in this Privacy Policy.

Use of Sensitive Personal Information

We collect sensitive personal information (as defined by the CCPA) only in the following limited circumstances, and solely to the extent necessary for each stated purpose:

• Account log-in credentials: to authenticate your identity and secure your account.
• Home address (precise location): to look up your property in ATTOM’s database, derive your climate zone, and power location-aware maintenance features. We do not use your home address for advertising or share it with advertising partners.
• Inspection report content (which may describe property hazard conditions): to process your uploaded inspection report and generate maintenance recommendations. This content is transmitted to Anthropic solely for AI processing and is not used by Anthropic for model training.

We do not use sensitive personal information to infer characteristics about you beyond the purposes listed above, and we do not sell or share sensitive personal information.

Purposes for Collecting Personal Information

We collect personal information for the business and commercial purposes described in Section 3 of the Privacy Policy above, including: providing and operating the Services; personalizing your home management experience; improving our product; maintaining safety and security; and complying with applicable law.

Disclosure of Personal Information

We do not sell personal information as that term is defined in the CCPA. We do not share personal information for the purpose of cross-context behavioral advertising.

Within the last twelve (12) months, we have disclosed personal information for business purposes to the service providers and third parties identified below.

Your Rights Under the CCPA

Right to Know: You have the right to request that we disclose: the categories and specific pieces of personal information we have collected about you; the categories of sources from which we collected it; our business or commercial purpose for collecting it; and the categories of third parties to whom we disclosed it.

Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (including our need to retain information to complete a transaction, comply with legal obligations, or defend against legal claims).

Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is required at this time. If our practices change, we will update this notice and provide an opt-out mechanism.

Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information to the purposes permitted by the CCPA. We use sensitive personal information only for purposes that fall within the CCPA’s permitted uses as described above.

Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights, including by denying service, charging different prices, or providing a different level of service.

How to Exercise Your Rights

To submit a rights request, use any of the following methods:

• Email us at: legal@sproos.ai

We will verify your identity before processing your request by matching information you provide against records in our system. Depending on the nature of the request, we may ask for additional verification. We will acknowledge your request within 10 business days and respond substantively within 45 calendar days, with a possible 45-day extension if reasonably necessary.

You may designate an authorized agent to submit a request on your behalf, provided you submit a signed written authorization. We may verify the authorized agent’s identity and authority using the process described above.

Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, or as required by applicable law. See Section 5 of the Privacy Policy above for additional detail.

Contact

For questions about this CCPA supplement or to exercise your rights, contact Sproos at legal@sproos.ai.