Official privacy policy and user data disclosures.
SamparkWA is engineered by Trustoryx under a strict 100% local-first privacy model. Your customer contacts, message templates, and campaign history reside exclusively on your physical computer.
No remote database or sync servers exist. Customer data stays in sandboxed browser IndexedDB.
We never sell, rent, monetize, or barter personal information with brokers or advertisers.
No Google Analytics, tracking pixels, or third-party telemetry SDKs are embedded in the extension.
Every message requires human confirmation in WhatsApp Web. Zero automated bulk bot spamming.
1. Developer and publisher identity
This Privacy Policy applies to the SamparkWA Chrome Extension (Manifest V3), engineered and published by Trustoryx ("Trustoryx", "we", "us", "our"), a digital verification, cybersecurity, and scam prevention ecosystem based in India.
2. Chrome Web Store single purpose statement
In strict adherence to Google Chrome Web Store Developer Program Policies, SamparkWA operates with a single, clear, and unified purpose:
"Assisting small business owners with local contact management, multilingual template preparation, and human-in-the-loop message staging on WhatsApp Web without automated spamming, cloud data storage, or account ban risks."
The extension requests only the minimum set of permissions necessary to execute this specific single purpose and performs no ancillary background data collection or unrelated functionality.
3. Data categories and processing practices
Exhaustive inventory of information processed by SamparkWA and how it is secured.
| Data Category | Origin / Ingestion | Persistence Location | External Exfiltration |
|---|---|---|---|
| Customer Phone Numbers & Names | Uploaded by user via local CSV spreadsheet or entered manually | Local IndexedDB sandboxed to extension origin | Zero. Never transmitted to Trustoryx or cloud servers |
| Message Templates & Drafts | Created by user or selected from default starter templates | Local IndexedDB and chrome.storage.local | Zero. Rendered into WhatsApp Web input box locally |
| Campaign Logs & Opt-Out Registry | Generated on-device during messaging runs or user opt-out entry | Local IndexedDB | Zero. Maintained on-device to prevent re-messaging |
| WhatsApp Private Chats & Incoming Messages | WhatsApp Web session | Not accessed or stored | Never scraped, read, or intercepted by SamparkWA |
| WhatsApp Authentication Credentials & QR Tokens | WhatsApp Web authentication | Not accessed or stored | Never accessed, captured, or transmitted |
| Browsing History & External Websites | Browser navigation | Not accessed or stored | Zero tracking. Only checks for web.whatsapp.com tab |
| Financial, Banking, or Biometric Data | N/A | Not collected | Zero collection |
4. Chrome Web Store permissions justification
Every permission declared in manifest.json is mapped to an essential, local-only function.
| Permission | Technical Justification & Need | Execution Scope |
|---|---|---|
| storage | Required to persist user preferences (business name, default country code, user settings), message templates, and opt-out registry locally inside chrome.storage.local and IndexedDB. All records remain on your local hardware. | Local browser storage only |
| tabs | Required to identify if an active web.whatsapp.com tab is currently open in the browser and bring it to focus when preparing customer messages. Prevents opening redundant tabs. Does not inspect, read, or record the contents, titles, or URLs of any other browser tabs. | Origin match web.whatsapp.com only |
| alarms | Required to provide non-blocking, periodic timer events (such as runner interval pacing and background session health checks) within the Manifest V3 service worker without maintaining continuous background execution, complying with Google's MV3 lifecycle guidelines. | Internal service worker timers only |
| host_permissions: https://web.whatsapp.com/* | Required to allow the content script (content.js) to inject the non-intrusive floating assistant dock into the user's active WhatsApp Web session and stage customer text into the message input field. Does not execute on or access any other domain. | Restricted strictly to web.whatsapp.com |
Adherence to Google User Data Policy
SamparkWA's use and transfer to any other app of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements:
- Single Purpose Delivery: We only use or transfer data to provide or improve prominent user-facing features that are essential to the extension's stated single purpose (local contact management and message preparation).
