BlackBird AI

Privacy Policy

Last updated: 27 September 2026

This policy explains what personal information BlackBird AI collects through theblackbirdmedia.com, through our emails and through our Instagram integration (the Publisher app), why we use it, who we share it with, and the choices you have. It applies to visitors and contacts in the United States, Canada, the United Kingdom, the European Union, the Middle East and everywhere else.

Our site links to LinkedIn, YouTube, Instagram, Facebook and WhatsApp. Those services have their own privacy policies, and this policy does not cover them.

At a glance

Contents

1. Who we are

BlackBird AI is an AI adoption agency. We help businesses and founders bring AI into how they work, by building and running AI systems across six areas of a business: lead generation, sales, customer support, internal operations, data and reporting, and content and marketing.

BlackBird AI is a trading name of BlackBird Media, a sole proprietorship owned by its founder, Hassan Ali, and registered in Lahore, Pakistan. BlackBird Media is the controller of the personal information described in this policy. This means it decides how and why that information is used. The exception is work we do for a client, described in section 2.

BlackBird AI is led by Hassan Ali, Founder and CEO, and Ahmad Shahzad, Co-Founder and Chief Marketing Officer. Hassan Ali is responsible for this policy and for how we handle personal information, including our compliance with Canadian and Quebec privacy law.

Postal address: 3rd Floor, 327, Block J, DHA EME Sector, Lahore 54000, Pakistan.

Privacy contact: hassan@theblackbirdmedia.com.

2. What we collect and how

Our enquiry forms

The enquiry form on our website asks for your first name, your email address and a message about your business. It can also ask about your company, such as its name and website, your role, company size, project budget and the areas you want to improve.

Our Canadian pages have a shorter callback form. It asks for your first name and phone number and, if you choose, your email address, business name and a note for our partner in Canada. It also has an optional marketing consent box, described in section 8.

With either form, we also receive how you found us:

These forms do not keep your IP address with your enquiry. Our spam protection keeps a hashed copy of it for up to 10 minutes, as described below.

You may not have to finish a form for us to receive your details. If you fill in part of a form, for example by clicking Next after the first step, or by typing your email address and then leaving or closing the page, we may receive what you have entered so far, even if you never press Submit. We treat these partial details like a full enquiry: we store them, email them to our team and send them to our CRM.

You do not have to give us any personal information, and no law or contract requires you to. Each form shows which fields are required. These are the minimum we need to reply, and without them we cannot answer your enquiry. Everything else is optional.

Enquiries from these forms go to HighLevel, our CRM. Because of how our connections to HighLevel are currently set up, the same enquiry can reach HighLevel more than once, and submissions our site rejects, including spam, incomplete and rate-limited ones, can still reach it.

The "Get your plan" widget

Some of our pages show a short widget that offers a plan for your business. It asks what you want help with, your name, your business, an email address or WhatsApp number, and an optional note.

With your answers we also receive the page you were on, the website that sent you there, how long you had been on the page, how far down you had scrolled, and your IP address. We store all of this and email it to our team, including your IP address. We send your contact details, your answers and how you reached us to HighLevel. Your contact details go to HighLevel as an email address or a phone number, depending on what you typed.

After you send it, the widget offers a link to continue on WhatsApp with a message already written for you. See "When you email, message or call us" for what happens when you open it.

Our ad concept forms

Two of our campaign pages offer a free ad concept or an ad rebuild. Depending on the form, they ask for your brand or company name, your website or Instagram handle, what you sell, your city, a link to the ad you are running, and your email address.

When you submit, we also store your IP address, your browser details and the address and title of the page the form is on. The details are emailed to our team, including to a Gmail inbox, and the email can include your IP address and browser details. Our page-view log, described below, also records your email address, company name and city with the submission.

Older forms

An older email box in the footer of our blog pages saves what you enter to our website database. We do not monitor it or send a newsletter from it, so please use our enquiry form if you want a reply.

An older enquiry address on our site also still accepts submissions. It saves what is sent, including the IP address and browser details, in a file on our server. It emails those details to our team and sends the enquiry to HighLevel. Submissions it flags as spam are also saved with the IP address and browser details.

We also still hold submissions made through earlier versions of our forms. Some of those recorded last name, annual revenue, browser details and IP address.

Blog comments

If you comment on a blog post, we collect your name, email address, website if you give one, and your comment. WordPress also stores your IP address and browser details to help detect spam.

If you tick the box to save your details, your browser keeps them in cookies for next time. Our blog posts show the author's profile picture from Gravatar, and profile pictures next to comments also load from Gravatar, a service run by Automattic in the United States. The page asks Gravatar for each picture using a scrambled (hashed) version of the author's or commenter's email address, and anyone reading a blog post connects to Gravatar's servers.

