Browser Extension

Privacy Policy for Pragmaz Extension

Last updated: 2026-05-18 · Effective as of 2026-05-18

Pragmaz ("we", "us", or "our") developed the Pragmaz browser extension (the "Extension") as a productivity tool for professionals who use WhatsApp Web. This Privacy Policy describes how the Extension collects, uses, stores, shares, and protects user data, in compliance with the Chrome Web Store User Data Policy, the LGPD (Brazil), GDPR (EU), and CCPA (California).

For information about data collected by the Pragmaz website and dashboard (pragmaz.ai), please refer to our website Privacy Policy.

1. Single Purpose

The Pragmaz Extension has a single, narrowly-scoped purpose: to provide professional productivity features (CRM Kanban, message templates, scheduled messaging, transcription, AI assistant, chatbot flow, broadcast lists) inside the WhatsApp Web interface (web.whatsapp.com) for business users with an active Pragmaz subscription. The Extension does not operate on or collect data from any other website.

2. Data We Collect

The Extension may collect the following categories of user data, only when necessary to deliver its features:

Category (Chrome Web Store)	What we collect	Purpose
Personally identifiable information	Email address, name (provided at subscription)	Account identification, license validation, support communication
Authentication information	License/activation code (unique key), session token	Validate active subscription; gate features behind the paywall
Financial and payment information	Limited billing metadata (we never see or store card numbers — all card data is handled exclusively by Stripe)	Subscription billing
Personal communications	WhatsApp messages, contact names, group metadata, media files (audio, image, video, document), labels, message status, timestamps. Processed locally in your browser by default. Specific items are sent to Pragmaz servers ONLY when explicitly required by a feature you trigger (see Section 4)	To render Kanban CRM cards, allow scheduling, send template broadcasts, automate replies (chatbot), transcribe audios, and analyze content with AI — strictly for the features you enable
Website content	WhatsApp Web DOM state needed to inject the Pragmaz UI (chat list, open conversation, toolbar)	Render Pragmaz features inside the WhatsApp Web page
User activity	Aggregated, anonymous feature usage events (which feature opened, error reports). No keystrokes, no message content.	Diagnose bugs, prioritize roadmap. Never used for advertising.

The Extension does NOT collect: browsing history outside web.whatsapp.com, passwords, payment card numbers, biometric data, health data, geolocation, or data from any website other than web.whatsapp.com.

3. Permissions Used (manifest.json)

Each Chrome permission requested by the Extension is justified strictly by a corresponding feature:

Permission	Why we need it
`storage`	Save user preferences, Kanban board layout, and offline cache locally inside the browser (chrome.storage.local).
`activeTab` / `tabs`	Detect when the user is on web.whatsapp.com and inject the Pragmaz interface only there.
`cookies`	Read the WhatsApp Web session cookie strictly to validate that the user is logged into WhatsApp Web (no cookie data is transmitted off-device).
`host_permissions: https://web.whatsapp.com/*`	Run content scripts inside WhatsApp Web only — no other domain is touched.
`notifications`	Show desktop notifications for scheduled-message delivery, chatbot triggers, or license expiration alerts.
`scripting`	Inject the Pragmaz UI into the WhatsApp Web page programmatically.
`alarms`	Trigger scheduled-message delivery at the time the user set.
`downloads`	Save exports requested by the user (e.g. CSV of contacts, JSON backup of Kanban) to their device.

4. How We Use Data

We use the data we collect solely to provide and improve the Extension's features:

Validate active subscription (license code → Pragmaz API).
Render local features (Kanban cards, message templates, scheduled queue) directly in your browser.
Process specific actions in our cloud only when you explicitly trigger them — for example: AI transcription of an audio message, AI reply generation, chatbot flow execution, broadcast delivery.
Send transactional notifications (license expiration, scheduled-message delivery confirmation).
Investigate and resolve bugs (error logs with the timestamp, browser version, and the feature that failed — no message content).

We do not use your data for advertising, ad targeting, profiling, or any purpose unrelated to delivering the features you subscribed to.

5. Where We Store Data and For How Long

Local storage (in your browser, never transmitted): Kanban configuration, message templates you authored, scheduled messages queue, user-interface preferences. Stored in chrome.storage.local and standard browser caches. Wiped automatically when you uninstall the Extension.

Cloud storage (Pragmaz servers, hosted on Google Cloud Platform — regions in Brazil and the United States):

License + subscription metadata: retained for the duration of your subscription plus 5 years thereafter (Brazilian tax law requirement).
Operational logs (anonymized error logs): retained for 12 months and then deleted.
Content sent to cloud-only features (AI transcription audio, AI prompts, chatbot conversation state): retained for up to 24 months to allow you to review history, then automatically deleted or anonymized. You can delete this data on demand from the Pragmaz dashboard.
After account cancellation: personal data is retained for 90 days (to allow recovery) and then anonymized or permanently deleted, except for records we are required to keep by law (financial records).

All data in transit is encrypted with TLS 1.3. All data at rest is encrypted with AES-256.

