This Privacy Policy explains how Legal Sparrow (Private) Limited (“Legal Sparrow”, “we”, “us”) collects, uses, shares, protects and retains personal data when you visit legalsparrow.cloud (the “Site”) and use its free online tools (the “Tools”), and what rights you have. It is written to meet the transparency requirements of Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”) (each as amended, including by the Data (Use and Access) Act 2025), the EU General Data Protection Regulation where it applies, and the laws of Pakistan, including the Prevention of Electronic Crimes Act 2016 and Article 14 of the Constitution of Pakistan.
Summary. You do not need an account to use the Tools. We collect only what we need to run the Site, keep it secure and comply with law. Some Tools work entirely in your browser; where a Tool sends your files to us, we use them only to run that Tool and delete them automatically. We do not sell personal data and we do not use your files or inputs to train AI models. We show ads (Google AdSense) and use analytics, and we ask for your consent for the cookies involved where the law requires it. You can ask us to access, correct or delete your data at privacy@legalsparrow.com.
1. Who We Are and How to Contact Us
1.1 Controller. Legal Sparrow (Private) Limited, SECP Registration No. 0332402 (UK Registration No. 17363806), registered office 356 Morrison Drive, AB10 7EN, Aberdeen, Scotland, United Kingdom, is the controller of the personal data described in this Policy, except as stated in section 4.
1.2 Separate policies. This Policy covers legalsparrow.cloud only. The Legal Sparrow AI platform at legalsparrow.com has its own privacy policy.
1.3 Privacy contact. For any privacy question or to exercise your rights, contact our Data Protection Lead at privacy@legalsparrow.com, or write to the address above marked “Data Protection”.
1.4 UK representative. Because we are established outside the UK and offer services to people in the UK, we have appointed a representative under Article 27 UK GDPR: Qamar Zaman, 356 Morrison Drive, AB10 7EN, Aberdeen, Scotland, United Kingdom, qamar@legalsparrow.com.
2. Scope and Children
2.1 This Policy applies to visitors and users of the Site, people who contact us, and people whose personal data appears in anything a user enters into or uploads to a Tool.
2.2 The Site is intended for adults aged 18 and over. People aged 13 to 17 may use the general calculators and educational content only with a parent or guardian’s supervision. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.
3. The Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Tool inputs and files (“Your Content”) | Numbers, dates, names, text, documents, images, PDFs, scanned pages you enter or upload, and the Output a Tool returns. This may include personal data about you or other people. | You |
| Preferences and saved items | “Recently Used” and “Saved Tools” lists, theme and layout settings, cookie choices. Kept on your device (browser storage) unless a Tool says otherwise. | You; your device |
| Technical and security data | IP address, browser and device type, operating system, language, referring page, pages and Tools visited, timestamps, request and error logs, approximate location derived from IP address, bot-detection signals. | Your device; our servers and security providers |
| Usage and analytics data | Pages viewed, Tools used, time on page, clicks, referral source, analytics identifiers. | Cookies and similar technologies; our analytics provider (with consent) |
| Advertising data | Advertising identifiers, ad interactions and inferred interests used to serve and measure ads. | Google and its ad partners, through cookies (with consent where required) |
| Communications data | Name, email address, message, attachments, error reports, feedback and complaints you send through our contact page or by email. | You |
3.1 We do not ask you to provide special-category data about yourself (such as health, religious belief or sexual orientation) and ask you not to enter it unless a Tool needs it for what you want to do.
3.2 We do not take payments on this Site and do not collect payment card details. All Tools are free.
3.3 You must give us the inputs a Tool needs for it to work. Consent to non-essential cookies is optional, and the Tools work without it.
4. Personal Data in Your Content (Files and Inputs)
4.1 People who use the Tools, including lawyers and law firms, may enter or upload material such as contracts, pleadings, identity cards, bank statements, CVs, letters and spreadsheets. This material may contain personal data about other people, and sometimes special-category data or criminal-offence data.
