WappHub

Sync Chat

Privacy Policy

Last Updated: March 8, 2026

This Privacy Policy describes how WappHub Sync WhatsApp Chat to CRM (“the Extension”, “we”, “our”, or “us”) collects, uses, handles, stores, and shares personal and sensitive user data. This policy applies to the Chrome browser extension and the associated sync service. It is published to comply with the Chrome Web Store Developer Programme Policies and applicable privacy laws including GDPR and CCPA.

1. Data We Collect

We collect only the data necessary to provide the sync service. Below is an exhaustive list of every data type we collect, how each is obtained, and why.

1.1. WhatsApp Chat Data (Personal Communications)

When you enable sync (manual or automatic), the Extension reads the following from the WhatsApp Web page open in your browser:

  • Message content: The text body of chat messages. Media files (images, videos, audio, documents) are never collected; only the text caption of a media message is included, and only when a caption exists.
  • Message metadata: Message ID, timestamp, message type (text, image caption, etc.), sender direction (incoming or outgoing), and chat identifier.
  • Chat information: Chat ID (phone number or group identifier), chat/contact name, and unread message count.
  • Your WhatsApp phone number: The phone number of the WhatsApp account currently logged in to WhatsApp Web. This is used to associate synced messages with the correct account in your CRM.

Purpose: To sync your WhatsApp conversations to your CRM so they appear in your customer records.

1.2. Authentication and Configuration Data

  • WappHub API key: Entered by you in the Extension settings. Used to authenticate every request to the WappHub sync server.
  • License key: Entered by you. Sent to the WappHub server solely for license validation and plan-tier provisioning.
  • Webhook / CRM configuration: Webhook URL, HTTP method, headers, and body template that you configure. Stored locally in your browser and sent to the WappHub server so the server can forward synced messages to your chosen endpoint.
  • Sync preferences: Whether sync is enabled, sync interval, list of selected chats, and blocklist of excluded phone numbers. Stored locally and on the WappHub server to persist your settings across sessions and devices.

Purpose: To authenticate you, enforce license limits, and deliver messages to the CRM endpoint you have chosen.

1.3. Account and Support Data

  • Email address and name: Collected only if you contact us for support or purchase a license. Payment processing is handled by third-party payment providers (e.g., Razorpay, Stripe); we do not receive or store credit-card or bank-account details.

Purpose: To provide customer support and manage your license.

1.4. Technical / Diagnostic Data

  • Browser and extension version: Collected automatically for compatibility checks.
  • Error logs: Non-personal error messages (containing no chat content or personal identifiers) may be logged to the browser console for debugging. These logs stay on your device and are not transmitted to WappHub unless you explicitly share them with support.

Purpose: To maintain extension reliability and assist with troubleshooting.

1.5. Data We Do NOT Collect

  • WhatsApp passwords or login credentials
  • Media files (images, videos, audio, documents)
  • Location data
  • Browsing history or activity outside of web.whatsapp.com
  • Financial or payment information (handled entirely by third-party processors)
  • Health information
  • Data from any website other than web.whatsapp.com

2. How We Use Your Data (Data Handling)

Below is exactly how each category of collected data is processed:

  • Sync service: Chat messages and metadata are collected from WhatsApp Web in your browser, encrypted using your API key (application-layer encryption), and transmitted over HTTPS to the WappHub sync server. The server decrypts the payload, deduplicates messages (so the same message is not forwarded twice), and forwards them to the webhook / CRM endpoint(s) you have configured. After forwarding, the server retains only a record of which message IDs have been synced (for deduplication)—message content (body text) is not stored after forwarding.
  • License validation: Your API key and license key are sent to the WappHub server to verify that your subscription is active and to determine your plan tier (e.g., maximum number of webhooks).
  • Settings persistence: Sync preferences and webhook configurations are stored on the WappHub server so your settings are preserved if you reinstall the Extension or switch browsers.
  • Customer support: If you contact us, we use your email and the information you provide solely to resolve your inquiry.

