1. Scope and Purpose

Swastik CRM for WhatsApp is a productivity tool designed for authorized sales representatives and staff of Swastik Jewels. The extension integrates the Swastik CRM system directly into WhatsApp Web (https://web.whatsapp.com), enabling users to:

• View and match active WhatsApp contacts with CRM customer and lead records.
• Create and update CRM leads directly from WhatsApp Web conversations.
• Send quick reply templates and jewelry catalog product links.
• Generate AI-assisted summaries of active customer chats upon explicit user request.
• Organize broadcast communications to opt-in CRM customers.

2. What User Data We Access and Collect

We access and collect only the data strictly necessary to provide the extension's stated CRM functionalities:

Data Category	Source	Purpose & Usage
Account Credentials & Session Tokens	Provided by user during extension login	Username, user ID, role, and API authentication token (JWT) are used to authenticate requests to the Swastik CRM API server. Passwords are never stored; they are only transmitted over TLS to authenticate.
WhatsApp Contact Information	Active WhatsApp Web DOM / React state (web.whatsapp.com)	The phone number and display name of the currently opened or selected WhatsApp chat are accessed locally to look up existing CRM leads, associate chat interactions, and save new customer records.
Chat Transcripts (User-Initiated AI Summary)	Active WhatsApp chat message area (web.whatsapp.com)	Only when the user clicks the "AI Summarize" button, the visible text transcript of the active chat conversation is sent to the Swastik CRM backend to generate a concise summary note for the lead record. Transcripts are never collected in the background or continuously recorded.
User-Configured Templates & Quick Replies	Created by user inside the extension	Custom quick-reply text snippets saved by the user for rapid customer responses.
Campaign Progress State	Generated during broadcast execution	Delivery status counters and campaign identifiers to allow resuming interrupted message sequences.

3. What Data We DO NOT Access or Collect

We respect user privacy and enforce strict minimization:

• We do not access or read browsing activity on any website other than WhatsApp Web (https://web.whatsapp.com).
• We do not read or monitor personal messages in unselected chats or background conversations.
• We do not collect credit card numbers, payment banking details, or biometric information.
• We do not use cookies, advertising identifiers, or analytics tracking scripts.

4. Data Storage and Retention

Local Storage: Authentication tokens, user display names, user IDs, user roles, API configuration URLs, quick reply templates, and campaign resume states are stored locally in the browser using the Chrome Storage API (chrome.storage.local). This data remains strictly sandboxed within your local Chrome profile.

• Immediate Deletion on Logout: When you click "Log Out" in the extension popup or sidebar, your authentication token, user ID, and username are immediately and permanently erased from chrome.storage.local.
• Uninstallation: Uninstalling the extension completely removes all locally stored data from your device.
• Backend CRM Retention: Customer and lead records saved to the Swastik CRM backend are retained according to Swastik Jewels' enterprise CRM data retention policies and applicable business compliance laws.

5. Data Transmission and Third-Party Sharing

All network transmissions occur over encrypted HTTPS/TLS connections:

• Swastik CRM API: Data is transmitted exclusively to authorized Swastik backend endpoints (https://backend-api.swastikjewel.in/api).
• Catalog Media CDNs: The extension accesses verified image hosts (Cloudinary, Cloudflare R2, and Shopify CDN) solely to retrieve jewelry catalog product photos for previewing and sharing.
• No Third-Party Sale: We never sell, rent, lease, or monetize your personal or customer data to third parties, data brokers, advertising networks, or market research firms.
• No Targeted Advertising: Data collected by the extension is never used for personalized advertising or profiling.

6. Google Chrome Web Store User Data Policy Compliance

7. Permissions Justification

The extension requests only the minimum necessary permissions:

• storage: Required to store authentication session tokens and user quick reply templates locally within Chrome.
• host_permissions:
  • https://web.whatsapp.com/*: Required to inject the CRM sidebar and detect active customer contacts.
  • https://*.swastikjewel.in/*: Required to communicate with the Swastik CRM API backend.
  • https://res.cloudinary.com/*, https://*.cloudinary.com/*, https://*.r2.dev/*, https://*.cloudflarestorage.com/*: Required to fetch product catalog imagery for jewelry items.

Note: The activeTab permission has been completely removed as it is not required for the extension's operation.

8. Security Measures

We implement industry-standard administrative, technical, and physical safeguards:

• All data in transit is protected using Transport Layer Security (TLS 1.2+).
• Local storage is isolated to the extension's secure sandbox.
• API communication requires bearer token authentication with expiration intervals.

9. User Rights and Deletion Requests

Users have the right to access, rectify, or delete their personal data:

• Local Data: Clear local extension data anytime by logging out or uninstalling the extension.
• CRM Data: To request access to, modification of, or deletion of customer records stored in the Swastik CRM backend, please contact our support team.

10. Contact Us