ChatXport Web Privacy Policy
The short version
ChatXport Web runs in your browser. When you open a WhatsApp export, the file and everything in it (messages, photos, videos, documents) is read and processed only on your own device. We never receive it, upload it, or send it anywhere. So you can pick up where you left off, your most recent chat may be kept locally on your own device, and you can clear it at any time. We do not require an account.
We do collect a small amount of information needed to run the website, take payment, and provide support. That is what this policy explains.
1. Your chat files never leave your device
The core function of ChatXport Web, reading and displaying your WhatsApp export, happens entirely inside your browser using local processing. Your chat content and media are not transmitted to us or to any third party. We have no access to them and no copy of them. So that you can resume your last session, ChatXport may keep your most recent chat in local storage in your browser, on your own device. That copy stays on your device, is never sent anywhere, and you can remove it at any time using the Discard control or by clearing your browser data.
2. Information we collect
We do not collect your chat content. The limited information we do handle is:
a. Technical and usage data. Like most websites, our hosting provider automatically records standard request data when you visit, such as your IP address, browser type and version, device and operating system, referring page, and the date and time of requests. This is used for security, abuse prevention, and keeping the Service running.
b. Cookies and similar technologies. We use cookies as described in Section 6.
c. Payment information. If you purchase the full version, payment is handled by our payment processor, Pesapal and any associated card networks. They collect the information needed to process your payment. We do not receive or store your full card number. We may receive limited transaction details such as your name, email address, an order or transaction reference, the amount, and whether the payment succeeded.
d. Information you send us. If you email support, we receive your email address and whatever you include in your message.
3. How we use information
We use the information above to operate and secure the Service, process and confirm payments, deliver the full-version unlock to you, respond to support requests, detect and prevent fraud and abuse, and comply with legal obligations. We do not use your information for advertising and we do not sell it.
4. Legal bases
Where the law requires a legal basis for processing, we rely on: performance of a contract (to provide the Service and the paid unlock you purchase), our legitimate interests (to secure and improve the Service and prevent abuse), your consent (for non-essential cookies, where applicable), and compliance with legal obligations.
5. Sharing and third parties
We share information only with service providers that help us run the Service, and only as needed:
- Hosting and delivery: Cloudflare, which serves the website and processes request logs as described above.
- Payments: Pesapal and associated payment networks, which process your payment under their own privacy terms.
We do not sell your personal information. We may disclose information if required by law, to enforce our terms, or to protect our rights, users, or the public.
6. Cookies
We use cookies that are strictly necessary for the Service to function and to remember your full-version unlock on your device. We do not use third-party analytics cookies that track your activity across the web. We use Google Search Console, a tool that reports aggregate search performance to us from Google's side and does not place tracking cookies on your device. You can control cookies through your browser settings; disabling necessary cookies may break parts of the Service.
7. Data retention
We keep technical logs and payment records only as long as needed for the purposes above or as required by law (for example, tax and accounting rules in Kenya). Because we never receive your chat content, there is nothing of that kind for us to retain or delete.
8. International transfers
Our hosting and content-delivery provider (Cloudflare) may process the limited technical and log data described above on servers outside Kenya. Our email provider (GoDaddy, United States) processes support emails you send us. Our payment provider (Pesapal) processes payments within Kenya. Where personal data is transferred outside Kenya, we rely on the safeguards required under Sections 48 to 50 of the Data Protection Act, 2019 and on those providers' own protections.
9. Your rights
Subject to the Kenya Data Protection Act, 2019 and applicable law, you may have the right to access the personal data we hold about you, ask us to correct or delete it, object to or restrict certain processing, and withdraw consent. To exercise any of these, contact us at hello@chatxport.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
10. Registration status and ongoing obligations
We have assessed our status under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. Based on our annual turnover (below KES 5,000,000), our number of employees (fewer than 10), and the fact that we do not process personal data for any of the listed non-exempted categories, we currently fall within the exemption from mandatory registration.
This exemption applies only to registration. We remain fully bound by the Data Protection Act, 2019, including maintaining a lawful basis for processing, honouring your rights, following the cross-border transfer rules in Sections 48 to 50, keeping appropriate technical and organisational security measures, notifying the ODPC of any qualifying personal data breach within 72 hours, and keeping this privacy policy published and current.
11. Security
We use reasonable technical and organizational measures to protect the limited information we handle. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. The strongest protection for your chat data is structural: it never reaches us in the first place.
12. Children
The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will address it.
13. Changes to this policy
We may update this policy from time to time. We will post the updated version here and change the effective date above. Significant changes will be made reasonably clear.
14. Contact
The Baobab Collective Ltd Email: hello@chatxport.com
For any data protection questions or to exercise your rights, contact us at the same address, hello@chatxport.com.