Privacy, in plain sight.

What this draft covers

This draft describes the intended privacy scope of the FlexSprout website and onsite campaign service. A final notice must identify the responsible legal entity and explain the different roles FlexSprout and each website operator take in processing personal information.

Account and workspace information

The service uses account identity and authentication information, organization membership, website configuration, campaign content, and billing-related records to operate workspaces. Payments are managed through the integrated billing provider; a final notice must document exactly which payment and transaction records are retained.

Information captured by campaigns

Depending on a website operator’s configuration, a campaign can collect an email address, name and phone number, consent response, survey answers, configured text/select/checkbox fields, and source-page information. Multistep answers stay in the mounted form until final capture; partial answers are not saved for later navigation. The website operator chooses the invitation and is responsible for explaining its purpose and obtaining any necessary permissions.

FlexSprout can record campaign impressions, clicks, dismissals, and conversions. Browser context supports frequency controls, visitor classification, experiment assignment, and onsite-feed read/dismissal state. The final notice must document the exact storage keys, retention, and consent treatment.

How the information is used

Product information supports account access, campaign delivery, lead management, configured integrations, reporting, billing, and service operations. A final policy must specify each processing purpose and legal basis rather than treating this list as blanket permission.

Configured integrations

Website operators can export leads and validated fields, send capture metadata to a configured webhook, or explicitly map supported fields to Klaviyo, Mailchimp, or HubSpot. Native credentials are stored encrypted and excluded from management responses. Klaviyo/Mailchimp sends require recorded affirmative email-marketing consent; HubSpot contact sync does not grant marketing subscriptions, and phone mapping does not grant SMS consent. Real credentials/provider receipts and final combined verification remain pending.

Operators are responsible for evaluating destinations and matching transfers to visitor promises. Recipient history records redacted delivery outcomes, not proof that a person read a message. A final agreement must clarify responsibilities, retention, and safeguards for these transfers.

Optional web push

The local push implementation stores website-scoped subscription endpoints, browser keys, consent, and delivery evidence after explicit opt-in. It requires VAPID and a customer-own-origin service worker; integrated UI and actual provider/device receipt verification remain pending. Provider acceptance is not a display, read, or click receipt. A final policy must explain push consent withdrawal, endpoint retirement, retention, and the receiving push services before activation.

The marketing playground

The interactive examples on this marketing site run locally in the browser. Example form submissions do not send or save the entered information. Hosting infrastructure may still process ordinary request information; final hosting and operational disclosures remain to be completed.

Retention, deletion, and rights

The product includes individual lead deletion and account management controls, but a complete retention schedule, backup deletion policy, and verified process for access, correction, export, and erasure requests still require legal and operational review. A dedicated privacy contact has not yet been published.

If you submitted information through another website’s campaign, start with that website’s published privacy contact. FlexSprout’s draft does not replace its privacy notice.

Before this becomes final

The operator must publish its legal identity and contact details, complete vendor and transfer disclosures, specify retention and security practices, establish the applicable rights process, and approve a dated final version. Until then, this page is a clearly marked review document.

See also the draft terms and consent setup guidance.