WaGoZAPPrivacy Policy
Last updated: September 30, 2026
This is a translation provided for convenience. In case of any discrepancy, the Portuguese version prevails.
This policy explains what data WaGoZAP (the Google Chrome extension, the website and the subscriber portal) processes, for what purpose, where it is kept and what your rights are. The data controller is WaGoZAP ("we"). Contact for privacy matters and the data protection officer: sylvesterstaller2508@gmail.com.
1. Summary
- Your scheduled messages, recipients and images stay on your computer, inside the extension. We do not send this content to our servers.
- On our servers we keep only what is needed for your account, your plan, the integration with your blog and click metrics.
- We do not sell personal data and we do not use your data for advertising.
2. Data that stays only on your computer (extension)
To work inside WhatsApp Web, the extension reads, on demand and only while you use the panel, information from your session: the name and identifier of chats and groups, the open chat and, when available, the profile picture thumbnail. It stores in the browser (IndexedDB/extension storage): the schedules you create (text, image, recipient, time, status history), your preferences and technical logs without message content. This data is not sent to us. You can delete it by deleting the schedules or removing the extension.
Auto-replies: when enabled, the extension reads new text messages received in private chats to decide whether to reply. This analysis, including the search in your blog, happens only on your computer: the text of received messages is not sent to our servers. The reply history is stored only in the extension.
Extras tab: private mode (blurring parts of the screen), the chat background image and exporting your list work only on your computer. The background image and preferences stay in the extension's storage. The export creates a spreadsheet downloaded straight to your computer, with only the contacts saved in your address book and the groups you belong to (name, number of participants and whether you are an admin). On the PRO plan you can also export the name and number of the members of the groups you choose, among the groups you belong to, with the same information WhatsApp already shows you (numbers hidden by WhatsApp stay hidden). The Restore removed messages feature is off by default; when you turn it on, the text of received messages stays only in the WhatsApp Web tab's memory for up to 24 hours, and messages the sender deletes are stored on your computer for up to 7 days (you can clear the list at any time). None of this is sent to our servers. You are responsible for how you use this data: handle it according to the applicable data protection laws (such as LGPD/GDPR) and only message people who gave you permission.
3. Data processed on our servers
| Data | Purpose | Legal basis (LGPD) | Retention |
|---|---|---|---|
| Name, email, preferred language and password (stored only as a cryptographic hash) | Create and protect your account | Performance of contract | While the account exists |
| Access sessions (device, dates of use) | Security and device control | Performance of contract / legitimate interest | Up to 30 days after they end |
| Plan, status, validity and subscription history | Enable features and billing | Performance of contract / legal obligation | As long as needed + legal periods |
| Orders and payments: plan, amount, coupon, status, payment method (Pix or card) and the payment identifier at Mercado Pago. We do not receive or keep card data. | Confirm payments, issue receipts and handle refunds | Performance of contract / legal obligation | Legal periods (tax and consumer law) |
| Send count (send identifier, without text, recipient or phone number) | Apply plan limits | Performance of contract | 13 months |
| Technical state of the extension (versions, WhatsApp connected yes/no, count of sends per status, error codes) | Technical support | Legitimate interest | 30 days |
| Connected blog: address, imported public posts and, if you provide them, username and application password (encrypted) | WordPress integration | Performance of contract | Until you disconnect the blog |
| Trackable links: destination address, name of the destination group (individual chats are not identified), campaign and post | Click metrics | Performance of contract | While the account exists |
| Clicks: date/time and an anonymous daily identifier (the IP address is not stored) | Click metrics and abuse prevention | Legitimate interest | 13 months |
| Public website visits: page, language, device type (from screen width), referring site, campaign (utm), how far the page was scrolled, sections viewed, reading time, buttons and links clicked and an anonymous daily identifier (no cookies; the IP address is not stored) | Understand and improve the website | Legitimate interest | 13 months |
| Audit logs of administrative actions | Security | Legitimate interest | 2 years |
4. People who click the links
When someone clicks a trackable link, we record the date and time of the click and an identifier calculated from a random value that changes every day, the IP address and the browser. The IP itself is not stored and the daily value is discarded, which prevents identifying the person or following them across days. Automated visits (bots and link previews) are excluded from the metrics.
Website visits: on the public WaGoZAP pages (home page, support and legal pages) we measure, with our own tool and without cookies, how the website is used: how far the page was scrolled, which sections appeared on screen, how long the page stayed open with interaction and which buttons and links were clicked. The visitor identifier is calculated as for trackable links (daily random value, IP and browser), without storing the IP. We do not record what is typed, we do not record the screen and we do not share this data with third parties. If your browser sends the Global Privacy Control or "Do Not Track" signal, nothing is collected. The subscriber portal and the admin panel are not measured.
5. Sharing
We share data only with processors needed to provide the service, under contract: hosting provider (Locaweb, with servers in Brazil), email provider (Hostinger) and, for payments, Mercado Pago, which receives your name, email and the order amount (card and Pix data are handled directly by Mercado Pago; we do not receive them). We may share data when required by law or court order.
6. Limited use of extension data
The use of information obtained by the extension is limited to providing and improving the features described to you. We do not transfer this data to third parties, except as described in this policy, we do not use it for advertising and we do not allow people to read it, except with your consent, for security or when required by law.
7. Security
We use encrypted connections (HTTPS), slow salted password hashing, encryption of credentials at rest, role-based access control, attempt limiting and audit logs. No measure is infallible; in case of a relevant incident, we will notify you and the ANPD (Brazil's data protection authority) as required by law.
8. Your rights
You can request confirmation, access, correction, portability, anonymization or deletion of your data, and revoke consents, by writing to sylvesterstaller2508@gmail.com. We reply within 15 days. Some information may be kept for the period required by law.
9. Children
WaGoZAP is not intended for people under 18.
10. Changes
We may update this policy. Relevant changes will be communicated by email or in the portal.
WhatsApp is a trademark of WhatsApp LLC / Meta Platforms, Inc. WaGoZAP is independent and is not affiliated with, sponsored or endorsed by WhatsApp or Meta.