Privacy Policy
Last updated: 2026-08-25
Scope
This policy applies to the WA Link Generator website (the "Service") and its companion Chrome extension. We follow a data-minimization principle: importing, validating, and generating links happen locally in your browser, and our servers keep only what is necessary to run your account. Questions about this policy can be sent to [email protected].
Information We Collect
At registration we collect your email address, a password (stored only as a bcrypt hash — no one, including us, can view the plaintext), and an optional nickname. If you sign in with Google, we read and store your email address, avatar, and basic profile. Running your account also produces records such as subscription status, points and check-in history, referral relationships, last login time, and language preference.
Phone Numbers & Message Content
Importing, deduplication, and link/QR generation all happen locally in your browser and are never uploaded. When you create a bulk send task, the numbers and message texts are uploaded to our servers: plaintext numbers are used only for the Chrome extension to carry out delivery and are erased from the server once the task completes or is cancelled; long-term records keep only masked numbers (e.g. +86138****5678) and delivery status.
AI Features
When you use AI copywriting or translation, the text you submit is forwarded to the third-party AI platform configured by the administrator and the result is returned to you. We log the platform name, model, latency, token counts, and the first 100 characters of the input and output as summaries for usage accounting and troubleshooting; full conversations are not retained.
Payment Information
Card and other payment credentials are handled directly by Stripe and never touch our servers. USDT cryptocurrency payments are processed by BEPUSDT; we store only the order amount, status, and on-chain transaction hash. Order records (amount, plan, payment method, period) are kept for accounting and support purposes.
Email Notifications
We send only transactional emails related to your account: email verification, password reset, and account notices such as subscription renewal or expiry, failed payment, plan downgrade, and grace-period reminders. You will not receive marketing emails; deleting your account stops all email.
Cookies & Local Storage
We use only the storage required to run the Service: a login session cookie (httpOnly, unreadable to scripts) and a CSRF-protection cookie, plus a short-lived language cookie during Google sign-in. Language, theme, guide state, and workspace data (phone lists, generated links, send progress) are kept in your browser’s local storage. We use no advertising cookies and no cross-site tracking.
Third-Party Services
The Service relies on: Stripe and BEPUSDT (payments), Google (optional sign-in), the AI platforms configured by the administrator (copywriting and translation), Sentry (error monitoring — emails, phone numbers, and other sensitive fields are automatically masked in logs), our SMTP email provider, and cloud hosting infrastructure. Each receives data only as necessary to provide the feature and handles it under its own privacy policy.
Data Retention
While your account exists we keep your account information and order records; AI and operation history is retained on a rolling window capped by your plan, with older entries deleted automatically; plaintext numbers in send tasks are erased when the task ends. Deleting your account permanently removes this data, including orders and points history, and it cannot be recovered.
Data Security
All traffic is served over HTTPS; passwords are stored as bcrypt hashes; APIs use JWT sessions (httpOnly cookies), CSRF double-submit protection, and rate limiting; sensitive fields in logs are automatically masked; changing your password immediately invalidates all signed-in sessions. No internet transmission can be guaranteed absolutely secure, so please keep your credentials safe.
Your Rights
Under Profile → Account Settings you can view and correct your information, export all of your account data as a JSON file, or permanently delete your account and all of its data (effective immediately and irreversibly); if your account has been suspended, contact us by email instead. To exercise other rights (correction, restriction, complaint), email [email protected]; we respond within 30 days.
Minors & Policy Updates
The Service is not directed at users under 16. If you are a guardian and believe your child has provided personal information, contact us and we will delete it. Material changes to this policy will be announced on-site or by email; the date shown on this page reflects the latest update, and continued use constitutes acceptance.