Privacy Policy

Effective Date: August 2026
Product: Wasf Chrome Extension

This Privacy Policy explains how Wasf Chrome Extension collects, uses, stores, and shares the limited user data necessary to provide its functionality, including authentication, AI content generation, subscription management, abuse prevention, and limited product analytics.

---

1. Information We Collect

We collect and process only the minimum data reasonably necessary to operate and improve the extension's core functionality.

1.1 Authentication Data

When you sign in using Google OAuth, we may receive:

• Email address
• Google user ID
• Basic profile information, such as name and avatar, if provided by Google

Purpose:

• User authentication
• Session management
• Subscription and access control
• Preventing unauthorized use and abuse

Authentication data is required to securely identify users and maintain access to the service across the extension and backend systems.

1.2 User-Provided Input Data (AI Processing)

We process text explicitly entered or submitted by the user for AI generation, such as:

• Product title
• Product description
• Product attributes, such as size, color, and features

Scope Limitation:

• Only product-related fields required by the feature are processed
• No full-page content is intentionally collected
• No browsing history is collected
• No customer data, order data, or unrelated store information is intentionally collected

The extension is designed to process product-related content only. Users are responsible for ensuring that they do not intentionally enter customer personal data or other sensitive information into AI generation fields.

Purpose:

This data is used to generate AI-based product titles and descriptions.

1.3 Minimal Operational Usage Data

We store limited technical records required to operate the service, including:

• Feature used
• Timestamp of request
• Credit consumption amount
• Success or failure status

Purpose:

• Credit usage tracking
• Billing reconciliation
• Fraud and abuse prevention
• Operational troubleshooting

These operational records are not used to create behavioral profiles, serve personalized advertising, or track users across unrelated websites.

1.4 Authentication Tokens

Authentication and session-related tokens may be stored locally using Chrome's storage API (chrome.storage.local).

Purpose:

• Maintaining the authenticated session
• Communicating securely with backend services

Tokens are handled by the extension and backend authentication system according to their respective session and security mechanisms.

1.5 Limited Sign-Up Analytics

Wasf uses Google Analytics 4 (GA4) through a server-side Measurement Protocol integration to measure the completion of user registration.

When a new user successfully creates an account, Wasf may send a sign_up event to Google Analytics containing:

• A pseudonymous internal user identifier (Supabase user ID)
• A server-generated synthetic client identifier
• The registration method, such as google

The analytics event does not intentionally include:

• Email address
• Name
• Avatar
• Authentication tokens
• Product content
• Customer or order information
• Browsing history
• Session identifiers

The synthetic client identifier is not a browser _ga cookie and is not intended to represent a real browser client ID. It is generated server-side to satisfy the GA4 Measurement Protocol requirements for the web data stream. It is not used to reconstruct browser sessions, browsing history, or traffic-source behavior.

Purpose:

• Measure successful registrations
• Understand basic product adoption
• Monitor registration flow performance
• Improve the reliability and usability of the service

This analytics integration is limited to product and operational measurement. We do not use this registration event to serve personalized advertising or to track users across unrelated websites.

2. Data We Do NOT Collect

• Customer data from Salla stores
• Orders or transaction history from Salla
• Payment card or banking information
• Full HTML content of web pages
• Browsing history
• Cross-site browsing activity
• Authentication tokens sent to Google Analytics
• Product content sent to Google Analytics

3. Data Scope Limitation (Content Script Access)

The extension uses Chrome content scripts restricted to the Salla product editing environment and the product-related elements required for its functionality.

Access is limited to information required for:

• Product name input
• Product description
• Product attributes entered for AI generation

Technical Restrictions:

• No intentional full-page DOM collection
• No intentional HTML or page snapshot extraction
• No browsing-history collection
• No intentional access to customer or order information
• No collection of unrelated Salla analytics information

No raw page snapshots or browsing history are transmitted outside the extension.

