Sprig

Sprig states it will use Company Data solely to provide and maintain Services, but allows use of 'Usage Data' (de-identified, aggregated) for service improvement and other lawful purposes. The distinction between Company Data and Usage Data is clear, but the term 'other lawful business purposes' for Usage Data is somewhat vague and could include AI training.

“[ToS] 'Sprig may collect Usage Data and use it to operate, improve and support the Services and for other lawful business purposes, including benchmarking and reports.' [ToS] 'Sprig will not disclose Usage Data externally unless it is (a) de-identified so that it does not identify Company, its Users or any other person and (b) aggregated with data across other customers.'”

Sprig explicitly reserves all IP rights in the Services and related technology. Company retains all IP rights in Company Data and Company Materials. The license granted is strictly limited to providing the service with no sublicensing beyond essential service delivery.

“[ToS] 'Except for Sprig's express rights in this Agreement, as between the parties, Company retains all intellectual property and other rights in Company Data and Company Materials provided to Sprig. Except for Company's express rights in this Agreement, as between the parties, Sprig and its licensors retain all intellectual property and other rights in the Services and related Sprig technology.'”

Company Data is shared only with essential infrastructure providers under strict DPAs. Sprig explicitly states it will not disclose Company Data to third parties except as permitted in the Agreement. The DPA references sub-processors with documented safeguards and advance notice requirements.

“[ToS] 'Sprig will access and use Company Data solely to provide and maintain the Services and Support under this Agreement. Use of Company Data includes sharing Company Data as Company directs through the Services, but Sprig will not otherwise disclose Company Data to third parties except as permitted in this Agreement.' [ToS] 'Sprig may use subcontractors and permit them to exercise its rights and fulfill its obligations, but Sprig remains responsible for their compliance with this Agreement.'”

The ToS states that after termination, Sprig will delete Company Data within 60 days of request, but allows retention in accordance with standard backup or record retention policies or as required by Law. The retention period during active use is not explicitly stated, creating moderate ambiguity.

“[ToS] 'After termination or expiration of this Agreement, within 60 days of request, Sprig will delete Company Data and each party will delete any Confidential Information of the other in its possession or control. Nonetheless, the recipient may retain Company Data or Confidential Information in accordance with its standard backup or record retention policies or as required by Law.'”

Company retains all IP rights in Company Data and outputs. Sprig claims no ownership or license to Company Data or generated outputs. The agreement explicitly protects Company's exclusive IP ownership over all content it creates or submits.

“[ToS] 'As between the parties, Company retains all intellectual property and other rights in Company Data and Company Materials provided to Sprig.' [ToS] 'Except for Sprig's express rights in this Agreement, as between the parties, Sprig and its licensors retain all intellectual property and other rights in the Services and related Sprig technology.'”

The ToS references a Data Protection Addendum and Information Security Addendum but does not explicitly list SOC 2, ISO 27001, GDPR compliance, or HIPAA certifications in the provided documents. The DTA includes Standard Contractual Clauses for GDPR compliance, but formal certification status is not clearly stated.

“[ToS] 'The parties will adhere to the Data Protection Addendum (DPA) found at https://sprig.com/dpa and the Information Security Addendum (Infosec Addendum) found at https://www.sprig.com/infosec' [DTA] 'This DTA reflects the parties' commitment to abide by Data Protection Legislation concerning the transfer of Company Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom.'”