1. Overview
The DigiSparrow is an AI agent and custom software development studio, based in Hamilton, Ontario, Canada, with a second office in Ludhiana, Punjab, India. We build and operate two software products used by other businesses: Botnira, an AI voice and chat receptionist, and ImmiPRO, a case-management CRM built for immigration consultants and agencies. This policy is written to cover three different relationships at once, because they involve different data and different responsibilities: you browsing our website, you applying for a job with us, and you (or your business) using or being processed through Botnira or ImmiPRO.
2. Who this policy covers
This policy applies to:
- Website visitors — anyone browsing thedigisparrow.com, including through the contact form, our blog, or the Botnira chat widget embedded on our pages.
- Job applicants — anyone submitting a general application through our Careers page.
- Business customers ("Customer," "you," if you've signed up for Botnira or ImmiPRO) — the companies and professionals who use our software to manage their own clients' data.
- End users / data subjects — the callers, chat visitors, or immigration clients whose personal data a business customer submits to, or collects through, Botnira or ImmiPRO. If you are an end user of a Botnira- or ImmiPRO-powered business, you should also refer to that business's own privacy policy — they control how your data is used, and we process it on their instructions (see Section 5).
3. Information we collect directly
When you interact with our website or apply for a role, we collect what you give us directly:
- Contact form: name, email address, what you're looking to build, and your message.
- Careers form: name, email, phone number, home address, the position you're interested in, education history, work experience, LinkedIn/portfolio URL, an optional resume/CV file (PDF, DOC, or DOCX), and anything else you choose to tell us in the notes field.
- Automatically, via cookies and analytics: see Section 9.
We use this information to respond to your enquiry, evaluate your application, and keep a record in case a relevant opening comes up later. See Section 10 for how long we keep it.
4. Information processed through Botnira & ImmiPRO
Botnira and ImmiPRO are built for businesses to store and process their own clients' personal data — not ours. Depending on which product a business uses, that can include:
- Botnira (AI voice & chat agent): caller and chat-visitor phone numbers, names, appointment and booking details, call recordings and transcripts, chat message content, and any information a caller or chat visitor volunteers during a conversation (e.g. an address for a service call, or symptoms described to a healthcare front desk).
- ImmiPRO (immigration case management): the categories of data typical to an immigration file — full legal name, date of birth, contact details, passport and travel document numbers, immigration and visa status, education and employment history, family/dependent information, uploaded supporting documents, agreement and e-signature records, and case notes. Some of this is sensitive personal data under most privacy laws, and immigration files often also touch on national origin, which several frameworks treat as a special category requiring extra care.
We do not decide what data a Customer collects, why they collect it, or how long they keep it — those decisions belong to the Customer, per Section 5. We provide the infrastructure that stores and processes it on their instructions.
5. Our role: controller vs. processor
For data described in Section 3 (our own website visitors and job applicants), we act as the data controller — we decide why and how that data is used, and this policy governs it directly.
For data described in Section 4 (data our Customers submit to, or collect through, Botnira or ImmiPRO), we act as a data processor / service provider acting on the Customer's instructions. The Customer is the controller: they are responsible for having a lawful basis to collect and process their end clients' data, for obtaining any consent required (including WhatsApp opt-in, see Section 8), and for honoring their end clients' privacy rights. If you are an end user whose data was submitted to Botnira or ImmiPRO by a business, requests about your data (access, correction, deletion) should go to that business first — we will support them in fulfilling it, consistent with our Customer agreements and applicable law.
6. How we use information
Website and applicant data (Section 3) is used to: respond to enquiries, evaluate job applications, operate and secure our website, understand site usage (see Section 9), and comply with legal obligations.
Product data (Section 4) is used only to: provide the Botnira/ImmiPRO service to the Customer as configured (e.g. answering a call, drafting a document, filling an IRCC form field), maintain and improve service reliability and security, provide customer support when a Customer asks for help with a specific record, and comply with legal obligations. We do not sell personal data processed through Botnira or ImmiPRO, and we do not use a Customer's client data to train models for other customers' use without a separate, explicit agreement.
7. Third-party services & sub-processors
Operating our website and products involves a small number of third-party services that process data on our behalf, under their own security and privacy commitments:
- Hosting & infrastructure — our website and application infrastructure run on third-party cloud/hosting providers.
- Meta / WhatsApp Business Platform — used by Botnira to send and receive WhatsApp messages on a Customer's behalf. See Section 8.