We do not use your data for advertising, profiling, analytics, credit scoring, or any purpose unrelated to providing the sync service.

3. How We Store Your Data (Data Storage)

3.1. On Your Device (Local Storage)

The Extension stores the following using Chrome’s chrome.storage API on your device:

  • API key and API base URL
  • License key and cached license-validation result
  • Sync preferences (enabled/disabled, interval, selected chats, blocklist)
  • Webhook / CRM configuration (URL, method, headers, body template)
  • Last-sync timestamps (per chat)

This data remains on your device, is sandboxed by Chrome, and is protected by your operating system and browser security. It is removed when you uninstall the Extension or clear extension data in Chrome settings (chrome://extensions).

3.2. On WappHub Servers

The WappHub sync server (hosted on AWS infrastructure in the ap-south-1 (Mumbai) region) stores:

  • Synced message IDs and timestamps: Used for deduplication so the same message is not forwarded to your webhook twice. Message body text is not retained after forwarding.
  • Account configuration: Your webhook URLs, HTTP method, headers, body template, sync preferences (enabled, interval, selected chats), and blocklist.
  • License and API-key records: To authenticate requests and enforce plan limits.

All communication between your browser and the server uses HTTPS (TLS 1.2+). Data at rest on the server is protected by AWS-managed encryption.

3.3. On Your CRM / Webhook Endpoint

Message data forwarded to the webhook endpoint(s) you configure is stored and governed by the privacy policy of that third-party service. WappHub has no control over, and no access to, data after it reaches your endpoint.

4. How We Share Your Data (Data Sharing and Disclosure)

  • Your configured CRM / webhook endpoint: Synced message data (content, metadata, phone numbers) is forwarded to the endpoint(s) you configure. You control which endpoints receive data and can add, change, or remove them at any time via the Extension options page.
  • WappHub sync server: Encrypted message data passes through the WappHub server for processing (decryption, deduplication) and forwarding. Message content is not retained after delivery (see Section 3.2).
  • Payment processors: If you purchase a license, your payment is processed by a third-party provider (e.g., Razorpay, Stripe). We receive only a payment-confirmation record—not your card or bank details.
  • No selling of data: We do not sell, rent, trade, or share your personal or sensitive data with any third party for advertising, marketing, or any unrelated purpose.
  • No use for credit or lending: We do not use or transfer user data to determine creditworthiness or for lending purposes.
  • Legal requirements: We may disclose account-level data (not message content, which we do not retain) if required by a valid legal order or government request.
  • Business transfers: In the event of a merger or acquisition, account and license data may be transferred to the successor entity. Message content is not stored on our servers and therefore cannot be transferred.

5. Data Retention and Deletion

  • Message content: Temporarily held in server memory only during the sync request (typically under 10 seconds). After forwarding to your webhook, message body text is discarded. Only message IDs and timestamps are kept for deduplication.
  • Deduplication records (message IDs and timestamps): Retained for the lifetime of your account to prevent duplicate forwarding.
  • Account and configuration data: Retained as long as your account is active. Deleted within 30 days of receiving an account-deletion request.
  • Local browser storage: Cleared immediately when you uninstall the Extension or manually clear extension data via Chrome settings.
  • Support correspondence: Retained for up to 12 months after resolution, then deleted.

6. How We Protect Your Data

  • Encryption in transit: All data transmitted between your browser and the WappHub server, and between the server and your webhook endpoint, is sent over HTTPS (TLS 1.2 or higher).
  • Application-layer encryption: Sync payloads are additionally encrypted using your API key before transmission, providing a second layer of encryption on top of HTTPS.
  • Encryption at rest: Server infrastructure uses AWS-managed encryption for data at rest.
  • Access control: Only you can configure which chats are synced, which numbers are blocklisted, and which endpoints receive data. WappHub staff do not have access to your message content (it is not stored on the server after forwarding).
  • Local storage security: Data stored via Chrome’s chrome.storage API is sandboxed by Chrome and protected by your device’s operating-system security.

