Privacy Policy

1. Who we are

Smallution Limited, (“we”) operates WhatSmall. We are the controller of your account data. For the content of your WhatsApp archive we act as your processor (service provider) and handle it only on your instructions. Contact: [email protected].

This policy is designed to meet the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and, where it applies, the EU/UK GDPR.

2. What we collect

Account and technical data:

• email address, password (stored in a protected, non-readable form), language, and the time you accepted our Terms;
• sign-up IP address, and IP address and browser/user-agent of your login sessions, used for security and abuse prevention;
• email verification and password reset tokens (stored hashed);
• referral data: your personal referral code, and if you sign up with someone's code, the link between you and that person so that rewards can be given. The person who referred you can see how many people used their code, but not who they are.

WhatsApp data, once you link an account:

• the phone number of the linked account and the label you give it;
• a session credential that keeps the linked device connected (encrypted at rest, see Security);
• your contacts' names, phone numbers and WhatsApp display names, your chat list and group names;
• messages in your chats: text, captions, type, timestamp, sender, and edited/deleted status;
• media files in your chats (photos, videos, voice notes, documents, stickers), within a storage allowance shared by all your linked numbers (100 MB per active number plus any storage you buy or are given), encrypted at rest and held with our object-storage provider. You can delete media per chat at any time.

Billing data:

• Stripe customer and subscription identifiers and, for each payment, the invoice ID, amount, currency, status and a link to the Stripe invoice. Card details are handled by Stripe and never reach our servers.

We do not run advertising or analytics trackers on the Service.

3. Other people's data in your archive

Your archive contains messages and details of other people. You decide what to link and keep, and you are responsible for having a lawful basis to do so. We process that content only to provide the Service to you, do not use it for our own purposes, and do not read it. Our admin tools show statistics and account status, not message content.

4. How and why we use data

• To provide the Service: authentication, linking your device, syncing, showing, searching and exporting your archive (performance of our contract with you).
• To take payment and manage subscriptions (contract; legal obligations).
• To keep the Service secure and prevent abuse, including bot protection and rate limiting (legitimate interests).
• To communicate with you: verification, password reset, essential service and billing notices (contract; legitimate interests).
• To comply with law and enforce our Terms (legal obligation; legitimate interests).
• We access message content only if you ask us for support, to investigate a security incident, or where the law compels us.

5. We do not sell your data

We do not sell or rent personal data, do not use your messages for advertising, and do not use them to train AI models.

6. Who we share data with

We use the following categories of service providers, who process data only for us and under contract:

• hosting and infrastructure provider (servers and database) — [provider name, region];
• Stripe, Inc. — payment processing and invoices;
• Cloudflare, Inc. — file storage, delivery and protection against automated abuse;
• email delivery provider — verification and notification emails — [provider name];
• encrypted backup storage provider — [provider name, region].
• We may also disclose data when required by law, court order or to protect rights, safety and security.

7. International transfers

Our providers may process data outside your country, including outside Hong Kong and the EEA/UK. Where required we rely on appropriate safeguards such as standard contractual clauses.

8. Retention

• Account data: kept while your account exists.
• Media files: kept for the period you choose (default 30 days; options 7 days, 30 days, 90 days, 1 year, forever, or never save), set as a default for your account, then per WhatsApp number and per chat, then deleted automatically.
• WhatsApp archive (text): kept until you delete it (per account or by deleting your whole account), or for the retention period we configure, if any. Deleting removes it from live systems immediately.
• Linked-device credentials: deleted as soon as you unlink, you are logged out by WhatsApp, or you delete the account.
• Backups: we keep encrypted backups for up to 35 days. Data you delete may therefore remain in backups until they expire; backups are not used except to restore the Service after a failure.
• Security and audit logs: kept for up to 12 months.
• Invoices and tax records are retained by Stripe for as long as the law requires.

9. Security

• Data is encrypted during transmission.
• Passwords are stored in a protected, non-readable form. Account connection details and saved files are encrypted in storage.
• Backups are encrypted before they leave our servers.
• Access to production systems is restricted and logged. Administrative actions are recorded in an audit log.
• No system is perfectly secure. If a breach is likely to harm you we will notify you and the authorities as required by law.

10. Your rights

Depending on where you live (including under the PDPO and GDPR) you can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent. Most of this you can do yourself: export any chat or your whole archive in TXT/CSV/JSON, unlink devices, delete archives, change your password and delete your account in the dashboard.

For anything else write to [email protected]. We respond within the period required by law (generally within 30 days; no later than 40 days under the PDPO). You may also complain to the Office of the Privacy Commissioner for Personal Data (Hong Kong) or your local data protection authority.

11. Cookies and local storage

We use essential cookies to keep you signed in. Our bot-protection provider may use strictly necessary cookies or storage to distinguish people from automated requests.

We also set two first-party cookies to understand how people find WhatSmall: a random visitor id (kept up to 12 months) and the campaign or website that last brought you here, such as a search engine or a tagged link (kept up to 90 days). We record which channel a visit came from and, when you sign up, store that channel with your account. These cookies are not shared with anyone and are not used for advertising. We do not use third-party analytics or advertising cookies.

12. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children. Contact us if you believe a child has registered and we will delete the account.

13. Changes

We will post changes here and, for material changes, notify you by email or in the Service before they take effect.

14. Contact

Smallution Limited, — [email protected]