1. Overview
The DigiSparrow is an AI agent and custom software development studio, based in Hamilton, Ontario, Canada, with a second office in Ludhiana, Punjab, India. Our one product is Botnira, an AI voice and chat receptionist. We also build custom AI agents, mobile applications and Moodle-based education platforms for clients (for example, we developed the ImmiPRO CRM for ImmiPRO CRM and IT Solutions in Mississauga, Canada, which operates that product itself). This policy is written to cover three different relationships at once, because they involve different data and different responsibilities: you browsing our website, you applying for a job with us, and you (or your business) using or being processed through Botnira or a system we built or host for a client.
2. Who this policy covers
This policy applies to:
- Website visitors — anyone browsing thedigisparrow.com, including through the contact form, our blog, or the Botnira chat widget embedded on our pages.
- Job applicants — anyone submitting a general application through our Careers page.
- Business customers ("Customer," "you," if you've signed up for Botnira or engaged us to build or host software) — the companies and professionals who use our software to manage their own clients' data.
- End users / data subjects — the callers, chat visitors, students, learners or other individuals whose personal data a business customer submits to, or collects through, Botnira or a custom system we built. If you are an end user of a business that uses Botnira or a system we built, you should also refer to that business's own privacy policy — they control how your data is used, and we process it on their instructions (see Section 5).
3. Information we collect directly
When you interact with our website or apply for a role, we collect what you give us directly:
- Contact form: name, email address, what you're looking to build, and your message.
- Careers form: name, email, phone number, home address, the position you're interested in, education history, work experience, LinkedIn/portfolio URL, an optional resume/CV file (PDF, DOC, or DOCX), and anything else you choose to tell us in the notes field.
- Automatically, via cookies and analytics: see Section 9.
We use this information to respond to your enquiry, evaluate your application, and keep a record in case a relevant opening comes up later. See Section 10 for how long we keep it.
4. Information processed through Botnira & custom-built systems
Botnira, and the custom systems we build for clients, are used by businesses to store and process their own clients' personal data — not ours. Depending on the system, that can include:
- Botnira (AI voice & chat agent): caller and chat-visitor phone numbers, names, appointment and booking details, call recordings and transcripts, chat message content, and any information a caller or chat visitor volunteers during a conversation (e.g. an address for a service call, or symptoms described to a healthcare front desk).
- Custom-built systems (AI agents, mobile apps, Moodle and education platforms, CRMs): whatever categories the client's own system is designed to handle — for example, student and learner records, course progress and assessment results for education platforms, or client files and uploaded documents for a CRM. Some of this can be sensitive personal data under privacy laws. What is collected is defined by the client and the system's design, not by us, and is described in the project scope.
We do not decide what data a Customer collects, why they collect it, or how long they keep it — those decisions belong to the Customer, per Section 5. We provide the infrastructure that stores and processes it on their instructions.
5. Our role: controller vs. processor
For data described in Section 3 (our own website visitors and job applicants), we act as the data controller — we decide why and how that data is used, and this policy governs it directly.
For data described in Section 4 (data our Customers submit to, or collect through, Botnira or a system we host or support for them), we act as a data processor / service provider acting on the Customer's instructions. Where we only build software that the client then hosts and operates itself, the client controls the data and we do not process it except while providing development or support. The Customer is the controller: they are responsible for having a lawful basis to collect and process their end clients' data, for obtaining any consent required (including WhatsApp opt-in, see Section 8), and for honoring their end clients' privacy rights. If you are an end user whose data was submitted to Botnira or a client system by a business, requests about your data (access, correction, deletion) should go to that business first — we will support them in fulfilling it, consistent with our Customer agreements and applicable law.
6. How we use information
Website and applicant data (Section 3) is used to: respond to enquiries, evaluate job applications, operate and secure our website, understand site usage (see Section 9), and comply with legal obligations.
Product data (Section 4) is used only to: provide the Botnira service (or support a custom system) for the Customer as configured (e.g. answering a call, booking an appointment, sending a message), maintain and improve service reliability and security, provide customer support when a Customer asks for help with a specific record, and comply with legal obligations. We do not sell personal data processed through Botnira or our client systems, and we do not use a Customer's client data to train models for other customers' use without a separate, explicit agreement. Botnira's Trust Center states that business data is not used to train models by default unless the organization explicitly opts in.
7. Third-party services & sub-processors
Operating our website and products involves a small number of third-party services that process data on our behalf, under their own security and privacy commitments:
- Hosting & infrastructure — our website and application infrastructure run on third-party cloud/hosting providers.
