WAblastr Privacy Policy

The extension accesses your signed-in WhatsApp identifier and the contacts, chats, groups and message information needed for the features you use. Recipient lists, templates, chat notes, drafts, exclusion lists, attachment files and campaign outcomes are stored locally in your Chrome profile.

When you choose to send, prepared messages and attachments pass through WhatsApp Web using your signed-in session. Message bodies and attachment files are not uploaded to the WAblastr account and usage API.

Workspace exports can contain sensitive contacts, notes and templates. They exclude authentication credentials, premium access, active campaigns and attachment files. Local workspace storage is not a cloud backup; clearing extension storage, removing a browser profile or uninstalling the extension can remove it.

Normal WAblastr connection uses the WhatsApp number observed in your session, a display name when available and a private random installation credential. It does not require a separate WAblastr email, password or sign-in code. The installation credential stays in extension-origin IndexedDB. Temporary bearer sessions are kept in background-only session storage.

Cloudflare Workers and D1 process account and profile details, the observed number, authentication digests, daily usage, opaque message-part reservation identifiers, timestamps and outcome markers. These records support connection, usage allowances, premium access and protection against replaying an already reserved message part. The backend stores credential and session digests rather than raw credentials or bearer tokens.

Hosting infrastructure receives network metadata such as your IP address. The API HMAC-hashes IP addresses for registration and sign-in rate limiting. The extension does not collect GPS coordinates or general browsing history. Private account records remain separate for each installation; a WhatsApp number by itself does not authorize access to another installation's private records.

Purchases take place on Razorpay-hosted Payment Pages. Razorpay receives the contact and purchase fields you submit, the WhatsApp number receiving premium and payment-method details. Its own privacy policy governs its processing.

WAblastr verifies payment notifications and payment/order records. It retains limited payment, order and event identifiers, plan, amount, currency, destination number, payment status, bounded failure codes, timestamps, access expiry and recovery-job records. It does not persist payment-card or bank details, raw provider responses, payer contact/email fields from those responses or arbitrary payment notes.

Premium is prepaid for 30 or 365 days and renewed manually. Remaining paid time carries forward when you renew. The WhatsApp number entered for activation identifies the premium entitlement. Razorpay sends payment receipts when configured.

The website is hosted on Vercel. Website requests expose normal network and request information to the hosting service. Browser storage remembers your theme and campaign parameters from links, including campaign identifiers, landing-page URL and timestamp. The local campaign history keeps up to ten entries.

The website loads Google Tag Manager and can initialize Mixpanel when configured. Website analytics may process page visits, referral or campaign information, browser/device information and identifiers using cookies or browser storage, depending on the configured provider. You can manage browser storage and restrict tracking through your browser settings.

These website features are separate from the extension. The extension does not enable an advertising analytics integration. Its API account connection uses bearer sessions rather than a cookie login. WhatsApp and Razorpay have their own separate storage and cookie practices.

WAblastr uses extension information to provide its messaging workspace, connect your account, enforce usage allowances, maintain premium access, investigate failures, prevent abuse and handle support requests.

WhatsApp/Meta processes messages passed through WhatsApp Web. Cloudflare hosts the account, usage and premium-access service; Razorpay handles payments; Vercel hosts the website. Google and, when configured, Mixpanel provide website measurement services. Support email is routed by Cloudflare to a Google Gmail inbox. Those services process the messages and attachments you send so we can answer your request.

Extension user data is not sold or used for advertising, unrelated profiling, creditworthiness or lending. Transfers are limited to providing and securing the disclosed functions, complying with applicable law, or other uses permitted by the Chrome Web Store User Data Policy. WAblastr's handling of extension user data follows that policy, including its Limited Use requirements.

Local workspace information, installation credentials, theme preferences and campaign storage remain in your browser until removed or replaced. The local campaign-history limit is a limit on entry count, not an automatic time-based deletion period.

Backend bearer sessions expire after seven days and can clear earlier from Chrome session storage. Daily cleanup removes expired sessions and sign-in challenges and stale hashed-IP rate-limit counters.

Account/profile, usage and message-part reservation records, payment attempts, premium grants and payment-recovery records currently have no fixed automatic deletion period. Records can remain after access expires. They support account continuity, payment reconciliation and replay protection. A fixed retention schedule for these categories has not yet been established.

Hosting, payment and analytics providers retain their own records under their service settings and policies. Clearing browser data does not remove records already held by WAblastr or these providers.

Contact support@wablastr.com to request access, correction or deletion of account information, or to ask about this policy. Requests must be verified against the relevant private account before information is disclosed or changed. Knowing or claiming a WhatsApp number alone is not sufficient verification for another installation's records.

You can remove local information through the extension and Chrome storage controls. The workspace export feature covers supported local workspace records; a self-service backend account deletion/export feature is not currently available. A request may require support review of account, payment and replay-protection records.

You control the recipients and content of prepared messages. Respect recipient preferences and exclusion requests. For data held by WhatsApp, Razorpay or website providers, their own privacy controls and policies also apply.

Production account traffic uses HTTPS. Authentication secrets are handled by the extension background, and the backend stores digests. Local workspace files and exports have no additional WAblastr application-level encryption; protect your device, browser profile and backup files.

WAblastr is an independent product and is not affiliated with WhatsApp or Meta. Their platform rules and account restrictions still apply. Changes to these practices will be reflected on this page with an updated date.