4.2 Our role. We process Your Content only to run the Tool you have asked to use. Where you are a Professional User and Your Content contains personal data about other people, you are the controller of that data and we act as your service provider (processor) to the extent needed to run the Tool. We do not offer a data processing agreement for the free Tools, so if your obligations require one, do not enter that data. Where you are a Consumer using a Tool for your own matter, we process Your Content as controller for that limited purpose. If your personal data appears in material uploaded by someone else, please contact that person or organisation first. We will assist where we can and will pass on any request we receive.
4.3 How files are processed. Some Tools run entirely in your browser, so Your Content never reaches us. Other Tools send Your Content to our servers or to service providers for processing, and the Tool page says so where this applies. Where Your Content is sent to us, it is encrypted in transit, used only to run the Tool, deleted automatically in sufficient hours after your request is completed or when your session ends, not used to train AI models, not used for advertising and not sold. Our staff do not read it as a matter of routine. Access is limited to security and abuse investigations, support you ask for, or legal compliance, and any such access is logged.
4.4 Protect yourself and others. Enter only what a Tool needs, remove or redact unnecessary personal data first, prefer Tools that work in your browser for sensitive material, and do not upload privileged or highly sensitive documents unless you have assessed the risk. Keep your own copies, because we do not store your files.
5. How We Use Personal Data and Our Lawful Bases
| Purpose | Lawful basis (UK GDPR Art. 6) and notes |
|---|---|
| Providing the Tools you ask for, processing Your Content and returning Output | Contract (Art. 6(1)(b)), because use of the Site is subject to our Terms, or otherwise legitimate interests (Art. 6(1)(f)) in providing a free service you have requested. Where a Professional User is the controller, that user’s lawful basis applies. For special-category or criminal-offence data in files a Consumer uploads for their own matter, we rely on your explicit consent (Art. 9(2)(a)), which you give by choosing to upload it, or on Art. 9(2)(f) (establishment, exercise or defence of legal claims). |
| Operating and securing the Site, preventing fraud, abuse and bots, keeping logs, enforcing our Terms | Legitimate interests in protecting the Site, our users and others; legal obligation to keep personal data secure (Art. 32). |
| Remembering preferences, “Recently Used” and “Saved Tools” | Strictly necessary for a feature you have requested (exempt from consent under regulation 6(4) PECR); otherwise your consent. |
| Analytics: understanding how the Site and Tools are used, fixing errors and improving or planning new Tools | Consent for analytics cookies; legitimate interests for server logs and error data. This never involves reading the content of Your Content. |
| Showing and measuring advertising | Consent for advertising cookies and personalised ads. Without consent, only non-personalised ads (or no ads) are shown where the law permits. |
| Responding to messages, error reports, complaints and requests | Legitimate interests in running the Site; legal obligation where a law requires us to respond. |
| Complying with the law, responding to lawful requests, establishing or defending legal claims | Legal obligation; legitimate interests; Art. 9(2)(f) where special-category data is involved. |
| Corporate transactions (merger, acquisition, financing, restructuring) | Legitimate interests, subject to confidentiality protections. |
5.1 Where we rely on legitimate interests, we have balanced them against your rights and can give you details on request. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before you withdrew it.
6. Cookies, Local Storage and Similar Technologies
6.1 We use cookies, local storage and similar technologies (together, “cookies”). They fall into four groups: (a) strictly necessary, for security, bot protection, load balancing and remembering your cookie choices; (b) functional, which remember settings and features you request, such as theme, “Recently Used” and “Saved Tools”; (c) analytics, which help us understand use of the Site (for example Google Analytics identifiers such as _ga); and (d) advertising, set by Google AdSense and its partners (for example __gads, __gpi and IDE).
