Privacy Policy — Android app

1. What stays on your phone

The lists you message and the messages themselves never reach our servers. They are held in the app's own storage on your device and are destroyed when you uninstall it:

• Phone contacts read with the READ_CONTACTS permission, after you grant it.
• Contact lists you import from CSV or Excel files.
• Campaigns, message text, attachments, delivery reports and your unsubscribe list.
• The credentials that link the app to your WhatsApp account, held in Android's encrypted storage.

We do not sell or rent any of it. Nothing in WB Bulk Sender & Group Manager sends your contacts or your message content to our servers or to any third party. The one optional feature that sends anything to an AI service, the in-app assistant, is described in section 3, together with exactly what it sends.

2. What we do collect

The app requires an account, and an account means we hold the following on our servers:

• Account details — your email address, plus your name and Google account identifier if you sign in with Google. If you sign in with a password we store a one-way hash of it, never the password itself. An optional phone number, country and language preference are stored if you supply them.
• Purchase records — for a premium unlock: the Google Play product id, purchase token, Play order id, purchase state and purchase date. These come from Google Play rather than from your device, and they are what lets us confirm that a purchase the app claims is real.
• Entitlement state — when your free trial started and expires, whether premium is active, and when it was granted or revoked.
• Email choices — whether you ticked the offers box when you signed up, and when; whether you have unsubscribed; and a record of each paywall email we sent you, with its kind and date. See section 6.
• Support messages — if you use the in-app support form: the category you pick, the message you write, the callback number you enter, and the app version, messaging-engine version, platform and plan tier at the moment you send it. Those technical values travel with the report so we can reproduce a bug without asking you to look them up.
• Assistant usage — if you use the in-app assistant: a weekly count of the questions you asked, content-free usage events (where the assistant was opened from, which suggested screen was tapped, the app language), and any answer you choose to report. See section 3.
• Plan and usage events — which upgrade screens were opened and what was chosen on them, purchase attempts that did not finish (cancelled, failed or pending), when a campaign paused because the plan's message allowance ran out, and the app's daily usage counts (messages sent on the trial, groups saved, group posts), and which setup steps you completed the first time (the messaging engine download, linking your account, your first list and campaign) with a short reason when one failed. Each event carries your plan tier and the app version. Never message text, contacts or phone numbers. We use them to understand how setup, the trial and the plans work for people. A purchase that did not finish is also what triggers the help email in section 6.
• Anonymous first-run counts — before you sign in, the app adds one to a daily count when it first opens the welcome tour, finishes it, reaches the sign-in screen, or fails to sign in (with a short reason such as a cancelled sign-in). The count is kept per app version only: no account, no device identifier and no IP address is stored with it.
• Technical data — the IP address of a request, used to rate-limit our own API so that one client cannot flood it. We do not build a profile from it and we do not use it for advertising.

There is no advertising SDK, no analytics SDK and no crash-reporting SDK in this app. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

3. The optional AI assistant

Ask WB Sender, the in-app assistant, answers questions about using the app. It is optional: nothing is sent unless you type a question.

• What is sent — your question, the earlier messages of that conversation, and fixed codes and counts the app reads on your phone so the answer fits your account: for example your plan and trial status, how many campaigns are running or stopped and a code for why, and whether WhatsApp is connected. Never the names, numbers or message text of your contacts or campaigns.
• Where it goes — through our server to OpenRouter, which passes it to the AI provider that writes the answer. Our server does not store your question or the answer; it keeps only the weekly count and usage events listed in section 2.
• What the AI providers may keep — they never use your questions to train AI models. They may keep them for up to 30 days for abuse and safety checks, and then delete them.
• Before you sign in — the assistant on the sign-in screen has a daily limit per network. The network's address is scrambled with a key that changes every day, so the address itself is never stored.
• Reported answers — if you report an answer, the question and the answer are sent to us and kept for up to 180 days so that we can review them.

4. Permissions the app asks for, and why

• INTERNET — sign in, verify a purchase, download the messaging engine, send your messages.
• READ_CONTACTS — offered only when you choose to build an audience from your phone contacts. Refuse it and the rest of the app still works; you can import a file instead. Contacts are read on the device and stay there.
• POST_NOTIFICATIONS — progress and result notifications for a running campaign.
• FOREGROUND_SERVICE and FOREGROUND_SERVICE_SPECIAL_USE — a campaign keeps sending while the screen is off. Android requires a visible ongoing notification for that, which is why you see one.
• WAKE_LOCK — keeps the device awake for the length of a send, so a campaign is not cut in half by the screen locking.
• SCHEDULE_EXACT_ALARM — a campaign you schedule for a specific time starts at that time.
• RECEIVE_BOOT_COMPLETED — a schedule you set survives a reboot.
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS — optional, and only ever a prompt you can decline. Some manufacturers kill background work aggressively enough to stall a long campaign.

File imports go through Android's document picker, so the app receives only the single file you choose and never gains access to your storage.