- Meta / WhatsApp Business Platform — used by Botnira to send and receive WhatsApp messages on a Customer's behalf. See Section 8.
- AI model providers — Botnira, and AI systems we build, use third-party large language model, telephony and speech providers (Botnira's published subprocessors include Twilio, Meta/WhatsApp and OpenAI) to power conversation handling and transcription. Data sent to these providers is used to generate the requested output and is handled under our agreements with those providers, not used by them to build products for other companies.
- Calendar, CRM, and e-signature integrations — where a Customer connects Botnira or a system we built to their own calendar, CRM, or e-signature tool, data flows to that tool per the Customer's own configuration and that provider's terms.
- Email delivery — used to send transactional messages such as form confirmations and notifications configured by the Customer.
- Analytics — Google Analytics on our marketing website only (see Section 9); we do not run third-party marketing analytics inside Botnira or client system data.
We maintain a list of current sub-processors for Botnira and hosted-system Customers on request (Botnira also publishes its list at compliance.botnira.com) — email kamal@thedigisparrow.com.
8. WhatsApp Business API & Meta Platforms
Botnira can send and receive messages through the Meta WhatsApp Business Platform on behalf of a Customer. This means:
- Message content, phone numbers, and delivery metadata pass through Meta's infrastructure as part of sending and receiving WhatsApp messages, and are also subject to WhatsApp's Business Messaging Policy and Meta's own privacy terms.
- Customers are responsible for obtaining proper opt-in consent from their own end clients before messaging them via WhatsApp through Botnira, and for honoring opt-out requests, consistent with Meta's policy and applicable law. We provide the technical capability; the Customer controls who is messaged and why.
- We do not use WhatsApp message content processed through Botnira for advertising, and we do not share it with unrelated third parties.
- Meta may retain limited data (e.g. for spam and abuse prevention) under its own policies, independent of our retention settings — see Meta's WhatsApp Privacy Policy for details on Meta's own handling of message data.
9. Cookies & tracking
Our marketing website (thedigisparrow.com) uses Google Analytics to understand aggregate traffic and improve the site, which sets cookies and collects standard analytics data (pages viewed, approximate location, device/browser type). The Botnira chat widget embedded on our site may also set a cookie to maintain a conversation session. We do not use cookies for cross-site advertising tracking. You can control cookies through your browser settings; blocking analytics cookies won't affect your ability to browse the site or use the contact/careers forms.
10. Data retention
Contact form messages are kept as long as needed to handle the enquiry and for a reasonable period afterward for our records. Career applications are kept on file for future opportunities unless you ask us to delete them sooner. Data processed through Botnira or a hosted client system is retained according to the Customer's own configuration and instructions — Customers can request deletion of specific records or full account data, and we will act on that request within the timeframe set out in our Customer agreement.
11. Data security
We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data involved, including encrypted transport (HTTPS/TLS) for data in transit, restricted access to production systems, and access controls scoped to what a given role needs. Application-storage folders (such as career application records and uploaded resumes) are blocked from public web access. No system is perfectly secure, and we can't guarantee absolute security — see Section 15 for how we handle a suspected breach.
12. International data transfers
We operate from Canada and India, and our sub-processors may process data in other countries, including the United States. Where personal data is transferred internationally, we rely on the mechanisms available under applicable law (such as standard contractual clauses, or the sub-processor's own recognized safeguards) to protect it. Customers operating in jurisdictions with data residency requirements should confirm with us before onboarding whether our current infrastructure meets those requirements.
13. Your privacy rights
Depending on where you're located, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing — for example under Canada's PIPEDA (and applicable provincial law), the EU/UK GDPR, India's Digital Personal Data Protection Act, or U.S. state laws such as the CCPA/CPRA. To exercise these rights over data we hold directly as controller (Sections 3), email kamal@thedigisparrow.com. If your data was submitted to Botnira or a client system by a business you're a client of, please contact that business directly first, as described in Section 5 — we'll support their response to you.
14. Children's privacy
Our website and products are intended for business use and are not directed at children. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to us, contact us and we will delete it.
15. Data breach notification
If we become aware of a security incident affecting personal data we control, we will assess and, where required by law, notify affected individuals and relevant regulators without undue delay. Where the incident affects data we process on a Customer's behalf (Section 4), we will notify the affected Customer promptly so they can meet their own notification obligations to their end clients and regulators.
16. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by an updated "last updated" date at the top of this page, and where appropriate, Botnira Customers and clients with hosted systems will be notified directly.
17. Contact us
Questions about this policy, or requests relating to your personal data, can be sent to kamal@thedigisparrow.com, or by mail to 151 Gateshead Crescent, Hamilton, ON, Canada.