Privacy Policy

WA Bulk Messenger ("we", "our", "us"), operated by WA Bulk Messenger, provides the WA Bulk Messenger Chrome extension, the WA Bulk Messenger Android app, and the website at wabulkmessenger.com. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights over it.

By installing the extension or the app, or using the website, you agree to this Privacy Policy. If you do not agree, please uninstall the extension or the app and stop using the Service.

1. How the Service Works

WA Bulk Messenger runs as a Chrome extension that operates inside your own WhatsApp Web session, and is backed by an account-based cloud service. Messages are delivered through your own WhatsApp Web session in your browser — we never connect to WhatsApp on your behalf and we never read your incoming WhatsApp conversations.

To provide features such as campaign management, scheduling, follow-up sequences, reporting, and cross-device access, the extension transmits certain data to our servers, where it is stored to operate your account. This section explains exactly what we store and why.

The Android app works with the WhatsApp app installed on your own phone. For each recipient it opens the chat in WhatsApp; you then tap Send yourself, or, only if you choose to turn on the optional Accessibility Service described in section 4, the app taps WhatsApp's Send button for you. We never connect to WhatsApp on your behalf.

2. Data Stored in Your Browser

Some data is kept locally in your browser by the extension:

• Your login token (JWT) to keep you signed in
• A local AES-256-GCM encryption key used to protect cached data; this key is destroyed when you log out
• Cached copies of your campaigns, templates, and settings for performance
• Feature usage counters

3. Data Stored on Your Device (Android App)

The Android app keeps some data on your phone:

• Your login tokens, kept in Android's secure storage so you stay signed in
• A local database holding the contacts you import (names, phone numbers, and any custom fields), your campaigns and their message text, the WhatsApp number or numbers you send from together with their daily sending limits, the per-recipient result of each send, your opt-out list, and the queue of messages still to be sent
• Your app settings and preferences

The account, campaign, and contact data described in section 5 is also sent to our servers so that your account, monthly allowance, and reports work across your devices. Uninstalling the app or clearing its storage removes the data kept on your phone.

The app does not request permission to access your phone's contact list, location, camera, or microphone. It uses the Android file picker only for files you choose to import or attach.

4. The Android Accessibility Service

The Android app includes an optional Accessibility Service, shown in Android Settings as "WA Bulk Messenger Auto Send". Only you can turn it on, in Android's Accessibility settings, and you can turn it off at any time. The app works without it: you simply tap Send yourself in WhatsApp.

What it does. While a campaign is running, after the app opens WhatsApp for one recipient, the service:

• finds WhatsApp's own Send button and taps it;
• recognizes a few WhatsApp screens it must react to: the contact picker, WhatsApp's error dialogs, and WhatsApp's notice that an account has been restricted or banned; and
• where WhatsApp files a recipient under a different address, enters that recipient's number into WhatsApp's search box and selects the matching result.

Limits.

• It receives events only from WhatsApp and WhatsApp Business, and from no other app.
• It is active only for the few seconds while a campaign is waiting on one recipient. At other times it does nothing.
• It looks at WhatsApp's on-screen buttons and notices only to do the things listed above. It does not record, store, or send the content of your chats or anything else it sees on screen, and the service's own code makes no network connections.
• It reports only an outcome to the app, such as sent, timed out, or account restricted. That outcome becomes part of your campaign's delivery results, which are described in section 5.

5. Data We Collect and Store on Our Servers

Account Information

• Email address
• Password (stored only as a bcrypt hash — your plaintext password is never stored)
• Display name and profile picture (optional)
• The WhatsApp phone number you send from, used to enforce fair-use limits and prevent abuse

If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.

Campaign & Contact Data

To create, run, schedule, and report on your campaigns across devices, we store the following on our servers:

• Recipient details — the names, phone numbers, country codes, and any custom fields you import or add for a campaign
• Message content — your campaign message text, saved templates, and follow-up sequence messages
• Attachment metadata — file name and type of media you attach (the media files themselves are sent through your own WhatsApp session in your browser or on your phone, not stored by us)
• Delivery results — per-recipient sent/failed/delivered status and timestamps
• Opt-out list — phone numbers (and optional names) you blacklist so they are automatically skipped

This recipient and message data is stored to operate the Service for you. We do not sell it, share it for advertising, or use it for any purpose other than providing the Service.

Contact Groups (end-to-end encrypted)

When you save Contact Groups, the group contents are encrypted on your device using AES-256-GCM before being uploaded. Our servers store only the encrypted blob, a group name, and a count — we cannot read the contents of your saved Contact Groups.

Billing Data

• Your plan (FREE or PRO) and monthly usage counters
• Payment and subscription reference IDs from our payment processor, Razorpay

Card and payment details are handled directly by Razorpay; we do not receive or store your full card information.

6. AI Features

If you use the optional AI message assistant (available on paid plans) to rewrite a message or generate variations, the message text you submit is sent to our third-party AI provider to generate the result. We do not send your contact lists or phone numbers to the AI provider, and the text is sent only to fulfil your request.

7. Third Parties We Share Data With

We use a limited set of service providers strictly to operate the Service:

• Cloud hosting & database — to host the application and store your account data
• Google — for optional Google Sign-In
• Razorpay — to process payments
• AI provider — only when you use the AI assistant, and only the text you submit
• Email provider — to send transactional emails (verification, billing, password reset)

We do not:

• Sell your personal data to anyone, ever
• Use your data for advertising or ad networks
• Read or store your incoming WhatsApp conversations
• Share your data except with the providers above or as required by law

8. Data Retention

• Account, campaign, and contact data — kept while your account is active. Permanently deleted within 30 days of an account deletion request.
• Billing records — kept as required to comply with applicable financial and tax regulations.
• Locally cached data — removed from your browser when you log out or uninstall the extension. Data kept on your phone by the Android app is removed when you uninstall the app or clear its storage.

You can delete individual campaigns, contacts, templates, and Contact Groups at any time from within the extension.

9. How We Protect Your Data

We use HTTPS for all data transmission, bcrypt for password hashing, AES-256-GCM encryption for Contact Groups, and signed JWT tokens with version-based revocation. No method of internet transmission or storage is 100% secure — while we take every reasonable precaution, we cannot guarantee absolute security.

10. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your account and all associated data.
• Data portability — request your data in a machine-readable format.

To exercise any right, email [email protected]. We will respond within 30 days.

Deleting your account. You can ask us to delete your account and all associated data at any time: use Delete account in the Android app's More tab, or follow the steps on our account deletion page. The page works even if you have already uninstalled the app or the extension.

11. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has an account with us, contact us at [email protected] and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Minor changes will be reflected by updating the "Last updated" date. Material changes will be communicated to registered users via email at least 14 days before they take effect. Continued use of the Service after changes constitutes your acceptance of the revised policy.

13. Contact Us

For any privacy-related questions or requests:

• Email: [email protected]
• Website: wabulkmessenger.com
• Delete your account: wabulkmessenger.com/delete-account