6.2 Your choices. In the UK, the EEA and Switzerland, a banner asks you to accept all, reject all or customise your choices by category. “Reject all” is as prominent as “Accept all”, and no non-essential cookie is set before you choose. You can change your choice at any time using “Cookie Settings” on the Site. We store your choice for up to twelve (12) months. We treat a Global Privacy Control signal as a rejection of advertising cookies.
6.3 Browser controls. You can also block or delete cookies in your browser settings. Blocking functional cookies means preferences and “Saved Tools” may not persist, and blocking strictly necessary cookies may stop parts of the Site from working.
7. Advertising
7.1 The Site displays advertisements served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this Site or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this Site and other sites on the internet.
7.2 Personalised and non-personalised ads. With your consent, Google and its partners may show personalised ads. Without it, only non-personalised ads (which use limited data for frequency capping, aggregated reporting and fraud prevention, where permitted) or no ads are shown. Google acts as an independent controller of the data it collects for personalised advertising.
7.3 Opting out. You can opt out of personalised advertising at Google Ads Settings (adssettings.google.com), and of many third-party vendors’ use of cookies for personalised advertising at aboutads.info/choices, optout.networkadvertising.org or, for EEA and UK users, youronlinechoices.eu. You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.
7.4 We do not give advertisers or ad networks Your Content, and ads are never based on the contents of your files.
8. Who We Share Personal Data With
8.1 We do not sell personal data.
8.2 We share personal data only with:
(a) Service providers (processors) acting on our instructions under written contracts. Current categories and providers (to be confirmed before publication):
| Service | Provider | Location of processing |
|---|---|---|
| Website hosting and content delivery | Third Party Providers | [●] |
| Security, bot protection and performance | Third Party Providers | [●] |
| Server-side file processing (only for Tools that process files on a server) | Third Party Providers | [●] |
| Analytics | Google LLC / Google Ireland Ltd (Google Analytics), with consent | United States / EU |
| Advertising | Google (AdSense): independent controller for personalised ads, with consent | United States / EU |
| Contact form and email | contact@legalsparrow.com | [●] |
(b) Our own services. Legal Sparrow (Private) Limited also operates legalsparrow.com. We keep data from this Site separate from the legalsparrow.com platform and do not link the two without your consent.
(c) Professional advisers (lawyers, auditors, accountants, insurers) under duties of confidentiality.
(d) Authorities, where we are legally required to, for example in response to a valid court order or lawful request from a competent authority, including under the Prevention of Electronic Crimes Act 2016 or the Investigatory Powers Act 2016. We review each request for legality and proportionality, disclose only the minimum necessary and, unless legally prohibited, tell the person affected.
(e) Successors: a prospective or actual buyer, investor or successor in a merger, acquisition, financing or reorganisation, subject to confidentiality and to this Policy continuing to apply.
(f) Others you direct us to, where you ask us to share information.
9. International Transfers
9.1 We are based in Pakistan and our providers operate in other countries, including the United States, the European Economic Area and the United Kingdom. Personal data of UK and EEA users is therefore transferred to Pakistan and to the countries in which our providers operate.
9.2 Where we transfer personal data protected by UK or EU law to a country not covered by UK adequacy regulations or an EU adequacy decision (including Pakistan), we use appropriate safeguards: the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, and/or the EU Standard Contractual Clauses, together with a transfer risk assessment and supplementary measures such as encryption. For transfers to US organisations certified under the EU–US Data Privacy Framework and its UK Extension, we may rely on that certification. You may ask for a copy of the relevant safeguards (commercially sensitive terms may be redacted).