When you email, message or call us

If you email us, message us on WhatsApp or call us, we receive your email address or phone number, your name if you give it, and what you tell us. The WhatsApp number on this website is +971 54 528 8379. Our Canadian pages also list a Toronto number, +1 416 459 4541, for our partner in Canada.

If our enquiry form or our Canadian callback form fails to send, the site can offer a WhatsApp link with your name, email address, company and main business bottleneck already filled in. The widget's WhatsApp link works the same way. If you open one of these links, your browser passes the pre-filled text to WhatsApp, which is run by Meta. It reaches us only when you press send. Meta handles that data under its own privacy policy.

When you book a call

If you book a call with us, we receive your name, email address, the time you choose and anything you add to the booking. Our booking pages run on Google Calendar, and our calls run on Google Meet. Some bookings use the HighLevel booking calendar instead.

Automatically, when you visit

When we email you

Our sales and follow-up emails can contain a tiny invisible image and tracked links.

To stop open tracking, turn off automatic image loading in your email app. To stop all tracking, ask us to stop emailing you.

If we contacted you first

If you received an email from us without contacting us first, we got your details from a business data provider such as Apollo or Explee, from a business directory, or from public sources such as company websites. We hold your name, work email address, company, website, city and, where available, a business phone number.

If you reply, we keep your replies and the email thread. We also keep notes of any calls or meetings, where you are in our sales process, and any deal value we discuss.

We use this to offer our services to businesses where they are likely to be relevant, and to follow up. Our outreach records are kept on our team's work computers and synced every few hours to a private dashboard on our website. Our team uses the dashboard to reply to you. It also alerts our team, with the text of your reply, when you write back.

You can object at any time. Reply "unsubscribe" or email hassan@theblackbirdmedia.com and we will stop.

Our business contact databases

We also keep business contact databases, including a directory of US businesses and their staff. We use them to choose which businesses to contact. You may be in them even if we have never emailed you. They hold names, job titles, work email addresses, phone numbers, company names and addresses, industry, company size and revenue band.

When we act for a client

For some clients, we run sales outreach on their behalf. The client is the controller for that outreach, and we act on its instructions. Where we find the contacts for a client campaign ourselves, for example from our own business contact databases or public research, we are also a controller for that research, and this policy applies to it. You can contact either the client or us, and we will make sure your request is handled.

If you connect the Publisher app

If you authorise our Publisher app on Instagram, we receive the account data described in section 10.

3. Why we use it, and our legal bases

We use personal information to:

UK and EU data protection law requires a legal basis for each use. Ours are:

We rely on legitimate interests only where we believe your rights do not override them. You can object at any time, and you can always object to direct marketing.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

4. Who we share it with

We do not sell your personal information. We share it with the service providers below, who handle it on our behalf, and with our partner in Canada.

We may also disclose information where the law requires it, or to protect our rights.

5. International transfers

We are based in Pakistan. Our team works with your information from Pakistan, and from other countries when team members are working there. Our providers store and process it in the United States, the European Union and other countries where they operate. Our partner in Canada works from Canada.

These countries may not have the same data protection laws as yours. Neither the UK nor the EU has formally recognised Pakistan as giving equivalent protection (an adequacy decision). For our providers, we rely on the safeguards in their data protection terms, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or certification under the EU-US Data Privacy Framework and its UK Extension. You can ask for a copy of the safeguards that apply by emailing hassan@theblackbirdmedia.com with the subject "Privacy request".

If you are in Canada, your information may be stored and processed outside Canada, including in Pakistan, the United States and the European Union. Courts and authorities there may be able to access it under local law.

6. Cookies and similar technologies

We keep these to a minimum. We do not use advertising cookies. Our site does not load Google Analytics, a Meta pixel or Google Tag Manager. The only third-party analytics on our site comes from Jetpack, from Automattic, described below.

Browser storage

Requests to other services

The open-tracking image and tracked links in our emails are described in section 2. Many of our pages also load fonts from Google, the Jetpack script from stats.wp.com and pixel.wp.com, and, on blog posts, profile pictures from Gravatar. These requests send your IP address and browser details to those providers.

Do Not Track

Our site does not change how it works when your browser sends a Do Not Track signal, because there is no agreed standard for these signals. Automattic (through Jetpack) and Google (through Google Fonts) can collect information about your visit to our site. Under their own policies, they may also collect information about your activity on other websites over time.

Your choices

You can block or delete cookies and site storage in your browser settings, or use private browsing to clear them when you close the window. You can turn off image loading in your email app to stop open tracking.

7. How long we keep it

We keep personal information for as long as we need it for the purposes in section 3. We have not yet set fixed deletion periods for every record, and our systems do not yet delete most records automatically. So most records stay until we delete them. We delete your records when you ask, except for our do-not-contact list, records of marketing consent, and records the law requires us to keep.

8. Your rights

UK and EU

Under the UK GDPR and the EU GDPR, you have the right to:

We reply within one month. For complex requests we may extend this by up to two more months, and we will tell you why.

