Privacy Policy — Android app

1. What stays on your phone

The lists you message and the messages themselves never reach our servers. They are held in the app's own storage on your device and are destroyed when you uninstall it:

• Phone contacts read with the READ_CONTACTS permission, after you grant it.
• Contact lists you import from CSV or Excel files.
• Campaigns, message text, attachments, delivery reports and your unsubscribe list.
• The credentials that link the app to your WhatsApp account, held in Android's encrypted storage.

We do not upload, copy, sell, rent or analyse any of it, and we cannot read it. Nothing in WB Bulk Sender & Group Manager sends your contacts or your message content to our servers or to any third party.

2. What we do collect

The app requires an account, and an account means we hold the following on our servers:

• Account details — your email address, plus your name and Google account identifier if you sign in with Google. If you sign in with a password we store a one-way hash of it, never the password itself. An optional phone number, country and language preference are stored if you supply them.
• Purchase records — for a premium unlock: the Google Play product id, purchase token, Play order id, purchase state and purchase date. These come from Google Play rather than from your device, and they are what lets us confirm that a purchase the app claims is real.
• Entitlement state — when your free trial started and expires, whether premium is active, and when it was granted or revoked.
• Support messages — if you use the in-app support form: the category you pick, the message you write, the callback number you enter, and the app version, messaging-engine version, platform and plan tier at the moment you send it. Those technical values travel with the report so we can reproduce a bug without asking you to look them up.
• Technical data — the IP address of a request, used to rate-limit our own API so that one client cannot flood it. We do not build a profile from it and we do not use it for advertising.

There is no advertising SDK, no analytics SDK and no crash-reporting SDK in this app. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

3. Permissions the app asks for, and why

• INTERNET — sign in, verify a purchase, download the messaging engine, send your messages.
• READ_CONTACTS — offered only when you choose to build an audience from your phone contacts. Refuse it and the rest of the app still works; you can import a file instead. Contacts are read on the device and stay there.
• POST_NOTIFICATIONS — progress and result notifications for a running campaign.
• FOREGROUND_SERVICE and FOREGROUND_SERVICE_SPECIAL_USE — a campaign keeps sending while the screen is off. Android requires a visible ongoing notification for that, which is why you see one.
• WAKE_LOCK — keeps the device awake for the length of a send, so a campaign is not cut in half by the screen locking.
• SCHEDULE_EXACT_ALARM — a campaign you schedule for a specific time starts at that time.
• RECEIVE_BOOT_COMPLETED — a schedule you set survives a reboot.
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS — optional, and only ever a prompt you can decline. Some manufacturers kill background work aggressively enough to stall a long campaign.

File imports go through Android's document picker, so the app receives only the single file you choose and never gains access to your storage.

4. Who else is involved

• Google Play Billing — processes the purchase and tells us whether it succeeded. We never see your card details. Google also notifies us when a purchase is later refunded or charged back.
• Google Sign-In — optional. If you use it, Google gives us your email address, your name and a stable account identifier.
• Cloudflare (cdn.sendbulkwhats.com) — serves the messaging engine the app downloads on first run. It is a static file download; nothing about you is sent with it.
• Our email provider — delivers sign-in codes and support correspondence to your address.
• WhatsApp / Meta Platforms, Inc.— the app drives your own WhatsApp account. Your use of WhatsApp is governed by WhatsApp's own terms and privacy policy, not by this one. We are not affiliated with, endorsed by or connected to WhatsApp LLC or Meta Platforms, Inc.

5. Deleting your account and data

You can erase everything we hold, and there are two ways to do it:

• From inside the app — open Settings and tap Delete account. This is immediate and needs no verification email, because you are already signed in.
• From the web — if you have already uninstalled the app, use our account deletion page. That form is not signed in, so it deliberately deletes nothing by itself: a person verifies that the address is yours and then processes it, within seven days.

Deletion removes your account, your sign-in details, your entitlement and trial record, your Google Play purchase record and any support messages you sent. It cannot be undone, and signing in again later creates a brand-new account with no trial left to spend.

Where a purchase was invoiced by us rather than by Google Play, the invoice is retained for tax and accounting purposes with your name and email address replaced by a non-routable placeholder, so the record no longer identifies you. An account enrolled in our affiliate programme cannot be self-deleted, because its records are somebody else's earnings; write to [email protected] and we will close it by hand.

6. How long we keep it

Account, entitlement and purchase records are kept for as long as the account exists, because they are what the app reads to decide whether you have paid. Support messages are kept while they are still useful for answering you. All of it goes when you delete the account, subject only to the de-identified financial records described above.

7. Security

The app talks to our servers over HTTPS only — plain-text connections are disabled in every release build. Your session credential is held in Android's encrypted storage, and passwords are stored only as a one-way hash. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8. Children

The app is a business tool and is not directed at children. We do not knowingly collect personal information from children. You must be at least 16 years old to consent to the processing of your personal information, or older where your country requires it. If you believe a child has given us personal information, write to us and we will remove it.

9. Changes to this policy

We may update this policy. The date at the top of this page is the date of the version you are reading, and the current version always lives at this URL — which is also the address filed with Google Play, so it does not move.

10. Contact us

Write to [email protected], use the in-app support form, or use the contact page. Postal address: SCS Technolabs, Vadakara, Koothattukulam, Kerala, India – 686662.