Sprout Social AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “**1.12.**“ **DPA**” means the Sprout Social Data Processing Addendum located at: [https://media.sproutsocial.com/uploads/Downloadable-Customer-DPA.pdf](https://media.sproutsocial.com/uploads/Downloadable-Customer-DPA.pdf).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “Your information may be transferred to, and processed in, countries other than the country in which you are resident. For example, if you are a resident of Canada, your personal information may be transferred to the United States for processing. These countries may have data protection laws that are different to the laws of your country. Specifically, our servers are located in the United States, and our group companies and third party service providers and partners operate around the world. This means that when we collect your information we may process it in any of these countries.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “Your information may be transferred to, and processed in, countries other than the country in which you are resident. For example, if you are a resident of Canada, your personal information may be transferred to the United States for processing. These countries may have data protection laws that are different to the laws of your country.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Sprout Social, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce (collectively, “ **Data Privacy Frameworks**”). Sprout Social has certified to the U.S. Department of Commerce that it adheres to (i) the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF; and (ii) the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF (collectively, the “ **DPF Principles**”).\\*\\* If there is any conflict between the terms in this privacy policy and the DPF Principles, the DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit [**https://www.dataprivacyframework.gov/**](https://www.dataprivacyframework.gov/).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “2. **12.2. Data Processing Addendum**. If your use of our Services includes processing personal data or personal information subject to applicable EU or US data protection laws, you must enter into the DPA. The DPA forms part of these Terms and applies to the processing of personal data.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “Specifically, our servers are located in the United States, and our group companies and third party service providers and partners operate around the world. This means that when we collect your information we may process it in any of these countries.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “With respect to any personal information received or transferred pursuant to the EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Data Privacy Frameworks, Sprout Social is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “In compliance with the DPF Principles, Sprout Social, Inc. commits to resolve complaints about your privacy and our collection or use of your information transferred to the United States pursuant to the Data Privacy Frameworks. EEA, UK, and Swiss individuals with privacy inquiries or complaints should first contact us by email at [**privacy@sproutsocial.com**](mailto:privacy@sproutsocial.com). We will work to resolve your issue and will respond within 45 days of receipt. If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the EEA, the United Kingdom, or Switzerland, you have the right to lodge a complaint with the competent supervisory authority.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain the personal information we collect for as long as it is necessary to complete the commercial purposes for which it was collected. Once the information is no longer necessary, we will delete it or de-identify/anonymize this data so that it no longer identifies a particular individual.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “When we have no ongoing legitimate business need to process your information, we will either delete or anonymize it in accordance with our data retention policy, or, in the limited circumstances where this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). When we have no ongoing legitimate business need to process your information, we will either delete or anonymize it in accordance with our data retention policy, or, in the limited circumstances where this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- Partners that offer co-branded services, sell or distribute our products, or engage in joint marketing activities.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Please note the Service uses third-party services, and if you use these third-party services through the Service, you are subject to the privacy policies of these third-party services (as applicable), including but not limited to:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Sprout Social and its Affiliates may provide your data to third parties if required by law or as permitted by you to provide the Services. Before providing your data to any third party service provider, we will take steps designed to ensure that the third party service provider maintains commercially reasonable data practices for maintaining the confidentiality and security of your data and for preventing unauthorized access to such data. We do not provide your data to third parties for their own marketing purposes.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may share your personal information with government entities when required to do so by law. Please review the [**To Whom We Share Your Information**](https://sproutsocial.com/privacy-policy/#to-whom-we-share-your-information) section for more detail about the parties we have shared information with.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “1. **12.1. Permitted Disclosures**. Sprout Social and its Affiliates may provide your data to third parties if required by law or as permitted by you to provide the Services. Before providing your data to any third party service provider, we will take steps designed to ensure that the third party service provider maintains commercially reasonable data practices for maintaining the confidentiality and security of your data and for preventing unauthorized access to such data. We do not provide your data to third parties for their own marketing purposes.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “**1.30.**“ **Third-party Service**” means any third-party product, service, or software provided under separate terms and conditions used in conjunction with the Services, including but not limited to certain social media networks and other integration partners.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- to creators who use the Service (including information pertaining to other creators and customers who may be interested in working with them) in order to effectively provide our, influencer marketing services and to manage their account. For example, we share information with creators who use the Service in order to help them identify and connect with customers they want to work with, maintain and administer their online accounts, respond to their questions and comments, comply with their requests, market and advertise to them and otherwise comply with our terms and with applicable law;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “5. **5.4.** **Credit Card and PayPal Authorization**. You acknowledge and agree that Sprout Social uses a third-party payment processor to process payments made by credit card or PayPal account. By submitting your credit card or PayPal information to Sprout Social, you authorize the third-party payment processor, acting on behalf of Sprout Social, to store such information and to charge the credit card or PayPal account until your Account is terminated. In addition, you authorize us to use a third-party payment processor in processing payments. If your credit card expires, or is declined, or your PayPal information requires an update, we will provide you notice via email. If, for any reason, your payment cannot be completed through credit card or PayPal, we may suspend your Account until we receive payment. You can choose to set up a backup payment method that will be used if the primary method fails for any reason (such as an expired credit card or insufficient funds). By adding a backup payment method, you agree that, if your primary payment method fails, Sprout Social can automatically charge your backup payment method to avoid any interruptions or suspensions to your Account.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “| **Third-Party Service** | **Location** |” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “| YouTube Privacy | [https://policies.google.com/privacy](https://policies.google.com/privacy) |” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “1. **4.1. Connecting to Third-party Services.