Canada

Under PIPEDA and similar provincial laws, you can ask us to:

Some legal or contractual limits may apply. We reply within 30 days, or tell you within that time if we need an extension the law allows, and why. Hassan Ali is responsible for our compliance.

Our Canadian pages collect your first name and phone number and, if you give them, your email address, business name and a note. We use them to:

The form also has an optional box that asks whether we may email or text you about call answering and booking services. Leaving it unticked does not stop our callback. If you tick it and also give us your email address, we keep a record of your consent: the time, your email address and phone number, the page, and the exact wording you agreed to. We also send your consent to HighLevel with your enquiry. We send marketing emails or texts to people who used these forms only when we hold a record of their consent. You can withdraw consent at any time by emailing hassan@theblackbirdmedia.com.

Canada's Anti-Spam Legislation (CASL) applies to commercial emails we send to people in Canada. CASL allows these emails with your express consent, or with implied consent in limited cases: for example, when you have published your business email address without saying you do not want messages, and the message relates to your role. Section 9 explains how to unsubscribe. We act on unsubscribe requests within 10 business days.

California

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA), gives you rights over your personal information.

In the last 12 months we collected these categories of personal information:

We collect these from you, from your browser and email app, from Meta if you connect our Publisher app, and from business data providers, business directories and public sources. We use them for the purposes in section 3, disclose them for business purposes to the service providers in section 4, and keep them as described in section 7.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you.

You have the right to:

You can make a request by email or by post, using the details in section 14. We confirm that we have received your request within 10 business days. You can use an authorised agent. We will ask the agent for your signed permission and may ask you to confirm your identity with us directly. We reply within 45 days, and may extend this by another 45 days where needed, with notice.

Everyone else

Wherever you live, including other US states, the Middle East and Pakistan, you can ask us to:

We reply within one month. If you live in a US state with its own privacy law, such as Virginia, Colorado or Texas, and we decline your request, you can appeal by replying to our decision. If we still decline, you can contact your state Attorney General.

How to make a request

Email hassan@theblackbirdmedia.com with the subject "Privacy request", or write to us at the postal address in section 14. Tell us which email address or phone number you used, so we can find your records. We may ask you to confirm your identity, usually by replying from the same email address. Requests are free unless they are clearly unfounded or excessive.

To ask us to delete your data, you can also use the subject "Delete My Data". Our Data Deletion page explains the steps and timelines.

9. Marketing emails and how to unsubscribe

We send business-to-business emails about our services. We send them to people who asked for them, and to business contacts where the law allows it, as explained in section 3 and section 8.

The cold emails we send from our own mailboxes include a line telling you how to opt out. Whatever an email says, you can stop our marketing emails in any of these ways:

We act on your request promptly, and within 10 business days at most. We then keep your email address on our do-not-contact list so that we do not email you again. We may still reply to messages you send us.

10. Instagram integration (the Publisher app)

We operate an app registered with Meta called Publisher. It connects to Instagram professional accounts so that we can publish content, manage comments and messages, and report on performance for the accounts whose owners authorise it. This section applies only if you authorise the Publisher app.

What we collect when you authorise the app

What the app can access

We access only the data you grant through Meta's authorisation (OAuth) screen, using these permissions: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_messages and instagram_business_manage_insights.

We use this data to publish content to your account when you ask us to, to read and reply to comments and messages on your behalf, and to prepare performance reports for you. We never ask for your Instagram password. The app works through access tokens that you can revoke at any time.

How long we keep it

If you remove the app or ask us to delete your data, we act on the timelines set out on our Data Deletion page.

Meta's terms

We comply with:

For complaints about our Instagram integration specifically, you can also contact Meta through its support channels.

Removing the app and deleting your data

You can remove the Publisher app at any time from your Instagram settings (Website permissions, then Apps and websites). After you remove it, the app can no longer read or post anything for your account. To have us delete the data we already hold, follow the steps on our Data Deletion page, or email hassan@theblackbirdmedia.com with the subject "Delete My Data".

11. Children

Our website and services are for businesses and the adults who work in them. They are not aimed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email hassan@theblackbirdmedia.com and we will delete it.

12. Security

We protect personal information with measures that fit the size of our business:

No website, inbox or system is completely secure, and we cannot guarantee the security of information sent to us. If a breach puts your information at risk, we will tell you and the relevant regulators where the law requires us to.

13. Changes to this policy

We will update this policy when our practices or the law change, and post the new version here with a new date. If a change significantly affects how we use your information, we will make that clear on this page and, where the law requires it, tell you directly.

14. Contact us

For any question about this policy or your personal information:

15. How to complain

We would like the chance to put things right first, so please contact us with the subject "Privacy complaint". We will acknowledge your complaint within 30 days, look into it and tell you the outcome. You can also complain to a regulator: