Privacy Policy

1. Scope and responsibilities

This policy applies when you visit our website, create an account, use the service, contact support, or communicate through a Sparrow-powered widget. For account and platform operations, Sparrow determines how necessary service data is processed. When an enterprise uses the widget to serve its own customers, that enterprise determines the business purpose and Sparrow processes data according to its instructions.

2. Information we collect

We collect only information needed to provide, secure, and improve the service.

• Account and identity data, such as company name, user name, email, phone number, role, authentication records, and Telegram binding information.
• Service content, such as conversations, attachments, tickets, customer profiles, tags, knowledge content, and support requests.
• Technical and security data, such as IP address, approximate region, device and browser information, login events, audit logs, cookies, and local storage identifiers.
• Billing and channel data, such as plan, seat count, order status, payment reference, email delivery configuration, and connected channel identifiers.

3. How we use information

We use information to create and manage accounts, deliver conversations and files, route service requests, provide security controls, process subscriptions, send requested notifications, support users, measure reliability, and improve service quality. We do not sell personal information.

4. AI-assisted features

If an enterprise enables AI features, relevant conversation or knowledge content may be sent to the configured AI provider to generate suggestions. AI output can be incomplete or inaccurate and must be reviewed before use. Do not submit passwords, private keys, payment secrets, or other unnecessary sensitive information.

5. Sharing and service providers

We may share necessary data with authorized users in your enterprise and with providers that support hosting, content delivery, object storage, email, Telegram, payment status, security scanning, and technical support. Providers may process data only for the contracted service and subject to applicable safeguards. We may also disclose information when required by law or to protect users and the service.

6. Cross-border processing

Connected providers and enterprise users may operate in different countries. Where data is processed across borders, we apply contractual, access, and security controls required for the service. Each enterprise remains responsible for giving its visitors any notice and obtaining any consent required by local law.

7. Retention and deletion

We retain information according to tenant settings, operational security needs, contractual obligations, and applicable law. When information is no longer required, it is deleted or anonymized. Backup copies are removed through the normal backup rotation unless a legal hold or security investigation requires longer retention.

8. Your choices and rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, withdrawal of consent, or a portable copy of relevant personal information. Visitors who contacted an enterprise through its widget should first submit the request to that enterprise. Account users can contact us using the address below.

9. Security

We use transport encryption, password hashing, encrypted credential storage, role-based access, session controls, audit logging, rate limits, attachment scanning, backups, and infrastructure monitoring. No internet service can guarantee absolute security, so users must protect account credentials and report suspected misuse promptly.

10. Children, updates, and contact

The service is intended for business use and is not directed to children. We may update this policy when the service or legal requirements change and will publish the new effective date on this page. Privacy requests can be sent to support@sparrowvip.com.