4. Data Usage and Flow

Data processing is initiated by user actions or by backend operations necessary to complete a requested service, such as account creation, AI generation, subscription management, or credit enforcement.

The extension uses collected data strictly for:

• AI content generation
• Authentication and session management
• Subscription and credit management
• Fraud and abuse prevention
• Limited registration and product analytics
• Operational monitoring and service improvement

We do not use the extension to monitor general browsing activity, build advertising profiles, or track users across unrelated websites.

5. Data Storage

5.1 Local Storage (Browser)

Depending on the extension's functionality, the following may be stored locally:

• Authentication/session information
• User preferences

Local data remains within Chrome's extension storage environment unless the extension's functionality requires communication with the backend.

5.2 Backend Storage (Supabase)

Our backend infrastructure uses Supabase to securely store and process:

• User account data
• Subscription status
• Credit and usage records
• Operational system events
• Limited registration event records used for analytics delivery and idempotency

The registration tracking record contains a user identifier, a synthetic client identifier, event status, response status, and timestamps.

The registration tracking table is protected by Row-Level Security (RLS) and is not exposed for direct client access.

6. Third-Party Services

6.1 OpenAI

Used for AI-assisted product content generation.

Shared data may include:

• Product text inputs submitted for generation

Not intentionally shared:

• Authentication tokens
• Unrelated page content
• Customer or order information

6.2 Google OAuth

Used for user authentication.

Data received may include:

• Email address
• Google user ID
• Basic profile information

6.3 Google Analytics 4

Used for limited product and registration analytics.

Wasf sends a server-side sign_up event when a new account is created. The event contains a pseudonymous internal user identifier, a synthetic client identifier, and the registration method.

Wasf does not intentionally send email addresses, names, authentication tokens, product content, customer data, order data, or browsing history to Google Analytics as part of this registration event.

Google Analytics processes the data according to Google's applicable privacy and service policies. Analytics identifiers and User-ID data must be handled in accordance with applicable Google Analytics policies and applicable privacy laws.

6.4 Lemon Squeezy

Used for subscription and billing management.

Shared data may include:

• User or account identifier
• Selected subscription plan
• Information required to process or reconcile subscriptions

Payment card information is handled by the payment provider and is not stored by the Chrome extension itself.

6.5 Supabase

Used for backend infrastructure, authentication-related services, database storage, Edge Functions, and secure API processing.

Supabase may process:

• User account information
• Subscription and credit information
• Operational records
• Registration tracking records

7. Data Retention

• Active account data is retained while the account is active and as necessary to provide the service.
• Billing and subscription records may be retained as necessary for financial reconciliation, fraud prevention, security, and legal obligations.
• Operational usage and system records may be retained as necessary for service operation, security, and troubleshooting.
• Registration tracking records may be retained as necessary for analytics delivery, duplicate-event prevention, monitoring, and service operation.
• Local extension data may remain until logout, removal, or clearing of the extension's stored data.

Retention periods may vary depending on the type of data and the operational or legal purpose for which it is retained.

8. User Rights

• Request access to personal data associated with your account
• Request deletion of your account and associated personal data, subject to applicable legal and operational requirements
• Revoke authentication by logging out or removing the extension
• Stop using the extension at any time

For privacy-related requests, contact us at the email address below.

9. Security and Limited Use

Wasf follows data minimization and security principles appropriate to the extension's functionality.

• Data is processed only for disclosed purposes
• Authentication and backend communication use secure HTTPS connections
• Backend database access is protected by server-side controls and Row-Level Security where applicable
• Analytics data is limited to product and registration measurement
• No user data is used for personalized or interest-based advertising through the extension
• No browsing history is collected or sold
• No user data is sold to data brokers or resellers

Our use of information received through Google APIs and extension permissions is intended to comply with the Chrome Web Store User Data Policy and its Limited Use requirements.

10. Contact

Email: [email protected]