- No Third-Party Transfer: We do not transfer user data to third parties, except as strictly necessary to deliver the user-requested messaging functionality or to comply with applicable law.
- No Advertising Usage: We do not use or transfer user data to serve advertising, including personalized, retargeted, or interest-based advertising.
- No Creditworthiness or Lending: We do not use or transfer user data to determine creditworthiness or for lending purposes.
- Zero Human Reading: No human at Trustoryx has access to or reads customer records or drafted messages, unless explicitly authorized by the user for technical debugging or required by law.
6. Prohibited practices and commercial guarantees
- Zero Monetization of Data: We will never sell, rent, lease, trade, or exchange customer phone numbers, message texts, or contact lists with data brokers, advertisers, or corporate affiliates.
- No Remote Script Ingestion: In full compliance with Chrome Manifest V3, 100% of extension code (React, IDB, libphonenumber, icons, styling) is bundled locally within the extension zip package. No external scripts, CDNs, or
eval()executions are permitted. - No Browser Fingerprinting: We do not compute hardware or browser fingerprints, track IP addresses, or establish cross-site identifiers.
- No Scraping of Private Communications: SamparkWA content scripts never read incoming chat logs, personal messages, media files, or contact lists on WhatsApp Web.
7. Optional Official WhatsApp Cloud API module
For businesses that require automated bulk transmission beyond manual click-by-click dispatch, SamparkWA includes an optional, decoupled module that connects to Meta's official WhatsApp Business Cloud API:
- Direct Client-to-Meta Dispatch: API calls are initiated directly from your browser to Meta's Graph API endpoints (
graph.facebook.com). - Zero Intermediary Relays: Trustoryx does not operate an intermediate API gateway, proxy, or server. Your Meta System User Access Token and Phone Number ID are stored in your local browser sandbox and never shared with Trustoryx.
- Governed by Meta Platform Terms: Transmissions via the Cloud API module are processed by Meta's enterprise infrastructure and subject to Meta's Business Terms and WhatsApp Business Messaging Policies.
8. Data retention, portability, and right to erasure
You maintain sovereign control over your information at all times.
Data persists in your browser's IndexedDB indefinitely until you choose to modify it, export it, execute a factory reset, or uninstall the extension.
Download your complete contact database as a sanitized CSV spreadsheet or export all settings and templates as an unencrypted JSON backup file at any time.
In the Settings tab, clicking "Clear All Data" instantly and irreversibly wipes all IndexedDB tables. Because no copies exist in the cloud, deletion is immediate and total.
9. Global privacy compliance & user rights
A. European Union & UK GDPR Compliance
Under Regulation (EU) 2016/679 (GDPR), processing occurs on your own hardware for the performance of the service (Art. 6(1)(b)) and pursuant to your direct consent. You have full rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), data portability (Art. 20), and restriction of processing (Art. 18), all directly exercisable through the extension interface.
B. California Consumer Privacy Act (CCPA / CPRA)
We do not sell or share personal information as defined by California Civil Code § 1798.140. California residents may exercise their rights to know, delete, and non-discrimination without impediment.
C. India Digital Personal Data Protection Act (DPDP Act 2023)
In accordance with the DPDP Act 2023, data processing is strictly limited to the specified purpose authorized by the Data Principal (the user). All contact records reside locally on the Data Principal's device within Indian jurisdiction, and a grievance redressal channel is provided below.
D. Children's Online Privacy Protection Act (COPPA)
SamparkWA is a business productivity utility not intended for individuals under 18 years of age (and strictly prohibited for anyone under 13). We do not knowingly collect or solicit data from children.
10. Technical security standards
Inherited from Trustoryx's cybersecurity engineering standards, SamparkWA implements enterprise defense-in-depth:
=, +, -, @ are neutralized with prepended apostrophes to prevent malicious formula execution in Excel or Sheets.11. Grievance officer and contact inquiries
For privacy verifications, compliance audits, or data rights inquiries, please reach out to our dedicated office:
Your customer data remains on your computer.
Add to Chrome with zero cloud risk. Free forever.