7. Browser Permissions and Why We Need Them

The Extension requests the following Chrome permissions. Each is used solely for the sync service described in this policy:

  • storage: To save your API key, license key, sync preferences, blocklist, and webhook configuration locally in Chrome.
  • alarms: To run periodic automatic sync at your chosen interval (e.g., every 5 minutes) without requiring the popup to remain open.
  • tabs: To locate the WhatsApp Web tab so the Extension can read messages from it, and to open WhatsApp Web if it is not already open when you click the Extension icon.
  • activeTab: To interact with the currently active tab when you click the Extension icon, allowing the popup to be displayed on that tab.
  • scripting: To inject the Extension’s own packaged content script into the WhatsApp Web tab when the tab was opened before the Extension was installed or enabled. No remote code is loaded or executed.
  • Host permission — web.whatsapp.com: Content scripts run only on this site to read chat data for syncing. We do not run scripts on any other website.
  • Host permission — *.wapphub.com and *.execute-api.ap-south-1.amazonaws.com: Used to communicate with the WappHub sync server and licensing server.

8. Your Rights and Controls

  • Choose what to sync: You select which chats are synced (manual mode) or exclude specific numbers via the blocklist (auto/live mode). No data is ever synced without your explicit action or configuration.
  • Disable sync: You can turn off automatic sync at any time in the Extension popup. Manual sync only runs when you click the sync button.
  • Edit or remove webhooks: You can add, change, enable, disable, or delete your webhook / CRM endpoints at any time in the Extension options page.
  • Uninstall: Removing the Extension from Chrome immediately stops all sync activity and deletes all locally stored data.
  • Request server-side data deletion: You may request deletion of all data stored on WappHub servers (account config, deduplication records, license info) by emailing contact.wapphub@gmail.com. We will process deletion requests within 30 days.
  • Data access and portability: You may request a copy of the personal data we hold about you by contacting support at the email above.

9. For Users in the EU/EEA (GDPR) and California (CCPA)

GDPR (EU/EEA Users)

  • Legal basis for processing: We process your data based on (a) your explicit consent (you enable sync and configure endpoints), and (b) the performance of the service you have requested.
  • Your rights under GDPR: You have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to withdraw consent at any time by disabling sync or uninstalling the Extension.
  • Data controller: WappHub (contact.wapphub@gmail.com).
  • International transfers: Data is processed on AWS servers in ap-south-1 (Mumbai, India). If you are in the EU/EEA, your data may be transferred outside the EEA; we rely on AWS’s compliance frameworks (including Standard Contractual Clauses) to ensure an adequate level of data protection.

CCPA (California Users)

  • We do not sell personal information as defined by the CCPA.
  • California residents have the right to know what personal data we collect, to request deletion of their data, and to opt out of any future sale of personal data (though we do not sell data).
  • To exercise these rights, contact us at contact.wapphub@gmail.com.

10. Cookies and Website Analytics

  • The Extension itself does not set any cookies or use any tracking technologies.
  • Our website (wapphub.com) uses essential cookies for session management. Anonymized, aggregated analytics may be collected on the website only. Website analytics are not linked to any Extension data or personal identifiers.
  • You can disable cookies in your browser settings; this does not affect Extension functionality.

11. Children’s Privacy

Our services are not directed to anyone under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected data from a child under 18, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this policy to reflect changes in our practices, legal requirements, or service features. When we make material changes, we will update the “Last Updated” date at the top of this page and post a notice on our website. If you have provided an email address for licensing or support, we will also notify you by email of significant changes.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or need support:

By installing and using WappHub Sync WhatsApp Chat to CRM, you consent to the collection, processing, transmission, and storage of data as described in this Privacy Policy. You may withdraw consent at any time by disabling sync or uninstalling the Extension.