Privacy Policy

Last updated: March 19, 2026 | Effective date: March 19, 2026

This Privacy Policy describes how WasappBulk ("we", "our", or "us") collects, uses, stores, and shares information when you use the WhatsApp Bulk Sender Chrome extension and related services. By installing or using the extension, you agree to this policy.

1. Data We Collect

We collect only what is necessary to provide our service:

Data Type	What We Collect	Purpose
Account data	Email address, hashed password, company name, phone number (optional)	Account creation, login, and support
Usage statistics	Number of messages sent per day, dates of activity	Enforcing daily plan limits
Subscription data	Current plan tier (Free / Pro / Enterprise)	Determining feature access
Authentication token	Session JWT stored locally on your device	Keeping you logged in
Media files (optional)	Images, videos, or documents you voluntarily upload via the extension (Pro/Enterprise plans only)	Attaching media to bulk messages; stored in Supabase Storage encrypted at rest
Message send logs	Timestamp, recipient phone number, and delivery status for each message sent	Displaying your send history and calculating daily usage limits

We do NOT collect: WhatsApp contact lists, browsing history, or any personally identifiable information about your recipients beyond what you explicitly provide. Message text you compose is processed locally in your browser and is not stored on our servers. Recipient phone numbers appear only in send logs (see above) for the purpose of displaying your history.

2. How We Use Your Data

To authenticate your account and verify your subscription plan
To track daily message usage and enforce plan limits
To respond to support requests you submit
To send transactional emails (account creation, password reset) — no marketing emails without your consent
We do NOT use your data for advertising or sell it to third parties

3. Data Handling

Message text you compose is processed locally in your browser only — it is never sent to our servers
Messages are sent directly from your browser to WhatsApp Web — we act only as the interface
Recipient phone numbers are transmitted to our server only to record a send-log entry (timestamp + number + status) for your history and usage tracking
Media files you choose to upload (Pro/Enterprise) are transmitted over HTTPS and stored encrypted (AES-256) in Supabase Storage
Authentication tokens are stored in Chrome's local storage on your device and are cleared when you uninstall the extension or log out
All data in transit is encrypted using HTTPS/TLS

4. Data Storage

Account data (email, hashed password, usage stats, send logs) is stored in Supabase — a GDPR-compliant, SOC 2 Type 2 certified cloud database
Media files you upload are stored in Supabase Storage, encrypted at rest with AES-256
Supabase servers are located in the United States
Authentication tokens are stored locally on your device in Chrome storage
Message text you compose is never stored on our servers — only the recipient phone number, timestamp, and send status are logged

5. Data Retention

Account data: Retained for the duration of your account. Deleted within 30 days of an account deletion request
Usage statistics & send logs: Daily usage counters reset at midnight UTC. Send log entries are retained for up to 12 months then automatically deleted
Media files: Retained according to your plan — Free: 30 days, Pro: 90 days, Enterprise: 365 days. You may delete files at any time from within the extension
Authentication tokens: Expire after 30 days or upon logout, whichever comes first
Local browser data: Removed immediately when you uninstall the extension or clear Chrome storage

6. Data Sharing

We do NOT sell, rent, or trade your personal data. We share data only in these limited circumstances:

Supabase: Our database, authentication, and file storage provider. Account data, usage statistics, send logs, and any media files you upload are stored here. Supabase does not use your data for their own purposes. See Supabase Privacy Policy
Legal requirements: We may disclose data if required by law, court order, or to protect the rights and safety of our users
Business transfer: In the event of a merger or acquisition, your data may be transferred. You will be notified via email before any such transfer
No data is shared with advertising networks, analytics platforms, or data brokers

7. Chrome Extension Permissions

The extension requests the following permissions and uses them solely as described:

Permission	Why It Is Needed
tabs	To open WhatsApp Web and detect when it is loaded
storage	To save your login token and draft phone numbers locally on your device
alarms	To schedule delays between messages to avoid spam detection
https://web.whatsapp.com/*	To interact with WhatsApp Web to send messages
https://isfaiawbywrtwvinkizb.supabase.co/*	To authenticate your account and retrieve plan limits

8. Cookies

The extension itself does not use cookies. Our website (wasappbulk.com) does not use advertising or tracking cookies. We use only essential session cookies required for the website to function.

9. Children's Privacy

This service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at privacy@wasappbulk.com and we will delete it promptly.

10. Your Rights

Access: Request a copy of all data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and all associated data
Portability: Request your data in a machine-readable format
Opt-out: Uninstall the extension at any time to stop all data collection

To exercise any of these rights, email privacy@wasappbulk.com. We will respond within 30 days.

11. Security

All communications use HTTPS/TLS encryption
Passwords are hashed using bcrypt and never stored in plain text
WhatsApp's own end-to-end encryption protects your messages in transit
No third-party tracking scripts or advertising pixels on our service
Access to our database is restricted by Row Level Security — users can only access their own data

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email at least 14 days before the change takes effect. Continued use of the extension after that date constitutes acceptance of the updated policy.

13. Contact

For privacy questions, data requests, or concerns, contact us at:
privacy@wasappbulk.com