- AI model providers — Botnira and ImmiPRO use third-party large language model and speech providers to power conversation handling, transcription, and document drafting. Data sent to these providers is used to generate the requested output and is handled under our agreements with those providers, not used by them to build products for other companies.
- Calendar, CRM, and e-signature integrations — where a Customer connects Botnira or ImmiPRO to their own calendar, CRM, or e-signature tool, data flows to that tool per the Customer's own configuration and that provider's terms.
- Email delivery — used to send transactional messages such as form confirmations and, for ImmiPRO, case-related notifications configured by the Customer.
- Analytics — Google Analytics on our marketing website only (see Section 9); we do not run third-party marketing analytics inside Botnira or ImmiPRO customer data.
We maintain a list of current sub-processors for Botnira and ImmiPRO Customers on request — email kamal@thedigisparrow.com.
8. WhatsApp Business API & Meta Platforms
Botnira can send and receive messages through the Meta WhatsApp Business Platform on behalf of a Customer. This means:
- Message content, phone numbers, and delivery metadata pass through Meta's infrastructure as part of sending and receiving WhatsApp messages, and are also subject to WhatsApp's Business Messaging Policy and Meta's own privacy terms.
- Customers are responsible for obtaining proper opt-in consent from their own end clients before messaging them via WhatsApp through Botnira, and for honoring opt-out requests, consistent with Meta's policy and applicable law. We provide the technical capability; the Customer controls who is messaged and why.
- We do not use WhatsApp message content processed through Botnira for advertising, and we do not share it with unrelated third parties.
- Meta may retain limited data (e.g. for spam and abuse prevention) under its own policies, independent of our retention settings — see Meta's WhatsApp Privacy Policy for details on Meta's own handling of message data.
9. Cookies & tracking
Our marketing website (thedigisparrow.com) uses Google Analytics to understand aggregate traffic and improve the site, which sets cookies and collects standard analytics data (pages viewed, approximate location, device/browser type). The Botnira chat widget embedded on our site may also set a cookie to maintain a conversation session. We do not use cookies for cross-site advertising tracking. You can control cookies through your browser settings; blocking analytics cookies won't affect your ability to browse the site or use the contact/careers forms.
10. Data retention
Contact form messages are kept as long as needed to handle the enquiry and for a reasonable period afterward for our records. Career applications are kept on file for future opportunities unless you ask us to delete them sooner. Data processed through Botnira or ImmiPRO is retained according to the Customer's own configuration and instructions — Customers can request deletion of specific records or full account data, and we will act on that request within the timeframe set out in our Customer agreement.
11. Data security
We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data involved, including encrypted transport (HTTPS/TLS) for data in transit, restricted access to production systems, and access controls scoped to what a given role needs. Application-storage folders (such as career application records and uploaded resumes) are blocked from public web access. No system is perfectly secure, and we can't guarantee absolute security — see Section 15 for how we handle a suspected breach.
12. International data transfers
We operate from Canada and India, and our sub-processors may process data in other countries, including the United States. Where personal data is transferred internationally, we rely on the mechanisms available under applicable law (such as standard contractual clauses, or the sub-processor's own recognized safeguards) to protect it. Customers operating in jurisdictions with data residency requirements should confirm with us before onboarding whether our current infrastructure meets those requirements.
13. Your privacy rights
Depending on where you're located, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing — for example under Canada's PIPEDA (and applicable provincial law), the EU/UK GDPR, India's Digital Personal Data Protection Act, or U.S. state laws such as the CCPA/CPRA. To exercise these rights over data we hold directly as controller (Sections 3), email kamal@thedigisparrow.com. If your data was submitted to Botnira or ImmiPRO by a business you're a client of, please contact that business directly first, as described in Section 5 — we'll support their response to you.
14. Children's privacy
Our website and products are intended for business use and are not directed at children. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to us, contact us and we will delete it.
15. Data breach notification
If we become aware of a security incident affecting personal data we control, we will assess and, where required by law, notify affected individuals and relevant regulators without undue delay. Where the incident affects data we process on a Customer's behalf (Section 4), we will notify the affected Customer promptly so they can meet their own notification obligations to their end clients and regulators.
16. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by an updated "last updated" date at the top of this page, and where appropriate, Botnira/ImmiPRO Customers will be notified directly.
17. Contact us
Questions about this policy, or requests relating to your personal data, can be sent to kamal@thedigisparrow.com, or by mail to 151 Gateshead Crescent, Hamilton, ON, Canada.