10. Retention
10.1 We keep personal data only as long as necessary for the purposes in this Policy. Our standard periods are:
| Data | Retention |
|---|---|
| Files and inputs sent to our servers by a Tool | Deleted automatically in sufficient hours after your request is completed or your session ends. |
| Inputs and files processed in your browser | Not received by us. They stay on your device until you close the page or clear your browser data. |
| “Recently Used”, “Saved Tools” and preferences | Kept on your device until you clear your browser data. |
| Server, security and error logs (including IP address) | [90] days, or longer where needed for an ongoing investigation or legal claim. |
| Analytics data | Up to [14] months; analytics cookies last up to 2 years. |
| Advertising data | Governed by Google’s policies; advertising cookies last up to 13 months. |
| Messages, error reports and complaints | Three (3) years after the matter is closed. |
| Cookie choice and consent record | Your choice is stored for up to 12 months; our record of consent is kept for 3 years. |
10.2 We may keep data for longer where a legal hold applies, where it is needed to establish, exercise or defend legal claims, or where the law requires it. Aggregated or properly de-identified data that no longer identifies anyone may be kept indefinitely.
11. Security
11.1 We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2 or higher), access limited to those who need it and logged, automatic deletion of files sent to our servers, secure hosting, vulnerability management and staff confidentiality undertakings.
11.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play a part: keep your device and browser up to date, and do not upload highly sensitive material unless you have assessed the risk.
11.3 If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (in the UK, the Information Commissioner’s Office, within 72 hours where required) and, where the risk is high, notify you without undue delay.
12. Your Rights
12.1 Depending on where you live, you have some or all of the following rights. Under UK and EU law you can:
(a) access your personal data and receive a copy;
(b) have inaccurate or incomplete data corrected;
(c) have your data erased (the “right to be forgotten”);
(d) restrict processing in certain circumstances;
(e) data portability: receive data you provided in a structured, machine-readable format and have it sent to another controller where technically feasible;
(f) object to processing based on legitimate interests, and object to direct marketing at any time;
(g) withdraw consent at any time, including for cookies through “Cookie Settings” on the Site;
(h) not be subject to decisions based solely on automated processing that have legal or similarly significant effects (see section 13); and
(i) complain to a supervisory authority (see clause 12.4).
12.2 How to exercise your rights. Email privacy@legalsparrow.com. We may need to verify your identity before acting. Because the Tools do not require an account, we may be unable to find data about you unless you give us details such as the approximate date and time of your visit and your IP address, and we are not required to collect more data to identify you. We will respond within one month, which may be extended by up to two further months for complex or numerous requests (we will tell you if so). We do not charge a fee unless a request is manifestly unfounded or excessive. Some rights are subject to exemptions, for example where the data is subject to legal professional privilege or disclosure would affect the rights of others.
12.3 Users in Pakistan and elsewhere. We extend the rights described above to all users regardless of location. Pakistan does not yet have a comprehensive personal data protection law in force, and we will comply with it when it is enacted and in force.
12.4 Complaints. We would appreciate the chance to resolve your concern first. You may complain to the UK Information Commissioner’s Office (ico.org.uk; 0303 123 1113), to the supervisory authority in your EU Member State of residence or work, or, in Pakistan, to the competent authority under applicable law (including, for cyber-crime matters, the National Cyber Crime Investigation Agency).
13. Automated Decisions and AI
13.1 We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing within the meaning of Article 22 UK GDPR. Tool Output is informational and you decide what to do with it.
13.2 We do not use Your Content to train or improve artificial-intelligence or machine-learning models. If a Tool uses a third-party AI or OCR service to process Your Content, the Tool page will say so and we will require that provider not to use Your Content to train its models.
14. Third-Party Websites and Links
14.1 The Site contains links to third-party websites, including legalsparrow.com, legislation and court websites and advertisers. Their privacy practices are governed by their own policies, and we are not responsible for them.
15. Changes to This Policy
15.1 We will update this Policy when our practices or the law change. For material changes, we will display a prominent notice on the Site for at least fourteen (14) days before they take effect, and the “Last Updated” date above will change. Previous versions are available on request.
16. Contact
Legal Sparrow (Private) Limited, 356 Morrison Drive, AB10 7EN, Aberdeen, Scotland, United Kingdom · privacy@legalsparrow.com · contact@legalsparrow.com.