5. Who else is involved

• Google Play Billing — processes the purchase and tells us whether it succeeded. We never see your card details. Google also notifies us when a purchase is later refunded or charged back.
• Google Sign-In — optional. If you use it, Google gives us your email address, your name and a stable account identifier.
• Cloudflare (cdn.sendbulkwhats.com) — serves the messaging engine the app downloads on first run. It is a static file download; nothing about you is sent with it.
• Amazon Web Services (Amazon SES, Mumbai region) — our main email provider. It delivers the emails we send you: sign-in codes, replies to your support messages, the confirmation when you delete your data, notices about purchases and affiliate payouts, and the Premium emails in section 6. It receives your email address, the email's content, and its sending details.
• Resend (United States) — our backup email provider. We use it only when Amazon SES cannot deliver an email, for example during an outage, and it then receives that one email the same way.
• OpenRouter and the AI providers it routes to — used only when you ask the assistant a question (section 3). They process it on our behalf to write the answer, never train AI models on it, and keep it for no more than 30 days.
• WhatsApp / Meta Platforms, Inc. — the app drives your own WhatsApp account. Your use of WhatsApp is governed by WhatsApp's own terms and privacy policy, not by this one. We are not affiliated with, endorsed by or connected to WhatsApp LLC or Meta Platforms, Inc.

6. Emails we send you

Besides the account and purchase emails in section 5, we send two kinds of email about a Premium purchase. We send them only when a purchase in the app did not finish, and only to accounts without an active Premium plan. Each kind is sent at most once every 30 days. Opening the Premium screen sends nothing.

If you tap Email me help on the Premium screen, we send the help email when you ask for it, at most three times a day. It contains no offers.

• Help with a purchase — sent when a purchase did not finish: it failed, was pending, showed as already owned, the payment sheet did not open, or you cancelled it. It offers help finishing the purchase, a note on restoring a purchase you already made, and a way to reach us. It contains no offers. It goes to accounts that did not tick the offers box below and have not unsubscribed.
• Offers — only if you ticked the box at sign-up that says you want offers and news by email. The box is unticked when you start, and signing up does not depend on it. These emails are about WB Sender AI, our desktop app for Windows. It is a separate product with its own licence, and it is not sold in this app. They do not repeat the help above. They stop when you unsubscribe. If you tick the box again later, they start again. If you open Premium before you tick, you may get the help email first and an offers email later, both within 30 days.

Each of these emails has an unsubscribe link. Using it stops both kinds, and we record that you have unsubscribed. You can also write to us (section 12) and we will stop them for you.

We do not send WhatsApp messages to anyone yet. The offers box is one tick and names WhatsApp as well as email. Until we send WhatsApp offers, the tick does nothing for WhatsApp. Before the first WhatsApp offer goes out, this policy will say so.

We keep a record of each email this section describes, with its kind and date, so that we can keep to the 30-day limit and answer questions about what we sent. It is kept with your account and deleted when you delete your account.

7. Deleting your account and data

You can erase everything we hold, and there are two ways to do it:

• From inside the app — open Settings and tap Delete account. This is immediate and needs no verification email, because you are already signed in.
• From the web — if you have already uninstalled the app, use our account deletion page. That form is not signed in, so it deliberately deletes nothing by itself: a person verifies that the address is yours and then processes it, within seven days.

Deletion removes your account, your sign-in details, your entitlement and trial record, your Google Play purchase record, any support messages you sent, and your assistant usage records and reported answers, your email choices, and the record of paywall emails we sent you. It cannot be undone, and signing in again later creates a brand-new account with no trial left to spend.

Where a purchase was invoiced by us rather than by Google Play, the invoice is retained for tax and accounting purposes with your name and email address replaced by a non-routable placeholder, so the record no longer identifies you. An account enrolled in our affiliate programme cannot be self-deleted, because its records are somebody else's earnings; write to [email protected] and we will close it by hand.

8. How long we keep it

Account, entitlement and purchase records are kept for as long as the account exists, because they are what the app reads to decide whether you have paid. Support messages are kept while they are still useful for answering you. Reported assistant answers, and the plan and usage events, are kept for up to 180 days. Your email choices and the record of paywall emails are kept for as long as the account exists. All of it goes when you delete the account, subject only to the de-identified financial records described above.

9. Security

The app talks to our servers over HTTPS only — plain-text connections are disabled in every release build. Your session credential is held in Android's encrypted storage, and passwords are stored only as a one-way hash. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

10. Children

The app is a business tool and is not directed at children. We do not knowingly collect personal information from children. You must be at least 16 years old to consent to the processing of your personal information, or older where your country requires it. If you believe a child has given us personal information, write to us and we will remove it.

11. Changes to this policy

We may update this policy. The date at the top of this page is the date of the version you are reading, and the current version always lives at this URL — which is also the address filed with Google Play, so it does not move.

12. Contact us

Write to [email protected], use the in-app support form, or use the contact page. Postal address: SCS Technolabs, Vadakara, Koothattukulam, Kerala, India – 686662.