Privacy Policy

1. Introduction

This Privacy Policy explains how WhatsApp Web Mini-CRM (“we,” “our,” or “the Extension”) collects, uses, stores, and protects your information when you install and use our Chrome extension.

We take your privacy seriously. This Extension is designed with a privacy-first approach: it reads the minimum data necessary to function and never accesses your message content, browsing history, or any data outside its stated purpose.

By installing and using the Extension, you agree to the practices described in this policy. If you do not agree, please uninstall the Extension.

2. Data We Collect

The Extension collects only the data required to provide its CRM functionality. Below is a complete and detailed inventory of all data collected:

Data Type	How It Is Collected	Purpose	Stored
Contact ID Phone number extracted from WhatsApp Web	Extracted automatically from the WhatsApp Web interface when you click on a chat	Used as the unique identifier for CRM records (tags, notes, reminders are associated with this ID)	Local + Cloud (if signed in)
Email Address	Received from Google OAuth when you sign in with Google	Used for authentication and to associate your data with your account	Cloud only
Display Name	Received from Google OAuth when you sign in with Google	Displayed in your profile section within the Extension	Cloud only
Profile Photo URL	Fetched from Google People API using your OAuth access token	Displayed in your profile section for visual identification	Cloud only
Tags	Created by you through the Extension UI	Core CRM feature: organizing contacts with labels	Local + Cloud (if signed in)
Notes	Written by you through the Extension UI	Core CRM feature: storing private notes per contact	Local + Cloud (if signed in)
Reminders	Created by you through the Extension UI	Core CRM feature: scheduling follow-up reminders with notifications	Local + Cloud (if signed in)

What We Do NOT Collect

The Extension explicitly does not collect or access:

• Message content — We do not read, store, or transmit any part of your WhatsApp conversations.
• Browsing history — We do not track which websites you visit.
• Location data — We do not collect GPS, IP-based location, or any geographical information.
• Health or medical information — We do not collect any health-related data.
• Payment or financial information — We do not collect credit card numbers, bank details, or transaction history. Premium payments are processed entirely by Freemius, our payment processor.
• Authentication credentials — We do not store passwords. Authentication is handled exclusively through Google OAuth.
• Personal communications — Other than contact IDs extracted for CRM purposes, we do not access your personal messages, call logs, or any other communications.
• User activity or keystrokes — We do not track clicks, mouse movements, scrolling, or keystrokes.
• Website content — We do not extract text, images, audio, or any other content from pages you visit.

3. How We Use Your Data

Your data is used exclusively for the Extension’s single purpose: providing a CRM sidebar for WhatsApp Web.

• Contact IDs are used to associate CRM records (tags, notes, reminders) with specific WhatsApp contacts.
• Email and display name are used for authentication and profile display within the Extension.
• Profile photo is displayed in the Extension’s profile section for visual identification.
• Tags, notes, and reminders are your CRM data and are stored to provide the core functionality of the Extension.

We do not use your data for:

• Advertising, marketing, or promotional purposes
• Training machine learning or AI models
• Behavioral profiling or analytics
• Selling, renting, or sharing with third parties
• Creditworthiness assessment or lending decisions
• Any purpose unrelated to the Extension’s stated functionality

4. Data Storage and Retention

4.1 Local Storage

When you use the Extension without signing in, all data is stored locally on your device using Chrome’s storage.local API. This data remains on your device and is never transmitted to any server. You can clear this data at any time by uninstalling the Extension or clearing your browser data for the Extension.

4.2 Cloud Storage

When you sign in with Google, your data is additionally stored in Firebase Firestore, a cloud database provided by Google Cloud. This enables cross-device synchronization. Your data is stored in a dedicated Firebase project and is accessible only to you when authenticated.

4.3 Retention Period

We retain your data for as long as you use the Extension. You may delete your data at any time:

• Local data: Remove by uninstalling the Extension or clearing browser storage for the Extension.
• Cloud data: Contact us to request permanent deletion of your cloud-stored data. We will process deletion requests within 14 days.

4.4 Data Deletion

To request deletion of your cloud data, contact us at the email address provided in Section 10. We will confirm receipt within 48 hours and complete the deletion within 14 days. After deletion, your data cannot be recovered.

5. Data Sharing and Disclosure

We do not sell, rent, trade, or otherwise transfer your data to third parties. The only third-party services involved in the Extension’s operation are:

• Firebase (Google Cloud) — Used for authentication (Firebase Auth) and cloud database (Firestore). Firebase processes and stores your data according to Google’s privacy policy and is GDPR-compliant. Firebase Privacy Policy
• Freemius — Used solely for processing Premium subscription payments. Freemius receives your email address and payment information only at the point of purchase. The Extension itself does not process or store any payment data. Freemius Privacy Policy
• Google Identity API — Used for OAuth authentication. Google receives your authentication request and returns your basic profile information (name, email, profile photo). Google Privacy Policy

These third-party services have their own privacy policies governing the use of your data. We encourage you to review them. We are not responsible for the privacy practices of these third parties.

We may disclose your information if required to do so by law, regulation, or legal process, or to protect our rights or the safety of others.

6. Data Security

We implement the following security measures to protect your data:

• Encryption in transit: All data transmitted between the Extension and Firebase is encrypted using TLS/SSL.
• Authentication: Access to cloud data is protected by Google OAuth. Only authenticated users can access their own data.
• Firestore security rules: Database access is restricted to authenticated users and scoped per user ID, preventing unauthorized access even in the event of a database breach.
• Minimal data collection: We collect only the data absolutely necessary for the Extension’s functionality, reducing exposure risk.
• No remote code execution: The Extension uses script-src 'self' CSP, preventing injection of external or unauthorized scripts.

While we take reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

7.1 For Users in the European Economic Area (GDPR)

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure (“Right to be forgotten”): Request deletion of your personal data.
• Right to restrict processing: Request limitation of how we use your data.
• Right to data portability: Request transfer of your data to another service provider in a structured, commonly used format.
• Right to object: Object to the processing of your personal data.

To exercise any of these rights, contact us at the email in Section 10. We will respond within 30 days.

7.2 For Users in California (CCPA / CPRA)

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: Request deletion of personal information we have collected from you.
• Right to opt-out: The Extension does not sell your personal information, so no opt-out is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

7.3 For All Users

• Uninstall: You may uninstall the Extension at any time. This stops all data collection and removes local data.
• Cloud data deletion: You may request deletion of your cloud-stored data by contacting us.
• No automated decision-making: We do not use your data for automated decision-making or profiling.

8. Children’s Privacy

The Extension is not intended for use by children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately and we will delete that information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last Updated” date at the top of this page. In the case of material changes, we will provide notice through the Extension itself (e.g., a notice in the sidebar).

We encourage you to review this Privacy Policy periodically. Your continued use of the Extension after changes constitutes acceptance of the updated policy.

10. Contact Information

For questions, concerns, data deletion requests, or to exercise your privacy rights:

• Email: iulianivn@duck.com
• Response time: We aim to respond within 48 hours and resolve requests within 30 days.

11. Governing Law

This Privacy Policy is governed by the laws of Romania. By using the Extension, you consent to the jurisdiction of the courts of Romania for any disputes arising from this policy.