Privacy Policy

Last updated: 26 April 2026

1. Information We Collect

Account Information: When you sign up via Google, we collect your email address, name, and profile picture URL.

WhatsApp Session Data: When you link your WhatsApp account, we cache the messages of the groups and DMs you have not muted, so we can produce digests. We do not access muted groups.

Generated Data: AI-generated digest summaries, action items extracted from messages, your status updates (pending/snoozed/resolved/dismissed) on those items.

Usage Data: Login history, sync timestamps, action item update events, dashboard interactions.

Payment Information: Payment details are securely processed through our payment provider. We do not store full credit card numbers.

2. How We Use Your Information

We use the collected information to:

• Run daily AI-powered digests of your WhatsApp groups and DMs
• Identify tasks, follow-ups, customer asks, and personal reminders
• Maintain your account, schedule, and dashboard preferences
• Process your subscription billing
• Improve service reliability and detect abuse
• Communicate service-related notifications (rare; not marketing)

We do not use your messages to train AI models, nor do we sell or share your data with advertisers.

3. Data Storage and Security

Database: Supabase Postgres, encrypted at rest, hosted on AWS.

WhatsApp Session: Stored encrypted on a Railway persistent volume isolated to your worker. No other user has access.

Transit: All data transmitted over TLS 1.3.

Retention: Cached message bodies are retained for 90 days then automatically purged. Digest summaries and action items are retained until you delete them or delete your account. Account metadata is kept until deletion or 12 months of inactivity, whichever is sooner.

4. Third-Party Services

We use the following third-party services to operate WhatsApp Wizzard:

• Google (sign-in via OAuth)
• Supabase (database + authentication, hosted on AWS)
• Anthropic Claude (AI summarisation — your messages are processed under Anthropic's no-training-on-customer-data default policy)
• Railway (hosting your private worker)
• Razorpay / Stripe (payment processing)

All sub-processors are bound by data processing agreements consistent with applicable privacy laws.

5. Your Rights

You have the right to:

• Access and download all your data (Settings → Export)
• Correct inaccurate data (Settings → Profile)
• Delete your workspace at any time (Settings → Danger Zone). Every record is removed within 60 seconds.
• Opt-out of marketing communications
• Object to data processing in certain circumstances

6. Data Sharing

We do not sell your personal data. We may share data only in these circumstances:

• With your explicit consent
• To comply with legal obligations or court orders
• To protect our rights, prevent fraud, or stop abuse
• With sub-processors (listed in Section 4) under strict data processing agreements

7. Cookies and Tracking

We use cookies and browser local storage to maintain your login session and remember dashboard preferences. We do not use third-party advertising trackers. You can clear cookies via your browser settings — doing so will sign you out.

8. Children's Privacy

WhatsApp Wizzard is not intended for users under 18. We do not knowingly collect personal information from children. If you believe we have collected data from a child, contact us at support@myultralabs.com immediately.

9. WhatsApp Linking — Important Disclosure

WhatsApp Wizzard connects to your WhatsApp account using the same linked-device protocol that WhatsApp Web uses. Our worker is a Chromium browser running on a server that you've authorized as a linked device. This is not officially endorsed by WhatsApp; their Terms of Service technically restrict third-party automation of WhatsApp Web.

What this means for you:

• Your messages stay end-to-end encrypted between you, your contacts, and your linked devices. WhatsApp's servers never see your message content. Our worker receives them in the same encrypted-then-decrypted-locally way your phone does.
• WhatsApp may temporarily restrict Web access on your number if their automated systems detect unusual patterns. Restrictions usually clear within 24-72 hours and don't affect your ability to use WhatsApp on your phone. Brand-new or rarely-used WhatsApp accounts are at higher risk.
• To minimise risk, our worker connects only briefly — for the daily digest run (~2-3 minutes) and on-demand syncs you trigger. It is not online 24/7.
• You can unlink at any time by deleting your workspace from the dashboard or by removing the linked device from your WhatsApp app (Settings → Linked Devices).

For a more detailed explanation of the linking risk, see our Security page.

10. Changes to Privacy Policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or through the service. Continued use after changes constitutes acceptance.

11. Contact Us

For privacy questions or to exercise your data rights:

• Email: support@myultralabs.com
• WhatsApp: +91 98181 09443