** The Applications contain links to and allow you to connect to and use certain Third-party Services. To use any Third-party Services, you must be registered for or logged into such Third-party Service. By accessing or enabling a Third-party Service within an Application, you are authorizing a secure authentication token to pass from the Third-party Service to the Application for this express purpose.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Pursuant to Section 1798.83 of the California Civil Code, residents of California can obtain certain information about the types of personal information that companies with whom they have an established business relationship have shared with third parties for direct marketing purposes during the preceding calendar year. In particular, the law provides that companies must inform consumers about the categories of personal information that have been shared with third parties, the names and addresses of those third parties, and examples of the types of services or products marketed by those third parties. To request a copy of the information disclosure provided by Sprout Social pursuant to Section 1798.83 of the California Civil Code, please contact us via email at [**privacy@sproutsocial.com**](mailto:privacy@sproutsocial.com).” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or court order or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Where Sprout Social, Inc. transfers your personal information to a third party acting as an agent on its behalf, it shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles (unless Sprout Social Inc is not responsible for the event giving rise to the damage).” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “| Pinterest Privacy Policy | [https://policy.pinterest.com/en/privacy-policy](https://policy.pinterest.com/en/privacy-policy) |” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “- Customers that provide us with information which we process as a service provider.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “We share information we collect in accordance with the practices described in this Privacy Policy. The following are the categories of recipients:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Notwithstanding the above, we may share information that does not identify you (including information that has been aggregated or de-identified) except as prohibited by applicable law. When information is de-identified (as defined by the CCPA), we maintain policies and technical procedures to avoid reidentification of such information. For information on your rights and choices regarding how we share information about you, please see the “ [**Your Data Protection Rights**](https://sproutsocial.com/privacy-policy/#your-data-protection-rights)” section below. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- Share anonymized or personalized tokens across the Sprout Social, Influencer Marketing and Employee Advocacy platforms in order to provide the Service;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “We do not knowingly “sell” or “share,” as those terms are defined under the California Consumer Privacy Act, as amended, the personal information of minors under 16 years old who are California residents.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Please note that when you interact with other entities, including when you leave our Site or Service, those entities may independently collect information about you and solicit information from you. The information collected and stored by those entities remains subject to their own policies, terms, and practices, including what information they share with us, your rights and choices on their services and devices, and whether they store information in the U.S. or elsewhere. We encourage you to familiarize yourself with and consult their privacy policies and terms of use.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- to our affiliates, service providers and partners who provide data processing services to us (for example, to support the delivery of, provide functionality on, or help to enhance the security of our Site or Service), or who otherwise process information for purposes that are described in this Privacy Policy or for which we provide you notice when we collect your information. We share information with our affiliates for business and commercial purposes. We contractually prohibit our service providers from retaining, using, or disclosing information about you for any purpose other than performing the services for us, although we may permit them to use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- to our customers (including information pertaining to customer end-users as well as internal personnel and creators who may be relevant to their influencer marketing) in order to effectively provide our social media management, social advocacy, social analytics, influencer marketing and social listening services and to manage the customer relationship. For example, we share information with our customers in order to facilitate the processing of their orders, maintain and administer their online accounts, respond to their questions and comments, comply with their requests, help them identify and connect with creators they want to work with, market and advertise to them and otherwise comply with our contractual obligations and with applicable law;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- to a potential buyer (and its agents, investors, and/or advisors) in connection with any proposed or actual purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your information only for the purposes disclosed in this Privacy Policy;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- when you voluntarily enter a sweepstakes, contest, or other promotion, we share information as set out in the official rules that govern the promotion as well as for administrative purposes and as required by law (e.g., on a winners list). By entering a promotion, you agree to the official rules that govern that promotion, and may, except where prohibited by applicable law, allow the sponsor and/or other entities to use your name, voice and/or likeness in advertising or marketing materials;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “- when you request or direct us to share information, such as when you choose to share information with a social network or other third party platform about your activities on the Service, which may require you to accept such third party’s terms of use or privacy policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “- The categories of third parties to whom the personal information was disclosed for a business purpose or sold;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “| TikTok Privacy Policy | [https://www.tiktok.com/legal/page/us/privacy-policy/en](https://www.tiktok.com/legal/page/us/privacy-policy/en) |” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “| LinkedIn Privacy Policy | [https://www.linkedin.com/legal/privacy-policy](https://www.linkedin.com/legal/privacy-policy) |” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “2. **5.1. Payment in Application (applicable to Sprout Social Subscription Services only)**.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “**1.15.**“ **Free Trial**” means access to the Services on a trial or evaluation basis at no charge.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “**1.17. “Influencer Marketing Subscription Services**” means the proprietary influencer marketing subscription services, which include the use of Sprout Social’s web-based Applications, technical support, and applicable documentation, each corresponding to the applicable Plan.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “**1.19.**“ **Plan**” means the specific services and product features available to you based upon your subscription. Plan details may be outlined within the Application or on a Service Order.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “**2.1. Plan Details.** The Services available to you will be based on your Plan.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “1. **2.1.1.** **In-App Purchases (Available for Sprout Social Subscription Services only).** If you purchased the Sprout Social Subscription Services within the Application, the details of your Plan will be set forth on the billing page within the Application.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “**1.26.**“ **Subscription Services**” means the Sprout Social Subscription Services, Employee Advocacy and/or the Influencer Marketing Subscription Services purchased by Subscriber per the applicable Plan or Service Order. Subscription Services do not include Professional Services or any Third-party Services.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.