Who we are
Barn is run by Sproutally (“we”). Your Organisation — the company that gave you access — decides who uses Barn and for what; we process your data on its behalf and as this policy says.
What we collect
- Your name, work email, mobile number, Organisation and role, as your Organisation’s Admin entered them.
- What you do in Barn: the records you create or change, with times, so your Organisation has an audit trail.
- Sign-in and security data: when and how you signed in, your device and browser, and your IP address.
- If you choose Continue with Google: your Google account’s name, email address and profile picture. We ask Google for nothing else — not your contacts, files, mail or calendar.
Why we use it
- To sign you in: a one-time code to your email or mobile, or Continue with Google followed by a code to the mobile number on file.
- To run Barn for your Organisation, keep it secure, and fix problems.
- To send the messages the service needs (sign-in codes, invitations). We do not send marketing without your consent.
Google user data
Barn’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use your Google name, email and picture only to find your account and show who is signed in. We never sell it, use it for advertising, or let anyone read it except to keep the service running or when the law requires.
Who processes it for us
Supabase (database and sign-in, region ap-south-1), Vercel (hosting), Resend (email), Twilio (SMS codes) and Google (Continue with Google) process data for us under contracts that limit them to providing their service. We share data with nobody else unless the law requires it.
How long we keep it
Account and usage data is kept while your Organisation uses Barn and deleted within 90 days after its subscription ends, unless the law requires us to keep it longer. Sign-in and security logs are kept for 180 days.
Your rights
You may ask to see, correct or delete your data, withdraw a consent you gave, or nominate someone to act for you, by writing to aniruddh.jain@sproutally.com. Some requests go through your Organisation’s Admin, who controls your account. We answer within 30 days.
Grievance Officer
Aniruddh Jain — aniruddh.jain@sproutally.com. If you are not satisfied with our answer you may complain to the Data Protection Board of India.
Security
Data is encrypted in transit and at rest; sign-in uses one-time codes; access inside your Organisation follows the roles its Admin gives.
Changes
We will post any change here with a new date, and tell your Organisation’s Admin before a change that affects how your data is used.