Privacy Policy

Sparrow is a business messaging platform operated by The Sketch Agency for Designs (“Sparrow”, “we”, “us”). It provides a shared inbox, campaigns, automation and AI-assisted workflows for businesses that message their customers on WhatsApp.

This policy covers the Sparrow web application and the services reachable from it. It does not cover Meta’s own products, which are governed by Meta’s policies.

Sparrow handles information in two distinct capacities, and it matters which one applies to any given piece of data.

This section describes how we operate. It is not legal advice, and it does not replace any separate agreement between Sparrow and a business customer.

• Service delivery — to run the inbox, send and receive messages, execute campaigns and automations, and produce the AI assistance you have enabled.
• Security — to authenticate users, isolate workspaces from one another, and detect and investigate compromise.
• Support — to answer your questions and diagnose problems you report.
• Fraud and abuse prevention — to enforce our Terms, prevent spam and messaging abuse, and protect the platform and its users.
• Legal obligations — to meet obligations that apply to us, and to establish, exercise or defend legal claims.

We do not sell personal information, and we do not use the contents of your customers’ conversations to advertise to them or to anyone else.

Sparrow connects to your own WhatsApp Business Account through Meta’s WhatsApp Business Platform. You authorise that connection yourself, inside Meta’s own signup flow — Sparrow never asks you for a Meta password, an access token or an account identifier.

Once connected, messages to and from your business number travel through Meta’s systems as well as ours. Meta’s handling of that data is governed by Meta’s terms and policies, not by this one. We request only the permissions the service needs in order to manage your WhatsApp Business Account and to send and receive messages for you.

You can disconnect at any time from Settings. See our Data Deletion page for what that removes and what it does not.

Sparrow runs on infrastructure and services operated by others. Those providers process data on our behalf, under contract, and only to deliver the service:

• Meta Platforms — the WhatsApp Business Platform that carries your messages.
• Supabase — database, authentication and encrypted secret storage.
• Vercel — application hosting and delivery.
• Resend — transactional email, such as sign-in confirmation and password reset.
• Payment providers — to process subscription payments, where enabled for your account.
• AI service providers, including OpenAI where AI-assisted features are enabled — to generate the summaries, suggestions or replies you requested.

This is our current set of providers, not a permanent list: as Sparrow develops we may add or replace one. We add providers only where they are needed, we require appropriate confidentiality and security commitments from them, and we will update this page when the list changes.

• Workspaces are isolated in the database itself, by row-level security, so one business cannot read another's data even if application code is wrong.
• Your WhatsApp access credential is held in encrypted secret storage, never in an ordinary database column, and is reachable only by server-side processes — never by a browser, and never by another workspace.
• Credentials are never written to logs, never returned by our interfaces, and never shown in the product.
• Messages from Meta are cryptographically verified before we act on them.
• Access to production data is restricted to the people who need it to operate the service.

No system is perfectly secure. We describe the controls we actually operate and do not claim certifications or compliance standards that Sparrow has not obtained.

Workspace data — contacts, conversations, messages, campaigns and automations — is retained for as long as the workspace exists, because it is the record of your business’s relationship with its customers. Account and billing records are retained while your account is active.

After deletion or account closure, we may retain limited records where we need them for legal, tax, security or abuse-prevention reasons, and only for as long as that reason applies.

You can delete data from within Sparrow, and you can ask us to delete your account or your workspace. Disconnecting WhatsApp removes Sparrow’s stored access credential immediately and stops all sending, while leaving your existing conversation history intact — deleting a channel is not a request to erase your history.

The full process, including how we verify who is asking, is on the Data Deletion page.

If you use Sparrow to message your customers, you are responsible for the lawful basis on which you do so. In particular:

• Obtain and record the consent that applies to you before messaging anyone, and honour opt-outs promptly.
• Tell the people you message who you are and how you handle their information.
• Only upload contact data you are entitled to use.
• Give your team the least access they need, and remove members who leave.
• Respond to requests from the people whose data you hold — you decide what happens to it, not us.

Depending on where you live, you may have rights to access, correct, export or delete personal information, to object to or restrict certain processing, or to complain to a data protection authority.

For information Sparrow holds as controller — your account and billing relationship — contact us and we will help. For information inside a business’s workspace, that business is the right first point of contact; where we are asked directly, we will pass the request to them and support them in answering it.

Sparrow and its providers operate infrastructure in more than one country, so your information may be processed outside the country you are in. Where that happens, we rely on our providers’ contractual protections for those transfers.

Sparrow is a product for businesses and is not directed at children. We do not knowingly collect information from anyone under 16 in the course of providing accounts. If you believe a child’s information has reached us through a Sparrow account, tell us and we will act on it.

We will update this policy as Sparrow changes. The date at the top always reflects the current version, and we will give notice of material changes through the product or by email before they take effect.

Questions about this policy, or about information Sparrow holds: