Privacy Policy

Last updated: October 2026

Spriggle ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use and store your data when you use Spriggle at spriggle.co.uk.

1. Data we collect

Your name and email address when you sign up
Your business name and description
Social media access tokens you connect (Facebook, Google Business Profile, Google Analytics, Google Search Console, Google Drive, YouTube, Gmail)
Posts you create and schedule through Spriggle
Images you upload to your Media Library
Usage data to improve the service

2. How we use your data

To provide the Spriggle service — posting, scheduling, AI generation
To send your weekly email report (if enabled)
To process your subscription payments via Stripe
To improve Spriggle based on usage patterns

3. Facebook data

When you connect your Facebook Page, Spriggle receives a page access token that allows us to post content on your behalf. We store this token securely in our database. We only post content that you explicitly create or schedule through Spriggle. We do not share your Facebook data with any third parties.

3a. Google data (Gmail, Drive, Analytics, Search Console, YouTube, Business Profile)

Data accessed: Depending on which Google services you choose to connect, Spriggle accesses: your Gmail address and profile name (to identify the connected account); the ability to send email on your behalf via Gmail, used solely to deliver your scheduled performance report emails — Spriggle does not read, search, or modify any existing email in your inbox; only the files you explicitly select in Google's file chooser (Google Picker) to import into your Media Library, using the drive.file scope — Spriggle cannot browse, list or read any other file in your Drive; read-only website traffic metrics (sessions, users, pageviews, bounce rate, session duration and top traffic sources) from a Google Analytics property you choose to connect, using the analytics.readonly scope — Spriggle cannot change anything in your Analytics account; read-only search performance data (clicks, impressions, click-through rate, average position and top search queries) for a Google Search Console site you choose to connect, using the webmasters.readonly scope — Spriggle cannot change anything in your Search Console account; your YouTube channel details, used to upload videos you create and choose to publish through Spriggle; and your Google Business Profile listing, used to list your locations, publish posts you create, and read your listing's performance metrics (search and Maps impressions, direction requests, call clicks and website clicks) to show in your dashboard. Spriggle does not edit or delete your listings or reply to reviews.

Data use: This data is used exclusively to provide the corresponding user-facing feature you've enabled — sending your report emails, importing selected media, displaying your website analytics and search performance, publishing your videos, or posting to and reporting on your Business Profile. We do not use Google user data for advertising, and we do not use it to train or improve any AI/ML models.

Data transfer: We do not sell or share your Google user data with third parties, except where required to operate the service itself (e.g. our hosting provider, Railway, and our database provider, Supabase, both of which store this data securely on our behalf and do not use it for their own purposes).

Data protection: Google user data and the access tokens that let us reach it are protected by the specific measures set out in section 4a below: encryption in transit (HTTPS/TLS), encryption at rest, strict per-customer access controls, server-side-only token handling, read-only access where possible, and restricted internal access. All connections use OAuth 2.0 — we never see or store your Google account password.

Data retention & deletion: Connected account tokens are retained only for as long as the connection remains active. You can disconnect any Google service at any time from Settings, which immediately deletes the stored access token. Deleting your Spriggle account deletes all associated Google connection data immediately.

4. Data storage

Your data is stored securely using Supabase (PostgreSQL database hosted in the EU). Images are stored in Supabase Storage. Payments are processed by Stripe — we never store your card details.

4a. How we protect sensitive data

This applies to all sensitive data we hold, including the Google user data we access (such as Google Analytics data via the analytics.readonly scope) and the OAuth access and refresh tokens for every service you connect. We protect it with the following measures:

Encryption in transit: All traffic between your browser and Spriggle, and between Spriggle and Google, Meta, Stripe and our database provider, is encrypted using HTTPS/TLS.
Encryption at rest: Your data, including connection tokens, is stored in a Supabase-hosted PostgreSQL database in the EU, which is encrypted at rest by the provider.
Access controls and customer isolation: Every request to our API is authenticated by verifying your signed-in session on the server, and data is only ever read from or written to your own workspace. One customer can never access another customer's data or tokens.
Server-side-only tokens: Access and refresh tokens are used only on our servers to call the relevant API on your behalf. They are never sent to your browser, displayed in the app, or included in any response to the app. The only exception is the Google Drive file chooser (Google Picker): when you choose to import from Drive, Google issues a short-lived token, limited to the drive.file scope, directly to your browser so that you can select files. Spriggle never receives or stores that token.
Least privilege: We request only the minimum permissions each feature needs. For Google Analytics and Search Console these are read-only scopes, so we can view your reports but cannot modify your accounts, properties or users.
Secrets management: Our own credentials (API keys and OAuth client secrets) are kept in protected server environment variables, never in source code or in anything delivered to your browser.
Restricted internal access: Access to our production servers and database is limited to authorised Spriggle personnel only, and we do not read your Google user data except where needed to provide support you have asked for or to comply with the law.
No password handling: Connections use OAuth 2.0, so we never see or store your Google account password.
Revocation and deletion: You can disconnect any service at any time in Settings, which immediately deletes the stored tokens, or revoke Spriggle's access from your Google Account permissions page. Deleting your account removes all associated data (see sections 3a and 5).

5. Data retention

We keep your data for as long as your account is active. If you cancel your subscription, we retain your data for 30 days before deletion. You can request immediate deletion by emailing info@spriggle.co.uk.

6. Your rights

You have the right to access, correct or delete your personal data at any time. Email us at info@spriggle.co.uk and we will respond within 30 days.

7. Cookies

Spriggle uses essential cookies only — for authentication and keeping you logged in. We do not use advertising or tracking cookies.

8. Third-party services

Supabase — database and authentication
Stripe — payment processing
OpenAI — AI content generation
Railway — server hosting
Meta/Facebook — social media posting
Google — Business Profile posting, Gmail (sending report emails), Google Drive (media import), Google Analytics (website traffic reporting), Google Search Console (search performance reporting), YouTube (video publishing)

9a. Limited Use compliance

Spriggle's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve, or train AI/ML models, and is never transferred to any third-party AI service for that purpose.

9b. Contact

For any privacy questions or data requests, contact us at:
Email: info@spriggle.co.uk
Address: Cornwall, United Kingdom