Privacy Policy

WAEXT is a browser extension for WhatsApp Web and this website, run by David Maillo, an individual based in Barcelona, Spain. We are responsible for the personal data described here (the "controller" under the GDPR).

For any privacy question or request, write to info@waext.com.

WAEXT is an independent project. It has no relationship to WhatsApp or Meta.

The extension saves these things in your browser's local storage. They are never sent to us:

• Your settings and which superpowers you turned on
• Your saved messages (Presets)
• The list of chats where you turned on auto-translate. This list can contain the chat's WhatsApp ID, which may include a phone number
• How many free AI credits you have used
• Your Pro license key and credit balance, if you have one

Uninstalling the extension deletes all of it.

The extension only works on web.whatsapp.com and only reads what is on your screen in the chat you have open. It does not read chats you haven't opened, your contact list, photos, videos, voice notes or any other files.

Reading a chat on screen does not send it anywhere. Text only leaves your browser when you use one of the AI features below.

Each AI feature sends only the text it needs:

• Smart Write and Smart Rewrite: the draft you are writing, or the part you selected, and the change you asked for (tone, length, language).
• Smart Reply: the last messages of the open chat (10, 20 or 40, you choose), with each sender's name as WhatsApp shows it. For an unsaved contact that name can be a phone number.
• Smart Summary: the last messages of the open chat (15 to 100, you choose), with sender names, as above.
• Auto-translate: the messages you receive in the chats where you turned it on. This one runs on its own while that chat is open, without a click, so it only works in chats you pick.

Apart from auto-translate, nothing is sent until you press a button. Pro users also send their license key, so we can check it and count the credit.

What happens to that text: our server passes it to OpenAI, gets the answer and sends it back to your browser. We don't save the text in a database or in our logs. Our logs only record which feature was used and how many AI tokens it took.

OpenAI processes the text under its API terms: it does not use API data to train its models and may keep it for up to 30 days to detect abuse, after which it is deleted. See OpenAI's privacy commitments.

Chats contain messages written by your contacts. When you use Smart Reply, Smart Summary or auto-translate, some of their messages and names go through the process above, only because you asked for it and only to give you the result.

Please use these features the way you would expect others to treat your messages. If a chat is sensitive, don't run AI on it.

Payments are handled by Polar, which acts as the seller (merchant of record). Polar collects your email and billing details, takes the payment and emails you your license key. We never see your card details.

From Polar we receive your email, what you bought and your license key. Every time a Pro user runs an AI action, we ask Polar whether the key is valid and add one credit to its usage count.

When a sale happens we get an internal notification with the amount and a partially hidden email address.

We count visits with Plausible, which uses no cookies and collects no personal data. We only see totals, like how many people visited a page. This site sets no tracking or advertising cookies.

Like any web server, our hosting provider keeps short-lived technical logs (such as IP address and time of request) to keep the service running and secure.

We use these providers. Each only gets what it needs for its job.

Some of them are in the United States. Transfers there rely on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

• Sell or rent your data
• Use it for advertising or share it with advertisers
• Use your chats to train AI models
• Use it to judge creditworthiness or for lending
• Send WhatsApp messages on your behalf
• Read your chats ourselves. Nobody at WAEXT looks at the text you send to the AI

We use the data only to provide and improve the features described here. The way WAEXT handles user data follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

• Providing the service you asked for (GDPR art. 6.1.b): running the AI features, checking licenses and counting credits.
• Legitimate interest (art. 6.1.f): server logs for security, and anonymous website statistics.
• Legal obligation (art. 6.1.c): keeping sales records for tax purposes.

• Text sent to the AI: not stored by us. Up to 30 days at OpenAI, as above.
• Server logs: kept for a short time by our hosting provider, then deleted.
• Purchase and license data: as long as your license is active, and then as long as tax law requires.
• Data in your browser: until you delete it or uninstall the extension.

You can ask us to access, correct or delete your personal data, to limit or object to how we use it, or to receive a copy of it. Write to info@waext.com and we'll answer within a month.

Since the text you send to the AI is not stored, there is usually nothing of it for us to give back or delete. For purchase data, include the email you used at checkout.

If you think we handle your data wrongly, you can complain to the Spanish data protection authority, AEPD, or the one in your country.

WAEXT is not meant for anyone under 16, and we don't knowingly collect their data.

If we change what we collect or how we use it, we'll update this page and its date. For important changes we'll also let you know in the extension.