6. Data Sharing — Service Providers / Subprocessors

We share user data with the following named third-party service providers, exclusively to operate the Extension. Each is bound by a Data Processing Agreement and is contractually prohibited from using the data for any other purpose:

Provider	Purpose	Data shared
Stripe, Inc. (USA)	Payment processing, billing	Email, name, billing address, card data (handled directly by Stripe — never touches Pragmaz servers)
Google LLC (Google Cloud Platform, USA + Brazil)	Backend hosting (virtual machines, managed databases)	All cloud-stored Extension data (encrypted at rest)
Amazon Web Services, Inc. (AWS, USA)	Transactional email (SES), backup storage	Email, name, transactional message bodies (license alerts, password reset)
OpenAI, L.L.C. (USA)	AI features (audio transcription via Whisper, GPT models for AI assistant)	Only the specific audio file or prompt the user explicitly submits to an AI feature. Per OpenAI policy, content sent via the API is not used to train models.
Anthropic, PBC (USA)	AI features (alternative AI provider for assistant / chatbot replies)	Only the specific prompt the user explicitly submits to an AI feature. Per Anthropic policy, API content is not used to train models.
Competent authorities	When required by law, court order, or valid request	Only data legally required and after evaluating the legitimacy of the request

7. We Do Not Sell or Transfer User Data

Pragmaz does not sell, rent, lease, or transfer user data to third parties for purposes outside the limited operational uses described in Section 6. The only "transfers" are to the subprocessors listed above, strictly to deliver the contracted service.

We do not use user data for:

Personalized advertising or ad targeting (on Pragmaz, on third-party platforms, or anywhere else)
Building advertising profiles
Training generic AI models (no message content is used to train AI models by us or by our AI subprocessors via API)
Selling, renting, or licensing to data brokers
Determining creditworthiness or for lending purposes

8. WhatsApp Data — Specific Handling

Local-first by default. The Extension runs inside your browser on top of WhatsApp Web. It reads WhatsApp conversation data (messages, contacts, groups, media) locally in your browser to render Kanban CRM, message templates, and other features. Private WhatsApp messages and contact lists are not transmitted to Pragmaz servers, stored on Pragmaz infrastructure, or shared with third parties by default.

Exceptions — only on explicit user action: when you click a feature that requires cloud processing (for example: transcribe an audio with AI, ask the AI assistant about a conversation, run a chatbot flow, schedule a broadcast), the specific content you targeted is sent to the relevant cloud service (Pragmaz or AI subprocessor) for the purpose of that feature only. Nothing is sent in the background or without your explicit action.

9. International Data Transfer

Some Extension data is processed by our subprocessors in the United States. Transfers from Brazil and the European Economic Area are protected by Standard Contractual Clauses and the safeguards required by Article 33 of the LGPD and Article 46 of the GDPR. Brazilian Resolution ANPD 04/2024 is followed for international transfers.

10. Your Rights

You may exercise the following rights at any time:

Access: request a copy of personal data we hold about you.
Correction: ask us to correct inaccurate or incomplete data.
Deletion / Right to be forgotten: request deletion of your data, subject to legal retention requirements.
Portability: receive your data in a structured, machine-readable format.
Restriction: ask us to restrict processing.
Objection: object to processing based on legitimate interest.
Withdrawal of consent: withdraw consent for any processing based on consent at any time.
Complaint: file a complaint with the National Data Protection Authority of Brazil (ANPD) or your local data-protection authority.

To exercise any of these rights, email privacidade@pragmaz.ai. We will respond within 15 business days (LGPD requirement). Self-service deletion is available via the Pragmaz dashboard at pragmaz.ai/business/data-deletion.

11. Security

We use industry-standard safeguards to protect your data:

TLS 1.3 encryption in transit
AES-256 encryption at rest
Role-based access control (RBAC) — only authorized personnel can access production data, and only with audit logs
Continuous monitoring and incident response
Regular security reviews of our code and dependencies

No method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security but we strive to use commercially acceptable means of protecting your data.

12. Cookies

The Extension does not set its own first-party cookies. Third-party services we depend on (license validation, error reporting) may set their own cookies on their domains. You can control cookies through your browser settings. Refusing them may disable some features.

13. Children's Privacy

The Extension is intended for use by business professionals and is not directed at children under 13 (or 16 in the EEA / 18 in Brazil for LGPD purposes). We do not knowingly collect personal information from children. If we discover that a minor has provided us with personal information, we will delete it promptly.

14. Google API Limited Use (where applicable)

Limited Use disclosure: "The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements."

Specifically, Pragmaz's use and transfer of information received from Google APIs to any other app:

Will be used only to provide or improve user-facing features that are prominent in the Extension's user interface.
Will not be transferred to others, except as necessary to provide or improve those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
Will not be used to serve advertisements (including personalized advertisements).
Will not be read by humans, unless we have obtained your affirmative consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or our use is for internal operations and the data has been aggregated and anonymized.

15. Independence from Meta / WhatsApp

Pragmaz is an independent browser extension. We are not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc., WhatsApp LLC, or any of their subsidiaries. WhatsApp is a trademark of WhatsApp LLC. Meta is a trademark of Meta Platforms, Inc.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to active subscribers at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

17. Contact

For any questions, complaints, or requests related to this Privacy Policy or your data:

General support: contact@pragmaz.ai
Privacy / Data Protection Officer (DPO): privacidade@pragmaz.ai