Privacy Policy — LeadZap

Last updated: October 7, 2026

LeadZap ("we", "our") is a browser extension (Chrome) that lets you export contacts, chats and groups from WhatsApp Web to CSV, XLSX, JSON and vCard files, with a free plan and Pro subscription plans. This policy explains what data we process, why, and what rights you have over it.

Data controller: Marcos Romualdo dos Santos.
Contact: suporte@leadzap.online

1. The core principle: your chats never leave your browser

Extraction of contacts, chats and groups happens entirely inside your browser, reading the data that WhatsApp Web itself has already loaded in your session. The content of your chats, your contacts and the member lists of your groups are never sent to, stored on or processed by any LeadZap server. The exported file (CSV, XLSX, JSON or vCard) is generated locally and downloaded straight to your computer.

This means we do not have access to, do not see and do not keep the content of what you export.

For the "export only new" feature, the extension keeps in your own browser (the extension's local storage) the list of who has already been exported from each group, chat or contact list, with the date of the last export. This list is never sent to our server and is deleted if you remove the extension.

2. What we actually collect

Because the product has a paid plan (recurring subscription), some administrative data goes through our backend:

When you subscribe to a Pro plan: email and payment details, processed directly by Stripe (our payment processor) — we do not store card numbers or sensitive financial data on our servers.
License key: when you activate a Pro license in the extension, we store the key, the plan purchased, the expiration/renewal date, an anonymous browser identifier (device ID) and a record of when the license was checked. This is only used to confirm that your subscription is active.
Email linked to the subscription: used to find your license in the Customer Portal and for communications about the subscription (confirmation, renewal, cancellation).
Customer Portal sign-in: to confirm that you own the email address, we send you an access code. We keep the code (encrypted) and the IP address of whoever requested it, only to prevent abuse, and delete this data within 1 day. After you sign in, an access session stays valid for 30 days in that browser.
Anonymous export count: on each export, the extension sends our server only the type (contacts, chats or groups), the file format, the number of items, whether messages were included, whether a Free-plan group hit the participant limit or a contacts export hit the Free cap (yes/no, without saying which group or which contacts), the extension language, the plan (Free or Pro) and the extension version. These numbers are added up per day, with no IP address, no browser identifier, no license key and nothing from the exported content, so there is no way to tell who exported. The total of exported items may appear on the website as social proof (“X contacts already exported”), still without identifying anyone.
Anonymous install count: when the extension is installed, it tells our server only the browser (Chrome, Edge or Opera), the language and the version. When it is removed, the browser opens a page of ours that records the same and, if you want, the reason you choose. The approximate country is worked out from the IP address at that moment, and the IP is not stored. These numbers are added up per day, with no browser identifier and no license key.
Anonymous link-generator count: on the free wa.me tool pages, the site tells our server only the action (open the page, copy the link, test, download the QR or click install), the page language, the country chosen in the selector and whether a ready-made message was present (yes/no). The number you type and the message text never leave the browser. These numbers are added up per day, with no IP address and no identifier.
Basic backend technical data: as with any web server, standard access logs (IP, date/time, user agent) may be kept for a limited time, for security and troubleshooting.
Country for the price currency: on the website, in the Customer Portal and when opening checkout, our server looks up your approximate country from the IP address in a database installed on the server itself (IP Geolocation by DB-IP), to show the right currency (Brazilian real only for visitors in Brazil, euro in the eurozone, US dollar elsewhere). The IP isn't sent to anyone or stored; the chosen currency is saved only in your browser and you can change it at the top of the website.

We do not collect: message content, contact lists, third-party phone numbers, group names or any data the extension exports — these stay only on your computer.

3. Why we process this data

To enable recurring billing of the subscription (via Stripe).
To check whether a license key is active and linked to your Pro plan.
To provide support when you contact us.
To show prices in your country's currency.
To know, in aggregate numbers, which features and formats are used the most, so we can improve the extension.
To comply with legal obligations (e.g. tax) related to billing.

We do not use your data for advertising, we do not sell data to third parties and we do not build behavioral profiles for marketing purposes.

4. Who we share data with

Stripe (payment processing and billing) — receives email and payment details directly; see Stripe's privacy policy.
Google Analytics (Google) — only on the website and the Customer Portal: visit statistics (pages viewed, approximate country, device type, clicks on plans). See Google's privacy policy.
Hosting provider of the backend (storage of licenses and the associated email).
Authorities, only if required by law or court order.

We do not share data with advertisers or data brokers.

5. How long we keep your data

For as long as your subscription is active, and for a reasonable period after cancellation for tax and support purposes (e.g. payment history). You can request deletion of your administrative data (email, license) at any time through the contact above, subject to legal obligations to retain tax records.

6. Your rights

Whether under the LGPD (Brazilian Law 13,709/2018, if you are in Brazil) or the GDPR (if you are in the European Union/United Kingdom), you have the right to:

Confirm whether we process your data and access it;
Correct incomplete or outdated data;
Request deletion of your administrative data;
Request data portability;
Withdraw consent and object to specific processing;
Know who we share your data with.

To exercise any of these rights, write to suporte@leadzap.online.

7. Cookies and similar technologies

The LeadZap website (leadzap.online) and the Customer Portal may use cookies that are strictly necessary for them to work (e.g. keeping your session in the Stripe checkout). We do not use advertising tracking cookies.

The website and the Customer Portal also use Google Analytics to measure visits: how many people visit, where they come from (approximate country and referring site), which pages they view and whether they click on the plans or complete a subscription. We do not send Google your email, your license key or anything the extension exports, and Google's advertising cookies stay off. We do this based on our legitimate interest in understanding how the site is used and improving it. Google keeps this data for up to 14 months. You can opt out at any time through the "Cookies" link in the website footer: from then on no Google Analytics cookies are stored and the site only sends anonymous signals that do not identify your browser. The extension itself does not use Google Analytics.

8. Children

LeadZap is not directed at people under 18 and we do not knowingly collect data from children. If we find that this has happened, we will delete the data as soon as possible.

9. Security

We adopt reasonable technical and organizational measures to protect the administrative data we process (license keys, email), but no system is 100% immune to incidents. Since the content of your chats never reaches our servers, the main exposure risk related to WhatsApp itself remains under the control of WhatsApp/Meta, not ours.

10. Changes to this policy

We may update this policy from time to time. Relevant changes will be communicated by email (if we have yours) or by a notice on the website, with the "last updated" date revised.

11. Contact

Questions, requests about your data or any privacy matter: suporte@leadzap.online