RWhatsApp Sales Support

Privacy Policy

WhatsApp Sales Support — Chrome Extension
Last updated: August 10, 2026

Overview

This Privacy Policy describes how the WhatsApp Sales Support Chrome extension ("the Extension") handles data. The Extension helps sales and support teams look up orders, place new orders, and sync WhatsApp Web conversations into their own CRM. It is published by Redefine.

What data the Extension accesses

To do its job, the Extension reads the following from your active WhatsApp Web tab (https://web.whatsapp.com):
  • The contact name and phone number of the chat currently open
  • Message text and timestamps of the currently open conversation
  • Metadata such as chat labels, unread state, and last-message time
The Extension never reads chats you are not actively viewing, never accesses media (images, audio, video), and never scrapes your full WhatsApp contact list.

Where data is sent

The Extension sends the data described above only to the destinations you configure. Supported destinations:
  • Redefine Partner Portal — an instance URL that you provide, used for leads, orders, tickets, and companies/staff records. The Extension authenticates via Firebase Auth ID tokens (email + password) that are verified server-side by the portal.
  • HubSpot — a private-app access token that you provide.
  • Custom webhooks — a URL you provide (Zapier, Make, n8n, or your own endpoint).
  • Shopify — via OAuth. You approve access at your store's admin. The Extension does not store your Shopify access token; the token lives in the Partner Portal's Supabase database, keyed to your company row. The Extension calls the portal's proxy endpoints to look up products/orders/customers and place orders.
  • WooCommerce — via WooCommerce's Auth REST API. Same pattern: consumer key/secret are stored in the Partner Portal, not in the Extension.
We do not operate any intermediate server other than the Redefine Partner Portal you configure. Data flows from your browser to that portal (which you or your organization operates). If you configure no destination, no data leaves your browser.

Local storage

The following is stored locally in your browser via the Chrome Storage API (chrome.storage.local):
  • Your account authentication tokens (Firebase ID token + refresh token) after you sign in
  • Your CRM / store configuration (portal URL, HubSpot token, webhook URLs, store selection)
  • A short-lived cache of matched leads and orders (to avoid re-querying)
  • Your UI preferences (quick replies, tags, active tab)
This data never leaves your browser except when synced to the destinations you configured. Uninstalling the Extension clears it.

What we do NOT do

  • We do not collect analytics or telemetry from users.
  • We do not sell, rent, or share your data with third parties.
  • We do not use your data for advertising or profiling.
  • We do not access any tab other than WhatsApp Web.
  • We do not transmit or persist Shopify / WooCommerce access tokens on the client — they live on the Redefine Partner Portal server-side only.

Permissions justification

  • host_permissions: https://web.whatsapp.com/* — required to read the active WhatsApp Web tab and render the sidebar.
  • host_permissions: https://*.amazonaws.com/* — required to display product / order thumbnails hosted on S3 that the portal references.
  • optional_host_permissions: https://*/* — requested at runtime only when you configure a portal, HubSpot, or webhook URL. Chrome shows a permission prompt each time; the Extension does not have blanket web access.
  • permissions: storage — required to remember your configuration and cache lead data between sessions.
  • permissions: activeTab — required to detect the WhatsApp Web tab and read the chat you are viewing.

Security

  • All traffic to CRM and store destinations uses HTTPS.
  • Account tokens (Firebase ID token, refresh token), CRM tokens, and webhook secrets live only in your browser's chrome.storage.local and are never transmitted anywhere except the destination you configured.
  • Shopify OAuth tokens and WooCommerce consumer keys are held server-side in the Redefine Partner Portal's Supabase database, not in the Extension.
  • You can revoke access at any time by clearing settings in the Extension or by uninstalling it. For Shopify, you can also uninstall the app from your Shopify admin; for WooCommerce, you can revoke the key from Woo → Settings → Advanced → REST API.

Children

The Extension is not directed at children under 13 and is not intended for consumer WhatsApp accounts; it is a business/CRM tool.

Changes to this policy

If we materially change how the Extension handles data, we will update this page and update the "Last updated" date above. Continued use of the Extension after changes means you accept the new policy.

Contact

For any questions about this privacy policy, contact us at shekh@atlan.com.
© 2026 Redefine. All rights reserved.