Privacy Policy — LEADTOOLS

1. Overview & Limited Use Disclosure

WA Manager ("the Extension") is a Chrome browser extension developed by LeadTools. Its single core purpose is WhatsApp Contact Management — helping users export, filter, and manage WhatsApp Web contacts and groups directly within their browser. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

By installing or using the Extension, you agree to the terms of this Privacy Policy.

🔒 Google APIs — Limited Use Disclosure

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. WA Manager does not use any Google user data for advertising, profiling, or any purpose unrelated to its single core function of WhatsApp Contact Management.

2. Data We Collect

2.1 Data Collected Automatically

Data	Purpose	Stored Where
Device ID (randomly generated)	License activation limit per device	chrome.storage.local (on your device only)
License key (encrypted)	Verify your subscription	chrome.storage.local (encrypted on your device)
Subscription tier	Unlock correct features (FREE/BASIC/PRO/PREMIUM)	chrome.storage.local (on your device only)
Validation timestamp	Auto-revalidation schedule	chrome.storage.local (on your device only)
Daily usage counter (`_du_free_groups`)	Enforce daily group export limit for FREE/BASIC tiers (resets at midnight)	chrome.storage.local (on your device only)

2.2 Data You Choose to Export

When you use the Extension to export WhatsApp contacts or group members, that data is processed entirely on your device. It is:

Never sent to our servers
Never stored by LeadTools
Only saved as a file on your local computer when you click "Export"

2.3 Data We Do NOT Collect

We do not collect:

Your WhatsApp messages or chat content
Your phone number or WhatsApp account details
Your browsing history
Any personal information of your contacts beyond what you explicitly export
Cookies or tracking data
Analytics or usage statistics

3. How We Use Your Data

Data	How It's Used
Device ID + License Key	Sent to our license validation server (wamanager.leadtools.workers.dev) to verify your subscription via DodoPayments
Subscription Tier + Limits	Enforced locally to unlock features matching your plan
Error Logs	Stored locally on your device only; exported only if you manually click "Export Logs"
Background License Revalidation	The Extension periodically contacts our validation server (wamanager.leadtools.workers.dev) in the background to keep your subscription status current — BASIC tier every 24 hours, PRO tier every 30 days, and all tiers when we release updated feature limits. Only your license key and device ID are sent; no WhatsApp data is ever included.

4. Third-Party Services

4.1 DodoPayments

We use DodoPayments as our Merchant of Record to process payments and issue license keys. When you purchase a plan, all payment handling is performed by DodoPayments under their own legal entity — we never see your raw card details. Below is a summary of their key data practices, sourced from their official Privacy Policy (last updated 26 Feb, 2026).

📋 Data They Collect From You (as a Customer)

Category	Examples
Personal identifiers	Name, email address, postal address, IP address
Payment details	Billing address, card payment identifiers, payment amount & date (raw card numbers are not stored — tokenised only)
Purchase details	Order records, subscription tier, transaction history
Device / site data	Device type, browser type, IP address, login timestamps (fraud prevention)
Sensitive auth data	CVV codes are not stored after transaction authorisation

⚙️ Why They Use Your Data

Purpose	Details
Payment processing	Act as Merchant of Record to complete your transaction
License key issuance	Generate and validate your subscription license
Tax & compliance	Calculate and remit VAT, GST, and sales tax on your behalf
Fraud prevention	Monitor transaction signals to detect and prevent fraud
Legal obligations	Comply with applicable financial regulations and law enforcement

🔒 Security & Retention

Payment data is tokenised — raw card numbers are never stored by DodoPayments
CVV / sensitive authentication data is not stored after transaction authorisation
Data is retained only as long as required by legal or regulatory obligations (typically no longer than the limitation period plus 2 months)
Transfers of personal data outside the EEA are covered by Standard Contractual Clauses

🧑‍⚖️ Your Rights (GDPR & CCPA)

Access: Request a copy of data DodoPayments holds about you
Rectification: Correct inaccurate personal data
Erasure: Request deletion (subject to legal retention obligations)
Portability: Receive your data in a structured, machine-readable format
Withdraw consent: Opt out of non-essential processing at any time
California residents (CCPA): DodoPayments does not sell personal information

4.2 Cloudflare Workers

Our license validation server runs on Cloudflare Workers (cloudflare.com). When the Extension validates your license, your license key and device ID are sent to our Cloudflare Worker endpoint over HTTPS.

What Cloudflare logs contain: Cloudflare's standard infrastructure logs may include technical metadata only — specifically the requesting IP address and request timestamp. These logs do NOT contain your WhatsApp data, contact names, phone numbers, message content, or any personal information related to your WhatsApp usage. Logs are retained for approximately 30 days per Cloudflare's standard policy and are used solely for infrastructure security and abuse prevention.

4.3 Google Forms (Uninstall Feedback)

When you uninstall the Extension, you are redirected to a Google Form for optional feedback. Completing this form is entirely voluntary. Google's Privacy Policy applies to any data submitted via that form.

4.4 WPPConnect / wa-js Library

The Extension uses the open-source WPPConnect/wa-js library (Apache License 2.0) to interact with WhatsApp Web. This library runs entirely on your device and does not transmit data to WPPConnect servers.

5. Data Storage & Security

All Extension data is stored locally on your device using chrome.storage.local
Your license key is stored using device-bound XOR encoding (obfuscation) tied to your unique device ID — it cannot be used on any other device
No Extension data is stored on LeadTools servers
Data transmission to our validation server uses HTTPS encryption
We do not sell, rent, or share your data with any third parties beyond what is described in Section 4

6. WhatsApp Data — Important Notice

The Extension accesses WhatsApp Web data solely within your browser session and only when you actively use the Extension. This includes:

Group member lists visible in your WhatsApp Web
Contact names and phone numbers visible to your WhatsApp account
Chat and label data visible in your WhatsApp Web

This data is never transmitted to LeadTools. It is processed locally and only exported to a file on your device when you explicitly request it.

7. Permissions We Request

Permission	Why We Need It
`storage`	Save your license key and settings locally
`scripting`	Inject the Extension interface into WhatsApp Web
`activeTab`	Detect when you are on WhatsApp Web
`downloads`	Save exported contact files to your computer
Host: `web.whatsapp.com`	Run the Extension only on WhatsApp Web

8. Children's Privacy

The Extension is not intended for use by anyone under the age of 13. We do not knowingly collect data from children.

9. International Users — GDPR & CCPA

GDPR (EU/UK Users)

If you are located in the European Union or United Kingdom, you have rights under GDPR including access, deletion, and portability. Since we do not store your personal data on our servers, most GDPR rights are exercised directly on your device by uninstalling the Extension or clearing Extension storage.

CCPA (California Users)

We do not sell personal information. California residents may contact us at Contact@leadtools.in for any privacy-related requests.

10. Data Retention

Local Extension data (license key, device ID, settings) is retained until you uninstall the Extension or manually clear browser Extension storage
Cloudflare Worker logs are retained for approximately 30 days per Cloudflare's standard infrastructure policy. These logs contain only technical metadata — IP address and request timestamp — and do not include any WhatsApp data, contact information, message content, or personal user data
LeadTools servers do not retain any personal data. We have no backend database of user information
Payment data is retained by DodoPayments under their legal and regulatory obligations (see Section 4.1)

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted at https://leadtools.in/privacy-policy with a new "Last Updated" date. Continued use of the Extension after changes constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related questions or requests, please email us at: Contact@leadtools.in

13. Limited Use Disclosure

WA Manager's use and transfer of information received from Google APIs to any other app will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.